4a4ab2024a9562a91f8061c9584f9420445729971c62388778f2efd37d95905c

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

40d94608218d77e7ffa27b6aba569b78_JaffaCakes118.html
Size

26KB
MD5

40d94608218d77e7ffa27b6aba569b78
SHA1

3a5e69acda24992e57b6d68aaeaa6111ebec15f3
SHA256

4a4ab2024a9562a91f8061c9584f9420445729971c62388778f2efd37d95905c
SHA512

c1acd884b3679d28a4d3a0f3d5c049fff9b28b0a85234a946c36f38a314fa0f761ebd5fbf01f41c07558cd884665d592eb1c29216fa749bb9a5856e133517cd6
SSDEEP

768:8qygcrowGt7vC5v83j0C21dLaiFYufszcHP7cUGyiP0gK8:8qygcrowGt7vC5v83j031ZbcUGyiP0gN

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
2668	msedge.exe
2668	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
1596	identity_helper.exe
1596	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 3244	2668	msedge.exe	83
PID 2668 wrote to memory of 3244	2668	msedge.exe	83
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 2196	2668	msedge.exe	84
PID 2668 wrote to memory of 1264	2668	msedge.exe	85
PID 2668 wrote to memory of 1264	2668	msedge.exe	85
PID 2668 wrote to memory of 1012	2668	msedge.exe	86
PID 2668 wrote to memory of 1012	2668	msedge.exe	86
PID 2668 wrote to memory of 1012	2668	msedge.exe	86
PID 2668 wrote to memory of 1012	2668	msedge.exe	86
PID 2668 wrote to memory of 1012	2668	msedge.exe	86
PID 2668 wrote to memory of 1012	2668	msedge.exe	86
PID 2668 wrote to memory of 1012	2668	msedge.exe	86
PID 2668 wrote to memory of 1012	2668	msedge.exe	86
PID 2668 wrote to memory of 1012	2668	msedge.exe	86
PID 2668 wrote to memory of 1012	2668	msedge.exe	86
PID 2668 wrote to memory of 1012	2668	msedge.exe	86
PID 2668 wrote to memory of 1012	2668	msedge.exe	86
PID 2668 wrote to memory of 1012	2668	msedge.exe	86
PID 2668 wrote to memory of 1012	2668	msedge.exe	86
PID 2668 wrote to memory of 1012	2668	msedge.exe	86
PID 2668 wrote to memory of 1012	2668	msedge.exe	86
PID 2668 wrote to memory of 1012	2668	msedge.exe	86
PID 2668 wrote to memory of 1012	2668	msedge.exe	86
PID 2668 wrote to memory of 1012	2668	msedge.exe	86
PID 2668 wrote to memory of 1012	2668	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\40d94608218d77e7ffa27b6aba569b78_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84d3746f8,0x7ff84d374708,0x7ff84d374718
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,8942379494664465133,13000115119848043705,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,8942379494664465133,13000115119848043705,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,8942379494664465133,13000115119848043705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8942379494664465133,13000115119848043705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8942379494664465133,13000115119848043705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,8942379494664465133,13000115119848043705,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3052 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,8942379494664465133,13000115119848043705,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,8942379494664465133,13000115119848043705,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8942379494664465133,13000115119848043705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8942379494664465133,13000115119848043705,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8942379494664465133,13000115119848043705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8942379494664465133,13000115119848043705,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:1792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
182B

MD5
5fba847350341dc385c90bbd14b812f4

SHA1
986d1713b103f3d565ccb88077a8598c8393a24e

SHA256
ecb5860418331ce7b5253419ebab9fb495ab9dba26b7d0751699949555074372

SHA512
227478553cd394c0ae057d78160c461119d7418765a14ab55ac18daec588ef8883c09c931adc149f380fead0a6e0e92cb0d6d8c29c27cacd63143b615b23e830

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
84c1e1936fec8447daf98527b5d7889b

SHA1
2bbc1d6a88ea175aae4c50f7eaab6730b097e370

SHA256
22841fc1dd7016c63522514ce7ea156c86c2210f15f81c02992f3c3d94b116af

SHA512
4bee1b2f5eca09a6929c3e9a77e3c52f7848c6e3c951cdf21b230da2102bf7ddf78c38ec1fb310f135ba73d8824e51b8130411fdb96fb594801cdaf44cd6e2e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eb6bbd9d92ac701fd803a8e6d5832db7

SHA1
24459d322a723b57658b40da6d72e45c59b45fc7

SHA256
6aab5d86180015f33ef1a6645ea599e66ca9d0230d67320dbebda12a08885682

SHA512
700be281ac472d3e9b9519ace37ff55a44eeca1df3fa18700051e25e53687a549c42c967a52f3ad950d24081b9925e6800b9fac4d0a32089e3786fd5c3cd7c46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4e9f073dd610875f892c0e1482303996

SHA1
506da885861b156bd58f907134a149abe6ab3d41

SHA256
feac3b67c78aa36f2594a1c92c474bd31c1785df12294e1839243af108e6fadc

SHA512
cc55b60d24dc5533cb0bbf7c23e4abcb6f10a9cab33a47c86e66ad8cc7e0187cafb3b2dfec0469a2a89db057e6f9d57a4ed092473bb836d08fc9b55d75ecdc23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dafc44194e224c4c298a1cbd219293a3

SHA1
f916535e06e715e08b2572724539b69c4c19cb5e

SHA256
aa792818b71a7d0e85b8f4cfc6081c3fcecf5d0421f7cb88803b047f6647913c

SHA512
3e5495ccc73f0f9c499de1cf7d645ce7b1bd0a7d5cadd6122468e784c8d6f7d7bf56c39530bdd45a4203992390c398accf31ab896e68c52f590f30aa3f830984

Download Submit