b8d515ae766311b3a4ab48430c4a644053e018c057ff1f350a6670e8a1031696

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 06:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23a6788a4591f77c1a6b660ae196c511_JaffaCakes118.html
Size

36KB
MD5

23a6788a4591f77c1a6b660ae196c511
SHA1

c071531e401291cbfdb06ed54f075894c17e3f5a
SHA256

b8d515ae766311b3a4ab48430c4a644053e018c057ff1f350a6670e8a1031696
SHA512

19b7fca0abc3264b014eee4be0e723291af7614b2f2f2286cb88bc97b5ab7652fdd665dabf77d9a9da57946c1240b5800c6358fd8b255b278a4cfbab76fccb35
SSDEEP

768:zwx/MDTHjr88hAR7ZPXuE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6ThZOg6f9U56lLRF:Q/vbJxNVNufSM/P8kK

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2952	msedge.exe
2952	msedge.exe
4888	msedge.exe
4888	msedge.exe
3804	identity_helper.exe
3804	identity_helper.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 3976	4888	msedge.exe	87
PID 4888 wrote to memory of 3976	4888	msedge.exe	87
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 1168	4888	msedge.exe	88
PID 4888 wrote to memory of 2952	4888	msedge.exe	89
PID 4888 wrote to memory of 2952	4888	msedge.exe	89
PID 4888 wrote to memory of 3276	4888	msedge.exe	90
PID 4888 wrote to memory of 3276	4888	msedge.exe	90
PID 4888 wrote to memory of 3276	4888	msedge.exe	90
PID 4888 wrote to memory of 3276	4888	msedge.exe	90
PID 4888 wrote to memory of 3276	4888	msedge.exe	90
PID 4888 wrote to memory of 3276	4888	msedge.exe	90
PID 4888 wrote to memory of 3276	4888	msedge.exe	90
PID 4888 wrote to memory of 3276	4888	msedge.exe	90
PID 4888 wrote to memory of 3276	4888	msedge.exe	90
PID 4888 wrote to memory of 3276	4888	msedge.exe	90
PID 4888 wrote to memory of 3276	4888	msedge.exe	90
PID 4888 wrote to memory of 3276	4888	msedge.exe	90
PID 4888 wrote to memory of 3276	4888	msedge.exe	90
PID 4888 wrote to memory of 3276	4888	msedge.exe	90
PID 4888 wrote to memory of 3276	4888	msedge.exe	90
PID 4888 wrote to memory of 3276	4888	msedge.exe	90
PID 4888 wrote to memory of 3276	4888	msedge.exe	90
PID 4888 wrote to memory of 3276	4888	msedge.exe	90
PID 4888 wrote to memory of 3276	4888	msedge.exe	90
PID 4888 wrote to memory of 3276	4888	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\23a6788a4591f77c1a6b660ae196c511_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd04646f8,0x7ffcd0464708,0x7ffcd0464718
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,9416785261612467444,2452660694927114187,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,9416785261612467444,2452660694927114187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,9416785261612467444,2452660694927114187,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9416785261612467444,2452660694927114187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9416785261612467444,2452660694927114187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,9416785261612467444,2452660694927114187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,9416785261612467444,2452660694927114187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9416785261612467444,2452660694927114187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9416785261612467444,2452660694927114187,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9416785261612467444,2452660694927114187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9416785261612467444,2452660694927114187,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,9416785261612467444,2452660694927114187,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5432 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2a70f1bd4da893a67660d6432970788d

SHA1
ddf4047e0d468f56ea0c0d8ff078a86a0bb62873

SHA256
c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561

SHA512
26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fbe1ce4d182aaffb80de94263be1dd35

SHA1
bc6c9827aa35a136a7d79be9e606ff359e2ac3ea

SHA256
0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51

SHA512
3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
613B

MD5
cee9794facee7c1afda3255c4e3204ae

SHA1
6ced1660e424b49d69fcf5d55125ec3e71633059

SHA256
36d3ac682b2eaa48f829b87c17b8a8db9e638f3bd0a22e713599a179320a2d03

SHA512
bc791b5bf020418ae4aa5d87320646cb9c9d4171405155f98c819d1dc78eb6ef17704d2dfc3e4e2cbd6eb97c5369f9811d0a82ef97ce0303790627d3ebc91381

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e70dc6d4cb144736fb86ace8fd59cd1d

SHA1
fd87b060f1cfbef75a36a0ddc5d42b902374bd5a

SHA256
8c4b91de77c1f57691833dd915a1418f1e544dec8c74cd0b041bbc41cd32289d

SHA512
6a9e95bbe123ca7170c50dca1ac89eeb7382700f1b483d8579b09960508438df2e792ca9e563f589c89e2938973ac8e87b226b4d33a403541142281f686eb0dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b0d472392f796a96a556f0382b43ed6e

SHA1
c6d55ee14997c2b5b50236837737900c70cc53bc

SHA256
34fe3e4503afc0bd7887343c5e37e25d1634d9559ad77ff5a3209596d1f655eb

SHA512
0d97fd4bc73479528415606645dce824be39262b60d635a79b3f3a204d81dd8f30e2a11516a684c5fc9811df90e348f8b740c6a7316a72ef69eaaba8877b4f43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f4e7cccee6633da721991157cac2eeb5

SHA1
bbaf20c9544fde1703dac5b0e9579c19179970ad

SHA256
ab003b2ef8df5e09fb61316d34a37c60355409b63081353ac4b5f1260f93a9ca

SHA512
3b1aa80231964b25c7b7f2da9ec671a8d7dc7ae14a534069241f8e6e25ce5ec16d16f6897acf533650822e05cb4bde11439e3f35d3b847abaf53df476c1d1e0e

Download Submit