3edaa5a1c3e025a305aff969c52547a46994b8402448442e1c6258f0f5b4a32b

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17a8c90dbb435af68434a7f8f48bf140_JaffaCakes118.html
Size

4KB
MD5

17a8c90dbb435af68434a7f8f48bf140
SHA1

f66aa5a816d8e0b16b88cdc3921aefd3c735cdb6
SHA256

3edaa5a1c3e025a305aff969c52547a46994b8402448442e1c6258f0f5b4a32b
SHA512

647107b04e6d9a1438f1aabfe3cdcc07e3878706fe1cab04ebcae912192f430396ae0b34dd16434eb6e6b48f19a19cac5296a26c08ff855868a054e99d4d634a
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8obEBSo8t:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDc

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1456	msedge.exe
1456	msedge.exe
4324	msedge.exe
4324	msedge.exe
2684	identity_helper.exe
2684	identity_helper.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 3832	4324	msedge.exe	85
PID 4324 wrote to memory of 3832	4324	msedge.exe	85
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 4424	4324	msedge.exe	86
PID 4324 wrote to memory of 1456	4324	msedge.exe	87
PID 4324 wrote to memory of 1456	4324	msedge.exe	87
PID 4324 wrote to memory of 5092	4324	msedge.exe	88
PID 4324 wrote to memory of 5092	4324	msedge.exe	88
PID 4324 wrote to memory of 5092	4324	msedge.exe	88
PID 4324 wrote to memory of 5092	4324	msedge.exe	88
PID 4324 wrote to memory of 5092	4324	msedge.exe	88
PID 4324 wrote to memory of 5092	4324	msedge.exe	88
PID 4324 wrote to memory of 5092	4324	msedge.exe	88
PID 4324 wrote to memory of 5092	4324	msedge.exe	88
PID 4324 wrote to memory of 5092	4324	msedge.exe	88
PID 4324 wrote to memory of 5092	4324	msedge.exe	88
PID 4324 wrote to memory of 5092	4324	msedge.exe	88
PID 4324 wrote to memory of 5092	4324	msedge.exe	88
PID 4324 wrote to memory of 5092	4324	msedge.exe	88
PID 4324 wrote to memory of 5092	4324	msedge.exe	88
PID 4324 wrote to memory of 5092	4324	msedge.exe	88
PID 4324 wrote to memory of 5092	4324	msedge.exe	88
PID 4324 wrote to memory of 5092	4324	msedge.exe	88
PID 4324 wrote to memory of 5092	4324	msedge.exe	88
PID 4324 wrote to memory of 5092	4324	msedge.exe	88
PID 4324 wrote to memory of 5092	4324	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\17a8c90dbb435af68434a7f8f48bf140_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff873f446f8,0x7ff873f44708,0x7ff873f44718
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,9321706632193910646,3715704741586115396,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,9321706632193910646,3715704741586115396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,9321706632193910646,3715704741586115396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9321706632193910646,3715704741586115396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9321706632193910646,3715704741586115396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,9321706632193910646,3715704741586115396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,9321706632193910646,3715704741586115396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9321706632193910646,3715704741586115396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9321706632193910646,3715704741586115396,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9321706632193910646,3715704741586115396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9321706632193910646,3715704741586115396,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,9321706632193910646,3715704741586115396,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
292B

MD5
e307e23ee0c7b60d7ab63f6278995451

SHA1
4e44bcd2d24454b9a9f69c30e5c48c2298316591

SHA256
d8997359a6fda0c38e3e037aac6ce130dec6411efc0a1f6c15154cdc39b4d250

SHA512
db1d832756059724d54964a259393d2f9bbc84d32dbcc652da46786e02c0e23e379554675b19b21784e05777d71544f6d03ea3bde61b35372adb14901e151972

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
25a3b43310158528fcec23669617c3c1

SHA1
4a69a72b29c91f257e1c1d9190aede4152a0df3f

SHA256
7ba08a168e840cd3d06d8eaab0e5db520b8c3377ee05a3517cbe524c68a662bf

SHA512
4cf149ff7de62567a3973893796128b29f3d3ad5b46c062899f022e580fce7f7e3094e66274e3eb946df9c4d89d506d2b263ea622ea8e0a09fca3f4ee992da40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3b151afc709a76da0b96e4a10954e35d

SHA1
c8d3e4a391697f9edd3711fed7b62ddb4642e3f4

SHA256
ed215e90278a06f72d4e93461b0b1442afe1ae7d859ec7fa9f86d87f9db7517e

SHA512
fd15bfd1cb18feb1d0cd49e109de754739d2b9c125cece0aebf546828f82ecf44753d968e86cda9577ea400db2d4ffa6435739ec3f691c04e479a7360613557f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fd02146295e74f9fc5219f45df4bdecd

SHA1
5baf42c4790056c735cb75d259f065c8369cf1a8

SHA256
4c44d5565e453a0f5fcf84c0d01bcd5fa7f97b7a1f62e6ee8dccde6c031cc005

SHA512
f52f2f4a04f2b93ab32e185a17cc952be857503c73574c70995b9212344e3bc0b73c0887975bc67775d7a6fb08a828ddbe08767ec1703b7d1b873bcd56d513c5

Download Submit