7251f5d7d5aaafa0f2527ca9c3895112289a7e252ce88a602f985db7114b075f

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 08:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23fef1b86a8edc1661b44209d1d0f753_JaffaCakes118.html
Size

39KB
MD5

23fef1b86a8edc1661b44209d1d0f753
SHA1

d0b0ce8976bb71a2314dc2c0912a605647e86d5a
SHA256

7251f5d7d5aaafa0f2527ca9c3895112289a7e252ce88a602f985db7114b075f
SHA512

f05bb4c091fcdbcf0bc1da347b8a9d1fa9bb0abc85f8da942134c6288a95a50ccadd1005849941c1fc78de3ae5cc87a838f71aa64459ea2ec0723c871e2a6a43
SSDEEP

192:uwnmb5nBGi4nQjxn5Q/1nQiewNnKrnQOkEntv3nQTbnJnQmSqxbRnsMdyZj6NFB5:KQ/oAhxmoy9O7WquQW3pJg7

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
3636	msedge.exe
3636	msedge.exe
856	identity_helper.exe
856	identity_helper.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe
5940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 5052	3636	msedge.exe	84
PID 3636 wrote to memory of 5052	3636	msedge.exe	84
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4980	3636	msedge.exe	85
PID 3636 wrote to memory of 4900	3636	msedge.exe	86
PID 3636 wrote to memory of 4900	3636	msedge.exe	86
PID 3636 wrote to memory of 1016	3636	msedge.exe	87
PID 3636 wrote to memory of 1016	3636	msedge.exe	87
PID 3636 wrote to memory of 1016	3636	msedge.exe	87
PID 3636 wrote to memory of 1016	3636	msedge.exe	87
PID 3636 wrote to memory of 1016	3636	msedge.exe	87
PID 3636 wrote to memory of 1016	3636	msedge.exe	87
PID 3636 wrote to memory of 1016	3636	msedge.exe	87
PID 3636 wrote to memory of 1016	3636	msedge.exe	87
PID 3636 wrote to memory of 1016	3636	msedge.exe	87
PID 3636 wrote to memory of 1016	3636	msedge.exe	87
PID 3636 wrote to memory of 1016	3636	msedge.exe	87
PID 3636 wrote to memory of 1016	3636	msedge.exe	87
PID 3636 wrote to memory of 1016	3636	msedge.exe	87
PID 3636 wrote to memory of 1016	3636	msedge.exe	87
PID 3636 wrote to memory of 1016	3636	msedge.exe	87
PID 3636 wrote to memory of 1016	3636	msedge.exe	87
PID 3636 wrote to memory of 1016	3636	msedge.exe	87
PID 3636 wrote to memory of 1016	3636	msedge.exe	87
PID 3636 wrote to memory of 1016	3636	msedge.exe	87
PID 3636 wrote to memory of 1016	3636	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\23fef1b86a8edc1661b44209d1d0f753_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff95ad46f8,0x7fff95ad4708,0x7fff95ad4718
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,12601001950728172464,14700638384343527313,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,12601001950728172464,14700638384343527313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,12601001950728172464,14700638384343527313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12601001950728172464,14700638384343527313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12601001950728172464,14700638384343527313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,12601001950728172464,14700638384343527313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,12601001950728172464,14700638384343527313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12601001950728172464,14700638384343527313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12601001950728172464,14700638384343527313,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12601001950728172464,14700638384343527313,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12601001950728172464,14700638384343527313,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,12601001950728172464,14700638384343527313,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3004 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7c87ee1f3f0f69bf5e57e07be8da4c4e

SHA1
c68598159f3332dce7439c283db86e15403f3417

SHA256
2d4509dc32037c6ef63c395df80e150fe29b0e63e07476bd1afca17293299c6c

SHA512
3940f2271ae18566530e72e7679fded0950e162ad4446967365cfd439ead8c37c80026aeac969b51de66bf831b6cd1d2760135c9e1bcce05a2f0029fb77fc488

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
98daca033bf428e0fd6af1b210c5eed8

SHA1
ccf6b502cf1499ec1d1268119ceb08abbc2418c6

SHA256
5fabb7330310986ef4c199e6ee29ea0f41a40aee49b65584aed689865cf80cd8

SHA512
8253a65642a96cbc5558bc5534abfa7783a1fd2410a250f0a09e06a6a895c6fa5418ebb18a06a12f1d86dec8cd25626851beca5849c69931eccbace1fb5a025c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9a4691c5a718a1837e27f61e3f4b5bc4

SHA1
95f256c5eeb621e497084ccfc069ad6bb20c16c2

SHA256
baf027a0159cc55077eac9d084f694829817e1266a18e37fec959bdeb36ce0cf

SHA512
f34ab1b0f61007cb66c8af1589a2f79cad2d85ad2b8c5d3176b2063ac0edbb5d38876a2227faf7c73e4b608bb02f2e7cff74c73a29dff3ea8cac882aba282ca7

Download Submit