cd42eda0a40b7b25417967f8591ebb007facda989178168760a9a08b25654ce1

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 07:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33708c760286b8f7621e114a7a5a1939_JaffaCakes118.html
Size

4KB
MD5

33708c760286b8f7621e114a7a5a1939
SHA1

5e51c9134eedd43636d79cabb52a3e73e510c632
SHA256

cd42eda0a40b7b25417967f8591ebb007facda989178168760a9a08b25654ce1
SHA512

4b978821bf8e025ded4be28b389462fc62f2dce87c32ef592563820ad42f83c95a3bb22b9e65add5e5ea9a318910d078d53ec77a066dd6c8f3bce06d673f02bf
SSDEEP

96:bgj11UD3LzYdUR4kLMgwffUf00Y9exef+ONmjUfYnf+OIwoi1fqtvf+OgfcoDlvF:bA11G+UR8hp/Nmj6q/bBO/mkFa9

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
4364	msedge.exe
4364	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 940	4364	msedge.exe	82
PID 4364 wrote to memory of 940	4364	msedge.exe	82
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 4760	4364	msedge.exe	83
PID 4364 wrote to memory of 1980	4364	msedge.exe	84
PID 4364 wrote to memory of 1980	4364	msedge.exe	84
PID 4364 wrote to memory of 756	4364	msedge.exe	85
PID 4364 wrote to memory of 756	4364	msedge.exe	85
PID 4364 wrote to memory of 756	4364	msedge.exe	85
PID 4364 wrote to memory of 756	4364	msedge.exe	85
PID 4364 wrote to memory of 756	4364	msedge.exe	85
PID 4364 wrote to memory of 756	4364	msedge.exe	85
PID 4364 wrote to memory of 756	4364	msedge.exe	85
PID 4364 wrote to memory of 756	4364	msedge.exe	85
PID 4364 wrote to memory of 756	4364	msedge.exe	85
PID 4364 wrote to memory of 756	4364	msedge.exe	85
PID 4364 wrote to memory of 756	4364	msedge.exe	85
PID 4364 wrote to memory of 756	4364	msedge.exe	85
PID 4364 wrote to memory of 756	4364	msedge.exe	85
PID 4364 wrote to memory of 756	4364	msedge.exe	85
PID 4364 wrote to memory of 756	4364	msedge.exe	85
PID 4364 wrote to memory of 756	4364	msedge.exe	85
PID 4364 wrote to memory of 756	4364	msedge.exe	85
PID 4364 wrote to memory of 756	4364	msedge.exe	85
PID 4364 wrote to memory of 756	4364	msedge.exe	85
PID 4364 wrote to memory of 756	4364	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\33708c760286b8f7621e114a7a5a1939_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffe1ff746f8,0x7ffe1ff74708,0x7ffe1ff74718
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,4946889325411522928,5544913784655939571,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,4946889325411522928,5544913784655939571,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,4946889325411522928,5544913784655939571,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4946889325411522928,5544913784655939571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4946889325411522928,5544913784655939571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4946889325411522928,5544913784655939571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,4946889325411522928,5544913784655939571,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,4946889325411522928,5544913784655939571,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4946889325411522928,5544913784655939571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4946889325411522928,5544913784655939571,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4946889325411522928,5544913784655939571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4946889325411522928,5544913784655939571,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,4946889325411522928,5544913784655939571,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5140 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
b2aa25d6b15f30a31cf35a306f79c3c9

SHA1
6e92ea921b7136ed036d06040bb45f245dded580

SHA256
fc85ffebc5a90d2446b9b847142cf6b16d6cfb478666f3fae23707ed745d9d98

SHA512
a4d2794de4ea101692a159eca3d31fac78339e8302ef73681f6641cd0da46bf3461f1810f2f89e4ea752518c05652059a95e14b90724ba89e9b654f18be67210

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
386B

MD5
fd0e585639c456e91cbbb8a7b448772d

SHA1
4b4ee44ce8893ac5cdbd0242ad62187d93454115

SHA256
f353f8611d62b2a5d10789f7acb829f11cccef870a5dfb6e6e577cb5f73df906

SHA512
1bbb5f342546ca7f7b954f1dded7f7ab964d9fa151a76390028db2f8b20803791a8b50092cfbaf839a1925f03c5e7b348f864c7178045742646c233ce2ff2da0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d1885370af672f6b17fda880a8bccf1e

SHA1
44311f71b4acbeb82d29e8a5d259004ee44d7613

SHA256
9e0b17e89ce7575fbb0152e2628aeaaf4584e3a11dd9cb8149bbe21d2fd4f37e

SHA512
6489955181c7e309f8dba99986e7580edd3f34406877f608eaa8f72506f3c2efefbc23c012cc4197687957fdd6b938ccfce088d57eb89a3056c8abdf4134767b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5626a307afb9631684f97d4cad562626

SHA1
f043d76bf0367e0c795090eb9be668497caa035d

SHA256
e466060cad05e14e28b432023ab083f785fd6174efa2c6ca86fc27a1837e772b

SHA512
d447491f56ae6cf97facb5b874bfa6db0b143a5a8be5bcb445b95969190274e1cddf58e9db121bfb9d1d7cbe775606e3a89501626352bee5f1db3205e02ed8e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
216289cfae0650148f3cc83b61975e54

SHA1
6c9109bbed92a75b0ea2dd65e83e570570ff5fe2

SHA256
2fe791edfb0094d980865c8dc1da6608a74b453ae0c573805589296b28e419fd

SHA512
192f116fcd9db7af0426382c055300cfd8a7301a78688e11cd4562b2c7a043c18a83bb5bc2d646994622a86e2cff4cf9bccb7ad9819040b4c9e226204b2c8525

Download Submit