0f528c11dc947516339013d97189614712943e70ffbbf7e91e756db7d7929e35

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 21:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4336616d6cd103a090e39e299b2bc955_JaffaCakes118.html
Size

36KB
MD5

4336616d6cd103a090e39e299b2bc955
SHA1

f32380148534a1b2e9a3a38de9e2e82a132fa81b
SHA256

0f528c11dc947516339013d97189614712943e70ffbbf7e91e756db7d7929e35
SHA512

e396de52144928c9d35a41a7c84a1d6a6e9ef95d6bd8e46c70994a3da4c568b9e06ac9763a53583ad54bc8470c1009c46ccee059edc654f0abdb06431dc1cae1
SSDEEP

768:zwx/MDTHqc88hARZZPX4E1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TtZO46lrl6lLRcZ:Q/7bJxNVuu0Sx/c8SK

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe
1192	msedge.exe
1192	msedge.exe
4328	identity_helper.exe
4328	identity_helper.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 2328	1192	msedge.exe	85
PID 1192 wrote to memory of 2328	1192	msedge.exe	85
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 744	1192	msedge.exe	86
PID 1192 wrote to memory of 3328	1192	msedge.exe	87
PID 1192 wrote to memory of 3328	1192	msedge.exe	87
PID 1192 wrote to memory of 4268	1192	msedge.exe	88
PID 1192 wrote to memory of 4268	1192	msedge.exe	88
PID 1192 wrote to memory of 4268	1192	msedge.exe	88
PID 1192 wrote to memory of 4268	1192	msedge.exe	88
PID 1192 wrote to memory of 4268	1192	msedge.exe	88
PID 1192 wrote to memory of 4268	1192	msedge.exe	88
PID 1192 wrote to memory of 4268	1192	msedge.exe	88
PID 1192 wrote to memory of 4268	1192	msedge.exe	88
PID 1192 wrote to memory of 4268	1192	msedge.exe	88
PID 1192 wrote to memory of 4268	1192	msedge.exe	88
PID 1192 wrote to memory of 4268	1192	msedge.exe	88
PID 1192 wrote to memory of 4268	1192	msedge.exe	88
PID 1192 wrote to memory of 4268	1192	msedge.exe	88
PID 1192 wrote to memory of 4268	1192	msedge.exe	88
PID 1192 wrote to memory of 4268	1192	msedge.exe	88
PID 1192 wrote to memory of 4268	1192	msedge.exe	88
PID 1192 wrote to memory of 4268	1192	msedge.exe	88
PID 1192 wrote to memory of 4268	1192	msedge.exe	88
PID 1192 wrote to memory of 4268	1192	msedge.exe	88
PID 1192 wrote to memory of 4268	1192	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4336616d6cd103a090e39e299b2bc955_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe6c446f8,0x7ffbe6c44708,0x7ffbe6c44718
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,5543992633644925791,6750106417652671342,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,5543992633644925791,6750106417652671342,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,5543992633644925791,6750106417652671342,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5543992633644925791,6750106417652671342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5543992633644925791,6750106417652671342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,5543992633644925791,6750106417652671342,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,5543992633644925791,6750106417652671342,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5543992633644925791,6750106417652671342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5543992633644925791,6750106417652671342,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5543992633644925791,6750106417652671342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5543992633644925791,6750106417652671342,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,5543992633644925791,6750106417652671342,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5504 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
614B

MD5
f16e52b9c46f7432a8ee59339069c7a9

SHA1
35d2d86fd97b1f1deec27adc8cc4e56bd4676088

SHA256
c536270b430e9e4e4d43caf3670035d3442de52cf1da491838351c98c8adcbd2

SHA512
b991c259bd772791b69f7d64decb31766bf71e70f03c9d4e1b31f6147aea942ce823e6b143db47a88192d2e164819795defa22fd50b443ae85ff7fd4a18de695

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dc10b7e4980183bab08393b4de440ad0

SHA1
7740f5f3719012f7334e6276550fd135e46c2ba3

SHA256
62bf8dab66d1bbbf46f88560bd99dcb08f2b7b7fe34ac8d08b04ffc37eaa3ac7

SHA512
2007c92233bc22a150ee1d808f55985855d8a307af695409aa8e639d76a1c0d89acbdd78ea33bfa36f77d8609f1ab1187c522c05d5a898c63c3fdd6b13b2bbeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
862d0d3f785bb617b9ee84d008d0762b

SHA1
37e1210f066a3e215ea6e717bd6e30e62b744aaa

SHA256
1ae46075482dccf41cf2f752cf03e4331e75888280c8f79b9d7049bf14ef011b

SHA512
f02d3c7ab042d926a94c6aecfa0c7893c74faf6312003810e5e103b2f8594c09caac0955c54ef2a561e90cc86afd4c06100053600dce6cb74e462894c00f5d26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
014ffc9eb27816fa018d29c98959168c

SHA1
a13cd1da47677a86a4412603eea53dad763b72ff

SHA256
56918c30da0c80285bb4853acc4cab3d3f978353cf1e4ea8a524cd352529d201

SHA512
1b7c883fc0f3dbc294d61849a24ebf731416835130fef5bb941079ec8e2a19626c98df13c444e7f510a1ad6eb0673c0d0c65cf2af92c5b135801b3e07909daab

Download Submit