8c9a5bbd6bd2ad5549269e0987eaed473c8541a865ee1551d83a1db0bd28ce9d

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d4dd1381e768ab1d0d02fc233859682_JaffaCakes118.html
Size

16KB
MD5

3d4dd1381e768ab1d0d02fc233859682
SHA1

3ff6646fdf91be26e7f550889003c57bfc3f1c06
SHA256

8c9a5bbd6bd2ad5549269e0987eaed473c8541a865ee1551d83a1db0bd28ce9d
SHA512

21806ac62ab572eaf9ea64795c622fdbf4552b217bd4700fda0c0f361f817fe4cb79f914f0bdbc58083dfcf1e76c53b85b24db09817ae70d6b3cbcf47983dff3
SSDEEP

192:SIuUxx08KWcWmbvycGJ/bzGRa1WwVIkiY8P9rLN4hfzsEds/YhNjOfsBNkwqY:SIuR89J/B1W+i598BGo

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
3976	msedge.exe
3976	msedge.exe
4076	identity_helper.exe
4076	identity_helper.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 2432	3976	msedge.exe	85
PID 3976 wrote to memory of 2432	3976	msedge.exe	85
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4968	3976	msedge.exe	88
PID 3976 wrote to memory of 4880	3976	msedge.exe	89
PID 3976 wrote to memory of 4880	3976	msedge.exe	89
PID 3976 wrote to memory of 1584	3976	msedge.exe	90
PID 3976 wrote to memory of 1584	3976	msedge.exe	90
PID 3976 wrote to memory of 1584	3976	msedge.exe	90
PID 3976 wrote to memory of 1584	3976	msedge.exe	90
PID 3976 wrote to memory of 1584	3976	msedge.exe	90
PID 3976 wrote to memory of 1584	3976	msedge.exe	90
PID 3976 wrote to memory of 1584	3976	msedge.exe	90
PID 3976 wrote to memory of 1584	3976	msedge.exe	90
PID 3976 wrote to memory of 1584	3976	msedge.exe	90
PID 3976 wrote to memory of 1584	3976	msedge.exe	90
PID 3976 wrote to memory of 1584	3976	msedge.exe	90
PID 3976 wrote to memory of 1584	3976	msedge.exe	90
PID 3976 wrote to memory of 1584	3976	msedge.exe	90
PID 3976 wrote to memory of 1584	3976	msedge.exe	90
PID 3976 wrote to memory of 1584	3976	msedge.exe	90
PID 3976 wrote to memory of 1584	3976	msedge.exe	90
PID 3976 wrote to memory of 1584	3976	msedge.exe	90
PID 3976 wrote to memory of 1584	3976	msedge.exe	90
PID 3976 wrote to memory of 1584	3976	msedge.exe	90
PID 3976 wrote to memory of 1584	3976	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3d4dd1381e768ab1d0d02fc233859682_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa006e46f8,0x7ffa006e4708,0x7ffa006e4718
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,16876330400091520955,7115147076435941279,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,16876330400091520955,7115147076435941279,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,16876330400091520955,7115147076435941279,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16876330400091520955,7115147076435941279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16876330400091520955,7115147076435941279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,16876330400091520955,7115147076435941279,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,16876330400091520955,7115147076435941279,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16876330400091520955,7115147076435941279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16876330400091520955,7115147076435941279,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16876330400091520955,7115147076435941279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16876330400091520955,7115147076435941279,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,16876330400091520955,7115147076435941279,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4900 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
182B

MD5
21288b4d9c0c0113b527ea64b5388e34

SHA1
634686f9842986ab0a3419eda6aa8f70f9c388cc

SHA256
4c7d2bb7f631e4d60278030e90bba17d19e024ba27d9b3e980587f3525561788

SHA512
45cb5e6cac3cff3a39b3e7f14c3b7eca0003c69218d69a8426e7cb843ac87dcfcf5e8e2149da337265a8ad2aa9d899956686a7dc569875dfe33efbbc3ee50d71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
970696fd403bf94350f2b153fe19c734

SHA1
b61fccfb7dd335d0182a036328f6dc22d67d5c05

SHA256
f748cacfef4905e058246e3adfc3c1f3245eefb417c0563dde1a04c40f3da4b5

SHA512
cbee8cd14da7a6a739db452d411cf7dd3e51cda3e421f18c012f3bf9716d68e6c5e05239af7825a1f378efe41cf10bc01497246bbbfbc4aad75f8c3e0305614c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
93741da67e42ad37a718d5398185bf4f

SHA1
91b2f7fed66ae97197e3ebff260c578ec66d96a0

SHA256
d155d2b926566d51f6e6c662bf3f68bf1fac82eb2f4445a4ad4b9be0aa0b8b43

SHA512
2e20daacdd01b61455dceb270a478e862d7d4cd1806eea6a861b92a7ba1238c75b9fdb9d242814af058fe2108681b7eb4ac7179e7323cbbdf27dd3e1e57d67eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fca2e8326af8c75ecb8961127ab8dfed

SHA1
d25e57084a93612372d0dff175cc5702d21f9666

SHA256
0824ebb90f11aee0d65e3aad5605135f3c64e95ffbf66ae787cac17da9764c92

SHA512
c56e15c99622e3c653ae006de068c90293976a9f1fba91e6b0f16f74f4cc7854cc8473e4213860030e72686a382d97f5da4ca128b6c6d3bb62c504550f518647

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6231d6dbc0818181ec50b0f25300317e

SHA1
ceedffebb77cf0d63f2de91b36745b826878221f

SHA256
bd315edc718db3fdc33fe143623b5e26fb7bcbb72a5c14989e334435a369d421

SHA512
87d8c22d4abdbc96e90f5ae5c76e8a028cb196f0e3dd6b64992c2581205e2d107c3552d7497a91f27e410da77e3367bd21ef5d2b21176582845ee89a300e8331

Download Submit