c64362d8b32ceda249e581f8a2394fe3aeed081b5e085fa379273f3294330ab7

Analysis

max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4181942388bc23595bc3f16be4e6033f_JaffaCakes118.html
Size

51KB
MD5

4181942388bc23595bc3f16be4e6033f
SHA1

69f5713fd94cd4e28fcaf1336700e455d4e18e75
SHA256

c64362d8b32ceda249e581f8a2394fe3aeed081b5e085fa379273f3294330ab7
SHA512

23112ad31e018726cd368202f35ca5e62bb9c2a47a7085da1ff375c631f15927873ab2ba773ce4babe358b8256b451c9f2efc5849cca43c7aeebb1b8bd85d369
SSDEEP

1536:qdPMf5jGT9WjLiNbJbfG6ieEFdGFBefJKQIPf:n6WjDeEFdyBsKQIPf

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2324	msedge.exe
2324	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3920	identity_helper.exe
3920	identity_helper.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe
3052	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 4356	3636	msedge.exe	82
PID 3636 wrote to memory of 4356	3636	msedge.exe	82
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2296	3636	msedge.exe	83
PID 3636 wrote to memory of 2324	3636	msedge.exe	84
PID 3636 wrote to memory of 2324	3636	msedge.exe	84
PID 3636 wrote to memory of 1468	3636	msedge.exe	85
PID 3636 wrote to memory of 1468	3636	msedge.exe	85
PID 3636 wrote to memory of 1468	3636	msedge.exe	85
PID 3636 wrote to memory of 1468	3636	msedge.exe	85
PID 3636 wrote to memory of 1468	3636	msedge.exe	85
PID 3636 wrote to memory of 1468	3636	msedge.exe	85
PID 3636 wrote to memory of 1468	3636	msedge.exe	85
PID 3636 wrote to memory of 1468	3636	msedge.exe	85
PID 3636 wrote to memory of 1468	3636	msedge.exe	85
PID 3636 wrote to memory of 1468	3636	msedge.exe	85
PID 3636 wrote to memory of 1468	3636	msedge.exe	85
PID 3636 wrote to memory of 1468	3636	msedge.exe	85
PID 3636 wrote to memory of 1468	3636	msedge.exe	85
PID 3636 wrote to memory of 1468	3636	msedge.exe	85
PID 3636 wrote to memory of 1468	3636	msedge.exe	85
PID 3636 wrote to memory of 1468	3636	msedge.exe	85
PID 3636 wrote to memory of 1468	3636	msedge.exe	85
PID 3636 wrote to memory of 1468	3636	msedge.exe	85
PID 3636 wrote to memory of 1468	3636	msedge.exe	85
PID 3636 wrote to memory of 1468	3636	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4181942388bc23595bc3f16be4e6033f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9053046f8,0x7ff905304708,0x7ff905304718
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,16570533954776741887,16078781720853951452,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,16570533954776741887,16078781720853951452,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,16570533954776741887,16078781720853951452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16570533954776741887,16078781720853951452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16570533954776741887,16078781720853951452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,16570533954776741887,16078781720853951452,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,16570533954776741887,16078781720853951452,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16570533954776741887,16078781720853951452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16570533954776741887,16078781720853951452,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16570533954776741887,16078781720853951452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16570533954776741887,16078781720853951452,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,16570533954776741887,16078781720853951452,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3128 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
343B

MD5
3923e2f0df1c0baea2de11199c5b95d0

SHA1
2e769420180e48bbf3aad53aa4e55da3f451778a

SHA256
39f8c9b727fe06822a6faba27b8dbe477e6373f4483097c87eff9bf44d5aa022

SHA512
cc7f8f3e57d6989aff137eee340511cc83febb2d67c72176221db35cda48f08f4cbbeae9ece840cfdd8e59f32f501d702bb2c9ccafc04dc14b95a125604195d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3da748d60e6ba0cf7bdeda455dd241d4

SHA1
8c15068cf133ff5f7af306f05cee6666058a5956

SHA256
28c4967a6dbdfe8d7ae8c5d5698381396b795d135e30ffa5d198d54406e0b990

SHA512
3ee75d99b6f16cc5900871f6b1275f8a5528ef9facd2def305f4fefe869d0e0b0953cd1e9cb90b24c6a8d43f0a8916a7fd8c243327572e6e79997a764c69a27b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2417b24bd10bcf92d67a944bd3e58b5b

SHA1
ce6e5ade3909670bd1aeab557f3fe8fdc58b90cc

SHA256
928b43c7f1ab43b3c49cad0216414f1ea3dd5ce0bb43ba3894a6189ef0ed62c5

SHA512
077a201295c90ca68ddc4fad3132a8f958174a4fefb4601425551a597389b614bf643ee89811b283e3cc92588993a9af9cd3e0f4add87206c8eebf0c04055130

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c2e0f23d83f72878d9d5f4e860c84dd5

SHA1
f24fd724cd0e4e9b5794add1b16dca5952ba4e86

SHA256
a771a9f51f2adc2084f400520b7c3017cf9ffa6840f46be9ffcde2c9dd2ed696

SHA512
8afcd984a44aeba817a437e3e0c685cb0688ce8ad6ffdb27e81d39628b5b3f85cbcbee900a123dbd51dc36379bff04825c6faf449840a0c86b280ec1bd5b659e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3e35eecc74302f535f2f355989f7b6ab

SHA1
1c6f8089eb962589f0d4b0b8bf636df9b8687e2b

SHA256
be7a452c76a59c45a01bbd733e08630ba3d763fe35bbed560383852386471621

SHA512
f319d20c2bfa1c47ee10a6d63fcb37230c45f4c6cbec0d3e9885af8ed394c6588466ab462a679fa2997368327fb32d8b8adf7c1d59e6fb36f15b7d20451ef9fa

Download Submit