45978caa487fe30226cc11e3bab5150b1f08f205e79c2de27b9334e48c3e246b

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

16ffa0de4e2e8ea4765704ad9772b395_JaffaCakes118.html
Size

161KB
MD5

16ffa0de4e2e8ea4765704ad9772b395
SHA1

3b8e08dceafaa6765af0d8feffe80c190be561d2
SHA256

45978caa487fe30226cc11e3bab5150b1f08f205e79c2de27b9334e48c3e246b
SHA512

0dfc67eb1ae40153bea2eb8291f56b06a5af2cb3679bb69e4afa19f7a7636dbf4f9c65008d323460657cf24399c5eca71dddf4fe25c8321e497cc31397bdcfd1
SSDEEP

3072:/NTSe3N2UP13G4k5QhLpOatVSTwr6/fNbYaaLStR6xWUu/v66sbsGon4G59t9Vcs:/Is3G4k5QhL8atVafNbYaaLStR6xWUuv

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3836	msedge.exe
3836	msedge.exe
3148	msedge.exe
3148	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3148 wrote to memory of 3208	3148	msedge.exe	84
PID 3148 wrote to memory of 3208	3148	msedge.exe	84
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 4028	3148	msedge.exe	85
PID 3148 wrote to memory of 3836	3148	msedge.exe	86
PID 3148 wrote to memory of 3836	3148	msedge.exe	86
PID 3148 wrote to memory of 1648	3148	msedge.exe	87
PID 3148 wrote to memory of 1648	3148	msedge.exe	87
PID 3148 wrote to memory of 1648	3148	msedge.exe	87
PID 3148 wrote to memory of 1648	3148	msedge.exe	87
PID 3148 wrote to memory of 1648	3148	msedge.exe	87
PID 3148 wrote to memory of 1648	3148	msedge.exe	87
PID 3148 wrote to memory of 1648	3148	msedge.exe	87
PID 3148 wrote to memory of 1648	3148	msedge.exe	87
PID 3148 wrote to memory of 1648	3148	msedge.exe	87
PID 3148 wrote to memory of 1648	3148	msedge.exe	87
PID 3148 wrote to memory of 1648	3148	msedge.exe	87
PID 3148 wrote to memory of 1648	3148	msedge.exe	87
PID 3148 wrote to memory of 1648	3148	msedge.exe	87
PID 3148 wrote to memory of 1648	3148	msedge.exe	87
PID 3148 wrote to memory of 1648	3148	msedge.exe	87
PID 3148 wrote to memory of 1648	3148	msedge.exe	87
PID 3148 wrote to memory of 1648	3148	msedge.exe	87
PID 3148 wrote to memory of 1648	3148	msedge.exe	87
PID 3148 wrote to memory of 1648	3148	msedge.exe	87
PID 3148 wrote to memory of 1648	3148	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\16ffa0de4e2e8ea4765704ad9772b395_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff14d946f8,0x7fff14d94708,0x7fff14d94718
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,1467117209347334920,5765421554682898157,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,1467117209347334920,5765421554682898157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,1467117209347334920,5765421554682898157,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2492 /prefetch:8
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1467117209347334920,5765421554682898157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1467117209347334920,5765421554682898157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1467117209347334920,5765421554682898157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1467117209347334920,5765421554682898157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3860 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1467117209347334920,5765421554682898157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,1467117209347334920,5765421554682898157,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5172 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
a6157c05c4dacd688a2f357dd8357cf4

SHA1
53286213b395ff32a21b1084681e0bbae9f13af4

SHA256
88e160dacc6f8f3101bf0a86a02af14a25453f7089ba35be1943a65a1c01e57b

SHA512
c8c068fc2a645648b3bc2f54c228f1473d535159326ceb52f82fab00f01ed5cd461159395e86f780ef650443bb5e5fa3c00e639ef491cee5c682701f0259c3a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
aaa0fdcad06877f6b97c2cb75e052526

SHA1
b10afa5fcb90a4c4567af95743e79dad87c491ee

SHA256
03fc61f238656eedba123e5a239378ba2afcbba9ae28a68f4f4c025da11ba5f9

SHA512
88bfafc22a179c08b05ac9e352e1ea93486ce04be73724562075ef0c1eb176561a92b013aca2375c56fb25867a25c5ba1c7b588a2fa67a908ba57399297b511f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
abd00e3a76ee56306ce2acca1ab8afc8

SHA1
14ba9090f727c6b196670f6ce32288712d14ec81

SHA256
18acaf8cc0dc6393fa1d34bf2cd1b6596baff98ffd87fc673399e2ca301f24b1

SHA512
dff782fcdfb85ee07834270c43107f95bdda71ec0745390a77cb3a6f50985f2aa0fe50907e0b7f867128526eedd7a25ea3a9e589017a763d1cbcb9a54fdcf6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0ba987772c21678136b7145a397ddcf2

SHA1
32e169dfc00c9a34389625648242007ee5927313

SHA256
8039469ba5ed6e22a1ebbc638bd8df5f9ecaee900a8f257aaaf321d3d06e6a5f

SHA512
4c2e3e006ae976ded8085a24861fb1dae006b9f698c723b143e253b59c7bae79fadb23aaf1972238104d615461c42f3a888bd9a12ca01d81c04b09bff104ca1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c3734623db214bea7beeff41141f5ae3

SHA1
635124e1ae08e20d20637b773eb123005efc8bc5

SHA256
c703031ab4209e862852a27716d332f2892b38dc85a2284dc9c5aabef177ce4d

SHA512
8cb034311c26986aedb1e4e2af0ea6cfb43ab55383b07303f8a7d57966504d525b27d5f51d6b9c5cc9c11f7bec091094b7aa0d1d97840d26562c47482669fc87

Download Submit