35552603724033725baa367013482e6f9f8ce480f4de3ad3c3ea950bdb77ab53

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

436cb6e9e3a37c59faef9bb15a3296b7_JaffaCakes118.html
Size

69KB
MD5

436cb6e9e3a37c59faef9bb15a3296b7
SHA1

648c78222319ce4d7222470645b9cda4591b068b
SHA256

35552603724033725baa367013482e6f9f8ce480f4de3ad3c3ea950bdb77ab53
SHA512

fd261f521d232c614a1d5b6feb4eb4ee12badadf21ae31562cb8fe9be167b8d42cdf0bbb78c4d28ca0422d2b59af10dbffa05ee4fda7182f3e878078b659d7d9
SSDEEP

768:SeSWbVbm9WlnrvI3fWP3ClOeWN9VyI3Hnb4Mk3nOduMxO4oe4e592X:SWy+rSWPSlOeWNf7MP3n6xO24ejs

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3912	msedge.exe
3912	msedge.exe
3404	msedge.exe
3404	msedge.exe
1632	identity_helper.exe
1632	identity_helper.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 2308	3404	msedge.exe	82
PID 3404 wrote to memory of 2308	3404	msedge.exe	82
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 1944	3404	msedge.exe	83
PID 3404 wrote to memory of 3912	3404	msedge.exe	84
PID 3404 wrote to memory of 3912	3404	msedge.exe	84
PID 3404 wrote to memory of 1032	3404	msedge.exe	85
PID 3404 wrote to memory of 1032	3404	msedge.exe	85
PID 3404 wrote to memory of 1032	3404	msedge.exe	85
PID 3404 wrote to memory of 1032	3404	msedge.exe	85
PID 3404 wrote to memory of 1032	3404	msedge.exe	85
PID 3404 wrote to memory of 1032	3404	msedge.exe	85
PID 3404 wrote to memory of 1032	3404	msedge.exe	85
PID 3404 wrote to memory of 1032	3404	msedge.exe	85
PID 3404 wrote to memory of 1032	3404	msedge.exe	85
PID 3404 wrote to memory of 1032	3404	msedge.exe	85
PID 3404 wrote to memory of 1032	3404	msedge.exe	85
PID 3404 wrote to memory of 1032	3404	msedge.exe	85
PID 3404 wrote to memory of 1032	3404	msedge.exe	85
PID 3404 wrote to memory of 1032	3404	msedge.exe	85
PID 3404 wrote to memory of 1032	3404	msedge.exe	85
PID 3404 wrote to memory of 1032	3404	msedge.exe	85
PID 3404 wrote to memory of 1032	3404	msedge.exe	85
PID 3404 wrote to memory of 1032	3404	msedge.exe	85
PID 3404 wrote to memory of 1032	3404	msedge.exe	85
PID 3404 wrote to memory of 1032	3404	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\436cb6e9e3a37c59faef9bb15a3296b7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe6b1346f8,0x7ffe6b134708,0x7ffe6b134718
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,15691546925662464819,4807663325459138360,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,15691546925662464819,4807663325459138360,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,15691546925662464819,4807663325459138360,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15691546925662464819,4807663325459138360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15691546925662464819,4807663325459138360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,15691546925662464819,4807663325459138360,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,15691546925662464819,4807663325459138360,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15691546925662464819,4807663325459138360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15691546925662464819,4807663325459138360,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15691546925662464819,4807663325459138360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15691546925662464819,4807663325459138360,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,15691546925662464819,4807663325459138360,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4928 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1c879dcb-8b47-43ea-ae1d-8c94b0f2b132.tmp

Filesize
6KB

MD5
3f5a0909826850a9785f0d580e5e3108

SHA1
2af63fc2961a3c334f112b453ea28528468c15ad

SHA256
b6bb11b463d78cfc7f00c11faa869b94667dee9beffbb2095091b6b16e0f3a4b

SHA512
87a6e943d6ba11dccae18ee6d68ba54fe68e1a5c5ce5e3d481ecca60003e7354ad73364a919a9f4d2ef473cd192e5efb5cac31b00613a78db8a844cb7dc85cb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
190B

MD5
1c7b7ecb983c284796fd394355db90d7

SHA1
bb4f24567f32481b6efbcc5a124f685e7a9172cb

SHA256
b8bdee0284fd6029fde2355c23d43d4ef3b2469111487b6c4daa10ef09a925f1

SHA512
7390e473b35ad18ad7c244d5260d44bc6a01fed8336c0bf4474e4b0b3aaa2fe610cbe93120cc86a40e8abd4397569e4504d42dfa09eac343db7f71bd8c0645db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8cb977dc6cd8f9111588943153b7bd3e

SHA1
fd034e4bf85355101b75d9c3c2f394d1353c22c6

SHA256
1880e0f7dfd319f071c5ce8b310a68bce000b50418a483f23b2f2966a2023426

SHA512
7660b66bda259519f0c7bd3c18775b77457371d9d68a393f88d0306679dd6f169a13339b987c83165fcf5be58eeba48c39d591d5ec967afc628360c917490afd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
21651bc8df051b6d3f7c20c5cc199c91

SHA1
c17c8d29447e1e93a8fae1fa2394dd1d8646668b

SHA256
c5151a3380a3b9f81b41a296c9777c0a50dc01fbddc8201f84bf356a988d83c3

SHA512
da77d1fcdccade685465c368808e45926505c11b9745eede5126387bd8f263ba2ab0201d1394aa48bf7184305c67cea328c6b987bbfadec381416f5e9672e46b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a59a7ad254c8e0112d5fa740d654b89a

SHA1
0d26d7c0e995e7bf2caff28343955e8dc6146eba

SHA256
7f511d147610221489d9b524b593ee86dc3f8a927416ad6b3d239ead5528c5ab

SHA512
d59984af3c9c7b597d4739695ddd0f9038075d2a3562b2efba075ca17daa0c52368ea6abcb67e05c45600a5b3b40b4da18029d05070548674e12d274dfb1b190

Download Submit