b163df3f1f5251eda28df1ddfccf34def2a8e0e8d67f98d111a28fec748e1d75

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 05:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

161b3ad3a09a8e13589ca7354a1c965d_JaffaCakes118.html
Size

159KB
MD5

161b3ad3a09a8e13589ca7354a1c965d
SHA1

54faf69e601150abd7e2a68f5c4ef6d9ecdb06d7
SHA256

b163df3f1f5251eda28df1ddfccf34def2a8e0e8d67f98d111a28fec748e1d75
SHA512

0ad0d7cb54f3aba44f6517477383b215faa74872bc823da3e256cabb2fcbf2982c5576ae2cce113210c294393b94fd805829e6c152ad445125b9984cd534d264
SSDEEP

3072:SlC/3Cp9zfPyfkMY+BES09JXAnyrZalI+YQ:Sl6CXzSsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe
1060	msedge.exe
1060	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 4012	1060	msedge.exe	85
PID 1060 wrote to memory of 4012	1060	msedge.exe	85
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 4672	1060	msedge.exe	86
PID 1060 wrote to memory of 5044	1060	msedge.exe	87
PID 1060 wrote to memory of 5044	1060	msedge.exe	87
PID 1060 wrote to memory of 544	1060	msedge.exe	88
PID 1060 wrote to memory of 544	1060	msedge.exe	88
PID 1060 wrote to memory of 544	1060	msedge.exe	88
PID 1060 wrote to memory of 544	1060	msedge.exe	88
PID 1060 wrote to memory of 544	1060	msedge.exe	88
PID 1060 wrote to memory of 544	1060	msedge.exe	88
PID 1060 wrote to memory of 544	1060	msedge.exe	88
PID 1060 wrote to memory of 544	1060	msedge.exe	88
PID 1060 wrote to memory of 544	1060	msedge.exe	88
PID 1060 wrote to memory of 544	1060	msedge.exe	88
PID 1060 wrote to memory of 544	1060	msedge.exe	88
PID 1060 wrote to memory of 544	1060	msedge.exe	88
PID 1060 wrote to memory of 544	1060	msedge.exe	88
PID 1060 wrote to memory of 544	1060	msedge.exe	88
PID 1060 wrote to memory of 544	1060	msedge.exe	88
PID 1060 wrote to memory of 544	1060	msedge.exe	88
PID 1060 wrote to memory of 544	1060	msedge.exe	88
PID 1060 wrote to memory of 544	1060	msedge.exe	88
PID 1060 wrote to memory of 544	1060	msedge.exe	88
PID 1060 wrote to memory of 544	1060	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\161b3ad3a09a8e13589ca7354a1c965d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff88c4c46f8,0x7ff88c4c4708,0x7ff88c4c4718
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,6358770536785954631,9263531221169960059,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,6358770536785954631,9263531221169960059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,6358770536785954631,9263531221169960059,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6358770536785954631,9263531221169960059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6358770536785954631,9263531221169960059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,6358770536785954631,9263531221169960059,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4812 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f167982c8758e39692528cbc02e9b135

SHA1
7da57a876d838cdbcc64eae2517b89d56697288e

SHA256
76e3af88ee6f6e31211d20ae3070ddb35a86e72b65e4207d0e5769e7ed2772be

SHA512
c36e99615d6439137a25f15725b6641bff602e4c56ae033b6a0fd32bed1f395c2415e7a32d13579db2063c3b25a3c4d45cbbfa50602135807b92f2b1531d97df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
21323c26c89f82a6834c0a018f4dfc2e

SHA1
4e3a54e53af2eba31ee4738adf2edf2fe32d9e96

SHA256
4bef3114d0bc510904f2db81bfdef7009e8638c0bd41fd8e54f522f281ee078e

SHA512
3f6242f4869043c43e56f5197d2222b75910c53acb58883d015002796ff02c7adffd3ab1d7cd381942db082c9d43de1e35f209a61d86361b8529e83ac9832818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b28d846cec75daca72a65359437dc4d5

SHA1
9ef30fa84331912759b4daedcb87120d148d8d0c

SHA256
f235552e41d11fe1184d88c435c9ec7e2cc3c4c453a56dc2f5347ee2bae876fd

SHA512
4107ffcec7afd33284cb9a8a0ba511488ae650b70d2619b5b4e29647b9228b7108f3849dc6172ecffd9071564710e9c7e76c4bb8bd197aa6619f25b407268c1a

Download Submit