8aa68e5f757e24dcee1a9d1e8403d843d76461a09a1af0a3b0d4642a91edc969

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23ab7a0413785c5a4016037c3e8e7ac5_JaffaCakes118.html
Size

34KB
MD5

23ab7a0413785c5a4016037c3e8e7ac5
SHA1

2d3fd48aa387eda48c79b75bc7914bf9305c2d1d
SHA256

8aa68e5f757e24dcee1a9d1e8403d843d76461a09a1af0a3b0d4642a91edc969
SHA512

3328cbe91e8a9433a753edafcc4ae3966e186be38dfc34dfe264ad9338817ef9a78973958e34f505266ddc5c27704f9e196fa61b99222db4e7d12b69b3832ca5
SSDEEP

768:0LSFQW81D4RA+vEOjz6rdG2Gil54RZfPGnf3Gu34ani6781DdRA4vEOjq6h8aRlv:vFQW81D4RA+vEOjz6raAhIaiC81DdRAY

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1496	msedge.exe
1496	msedge.exe
4852	msedge.exe
4852	msedge.exe
1948	identity_helper.exe
1948	identity_helper.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 2300	4852	msedge.exe	86
PID 4852 wrote to memory of 2300	4852	msedge.exe	86
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 5116	4852	msedge.exe	87
PID 4852 wrote to memory of 1496	4852	msedge.exe	88
PID 4852 wrote to memory of 1496	4852	msedge.exe	88
PID 4852 wrote to memory of 1636	4852	msedge.exe	89
PID 4852 wrote to memory of 1636	4852	msedge.exe	89
PID 4852 wrote to memory of 1636	4852	msedge.exe	89
PID 4852 wrote to memory of 1636	4852	msedge.exe	89
PID 4852 wrote to memory of 1636	4852	msedge.exe	89
PID 4852 wrote to memory of 1636	4852	msedge.exe	89
PID 4852 wrote to memory of 1636	4852	msedge.exe	89
PID 4852 wrote to memory of 1636	4852	msedge.exe	89
PID 4852 wrote to memory of 1636	4852	msedge.exe	89
PID 4852 wrote to memory of 1636	4852	msedge.exe	89
PID 4852 wrote to memory of 1636	4852	msedge.exe	89
PID 4852 wrote to memory of 1636	4852	msedge.exe	89
PID 4852 wrote to memory of 1636	4852	msedge.exe	89
PID 4852 wrote to memory of 1636	4852	msedge.exe	89
PID 4852 wrote to memory of 1636	4852	msedge.exe	89
PID 4852 wrote to memory of 1636	4852	msedge.exe	89
PID 4852 wrote to memory of 1636	4852	msedge.exe	89
PID 4852 wrote to memory of 1636	4852	msedge.exe	89
PID 4852 wrote to memory of 1636	4852	msedge.exe	89
PID 4852 wrote to memory of 1636	4852	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\23ab7a0413785c5a4016037c3e8e7ac5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3a5f46f8,0x7ffa3a5f4708,0x7ffa3a5f4718
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,16506433451045325446,2895306280690180207,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,16506433451045325446,2895306280690180207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,16506433451045325446,2895306280690180207,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16506433451045325446,2895306280690180207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16506433451045325446,2895306280690180207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,16506433451045325446,2895306280690180207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,16506433451045325446,2895306280690180207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16506433451045325446,2895306280690180207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16506433451045325446,2895306280690180207,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16506433451045325446,2895306280690180207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16506433451045325446,2895306280690180207,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,16506433451045325446,2895306280690180207,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4820 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
572B

MD5
c4b3bf0653a3194639230238b820db79

SHA1
7ff403e59757a29e77f2d209e7b20e1a8a6bd83c

SHA256
de1ee3e5bfb057124c2db37c593594392cbadaf974a266f3b29afc04a060cf28

SHA512
1beb53fde30614b4dfce8c054553c4acc1735837a0381fe2ea7630b7c7e3010cabb6466d0d6ab771182cc9bf4f7f301a1c07b9e0c403693ed1d4a3fd6a161681

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5948acaa5b38b944b7d66cd2b353d56c

SHA1
d330a1bbcae1682b6044571c47f11855f9d3f824

SHA256
05052a965dcdc9e9bca9e189d6fab8f12ad2d954e9bd3e0bb91e2572966252ea

SHA512
2dce0eddfeb8ab178799ed3dd5c88c327e4a221f57addb041d596f6cd14a73a70cd0023c3ccf7b64a7ea1fa3c4c336c69978d3b2609de685d0c712172758f3b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c0689a38-0d2f-4114-854a-dd1f89d5259f.tmp

Filesize
5KB

MD5
a3f23628fdeb7b00a37a46343973377f

SHA1
075dbab846d75c128becf68a93d46efee13085f0

SHA256
54da7164917be0ed717b0c501c2228788f63547224d20376a267ee8376a4935c

SHA512
e45cb65eb30169e5dc0ca73da7df124461f1fcaa98b04a8703eda883763f412ce3349a7ed0508527bb70b3bcab124739e96e9ce5a0351d65e6ec801b9a2c2a21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
03bb41b899573f3b12002ff2a4bd3e39

SHA1
fb199bdae012ece2a1942c79f1b421395e6f5168

SHA256
5a508b0cef8948e73cbbfa4b7837aa4ab22f09e6eb7e9757e7e976d40e48004d

SHA512
717c3f19d1858ae2a6907ada87220f28d5645826a7c27103a3c8a1541d793cc29c7aa453c6d7184710d77dabecadb161d32c232de711bc1a3fbc3cce9c659a75

Download Submit