b1ef8c9a7fcae8913f3f234c7bdb25574f18d4a61cb3f66fcd0f1ef64e789cdb

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 00:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

226af8e6c421a66bd00cc9f33c4c3021_JaffaCakes118.html
Size

37KB
MD5

226af8e6c421a66bd00cc9f33c4c3021
SHA1

1869670ad035b49bcad9bb3b7197986c41265e60
SHA256

b1ef8c9a7fcae8913f3f234c7bdb25574f18d4a61cb3f66fcd0f1ef64e789cdb
SHA512

b0f450f28c74ed418c5ce255f9c8252b05729ef1ef735b3e9ea744fd2e5928d170ce09c1e2925f4dae5e104d34575db0210ef2a13b9604dd9a1c6e3732057f39
SSDEEP

768:34OL9aMwZY/GrRqsymlUrIzcfmULbb/yKdYv2gC6PWRWFEP6tHfz5:31aMwZY/GVDymlUkzcfm2X/zdYOgx0S3

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1384	msedge.exe
1384	msedge.exe
2180	msedge.exe
2180	msedge.exe
4928	identity_helper.exe
4928	identity_helper.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 396	2180	msedge.exe	83
PID 2180 wrote to memory of 396	2180	msedge.exe	83
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 3692	2180	msedge.exe	84
PID 2180 wrote to memory of 1384	2180	msedge.exe	85
PID 2180 wrote to memory of 1384	2180	msedge.exe	85
PID 2180 wrote to memory of 4048	2180	msedge.exe	86
PID 2180 wrote to memory of 4048	2180	msedge.exe	86
PID 2180 wrote to memory of 4048	2180	msedge.exe	86
PID 2180 wrote to memory of 4048	2180	msedge.exe	86
PID 2180 wrote to memory of 4048	2180	msedge.exe	86
PID 2180 wrote to memory of 4048	2180	msedge.exe	86
PID 2180 wrote to memory of 4048	2180	msedge.exe	86
PID 2180 wrote to memory of 4048	2180	msedge.exe	86
PID 2180 wrote to memory of 4048	2180	msedge.exe	86
PID 2180 wrote to memory of 4048	2180	msedge.exe	86
PID 2180 wrote to memory of 4048	2180	msedge.exe	86
PID 2180 wrote to memory of 4048	2180	msedge.exe	86
PID 2180 wrote to memory of 4048	2180	msedge.exe	86
PID 2180 wrote to memory of 4048	2180	msedge.exe	86
PID 2180 wrote to memory of 4048	2180	msedge.exe	86
PID 2180 wrote to memory of 4048	2180	msedge.exe	86
PID 2180 wrote to memory of 4048	2180	msedge.exe	86
PID 2180 wrote to memory of 4048	2180	msedge.exe	86
PID 2180 wrote to memory of 4048	2180	msedge.exe	86
PID 2180 wrote to memory of 4048	2180	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\226af8e6c421a66bd00cc9f33c4c3021_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffefc9446f8,0x7ffefc944708,0x7ffefc944718
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,7079716080806737143,4615353213528452043,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,7079716080806737143,4615353213528452043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,7079716080806737143,4615353213528452043,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7079716080806737143,4615353213528452043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7079716080806737143,4615353213528452043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7079716080806737143,4615353213528452043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,7079716080806737143,4615353213528452043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,7079716080806737143,4615353213528452043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7079716080806737143,4615353213528452043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7079716080806737143,4615353213528452043,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7079716080806737143,4615353213528452043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3088 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,7079716080806737143,4615353213528452043,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,7079716080806737143,4615353213528452043,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4996 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2a70f1bd4da893a67660d6432970788d

SHA1
ddf4047e0d468f56ea0c0d8ff078a86a0bb62873

SHA256
c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561

SHA512
26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fbe1ce4d182aaffb80de94263be1dd35

SHA1
bc6c9827aa35a136a7d79be9e606ff359e2ac3ea

SHA256
0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51

SHA512
3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
458B

MD5
7fa91520f8a1bb1c1040246ab646c7f4

SHA1
5fea84d432b319fe2273a6dcc12c06991c081b0c

SHA256
381109777dd524fccc9df7b974874b4194e9421fcf38c56694e7ab5f209112c9

SHA512
3fa7e933a76c12aaee8897275c00fbb9114a8174e83c619a1789ac506a012ad931b9b0c207cc3951d2cc8cfb66f4465258b18b89dde49d170b71f584020cfce7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bcd97a9dba70dafe33b10285ef06ece7

SHA1
e981790db704848ce97064a4bf19d1a05d4d0eea

SHA256
18c88cbe532cd8d474d913a0ba9ae0cb9e75e37a36fbfb107d0a0322b2330406

SHA512
dd055df0084e66dbbf699b2b0ba6bc4645a257ef6d560dd988c4ec2020d72701edd548874c502528dab23e4a01b3e268612f102cf68a981516dda0a24925e764

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4cc619e57efd7f1b0c5dd6b5213a6c72

SHA1
1b3ccd220790014399dd97182b8b4168c6a82a3e

SHA256
30dc5ae2a6f6ca74033c3e39d4c4f532ba2d7e16771113b7551b1e8359dd0f53

SHA512
2642482cbb12ac4c7a038d834be59f69c66df30de5b68021b8e469ef9dc40e4b2155409afbd238c9aeea887c6c6a20ade318c1a1280c70d806c1b752204b32ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2056a669ea67aeba205197de4764c4a7

SHA1
5b003e6aa87628e56b27b032fa1d8bab9bc51903

SHA256
e196add44de9ed64f4003341177b278afab2e0103ecc0576af53615432d4be75

SHA512
06fa6f7858147489b02bd453325efb95eb4a75941b53265d4855cc7af1dd097c65f32d89d0f41f69dfe3361299a6979482d6dffc6b1b6de945ac94129b4f670e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f75846fd1e9b28f5d66e9f73dcd6d653

SHA1
ef713f10c6f960e1ad716e404e9ff69d878a86ed

SHA256
c6c904883a820ed0fe2b3968d2e67dc7a06324beef3db11c8f8ed7cd67ba3a5e

SHA512
bf32cf35497ae5c5a54f5c599136f7e1953e36c2fd22289b3b8f365b6b9d7f0323c027edc7c2e4c0b9eb8fedfbc7cc07e0d1f38c2fea940e99c2c182bd9c8459

Download Submit