18fc44b51875aa9c6350012c7c8d9b347ecba0b00b8104b41f4e708e3bea0c0b

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 15:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46d8086667b279ebfba3a240736c9c54_JaffaCakes118.html
Size

462KB
MD5

46d8086667b279ebfba3a240736c9c54
SHA1

b57654020165cd5aeef9e41d310bb1234d3e5af9
SHA256

18fc44b51875aa9c6350012c7c8d9b347ecba0b00b8104b41f4e708e3bea0c0b
SHA512

dbdcc61f6e888977ee939433595c63456ecbbdaf4f274f10cb8c4e588dae8c2feda7183b89c83530780f89881468f749502f57ee8c7f28f0ec62d27b83ec0151
SSDEEP

6144:IMCe5EIGVT9j5e8Ugqoe9/M6mhpCYTzo+8mXt7/s:IC5ej5e8UgqokG/s

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
1384	msedge.exe
1384	msedge.exe
4128	identity_helper.exe
4128	identity_helper.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 2904	1384	msedge.exe	82
PID 1384 wrote to memory of 2904	1384	msedge.exe	82
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 1056	1384	msedge.exe	83
PID 1384 wrote to memory of 4884	1384	msedge.exe	84
PID 1384 wrote to memory of 4884	1384	msedge.exe	84
PID 1384 wrote to memory of 688	1384	msedge.exe	85
PID 1384 wrote to memory of 688	1384	msedge.exe	85
PID 1384 wrote to memory of 688	1384	msedge.exe	85
PID 1384 wrote to memory of 688	1384	msedge.exe	85
PID 1384 wrote to memory of 688	1384	msedge.exe	85
PID 1384 wrote to memory of 688	1384	msedge.exe	85
PID 1384 wrote to memory of 688	1384	msedge.exe	85
PID 1384 wrote to memory of 688	1384	msedge.exe	85
PID 1384 wrote to memory of 688	1384	msedge.exe	85
PID 1384 wrote to memory of 688	1384	msedge.exe	85
PID 1384 wrote to memory of 688	1384	msedge.exe	85
PID 1384 wrote to memory of 688	1384	msedge.exe	85
PID 1384 wrote to memory of 688	1384	msedge.exe	85
PID 1384 wrote to memory of 688	1384	msedge.exe	85
PID 1384 wrote to memory of 688	1384	msedge.exe	85
PID 1384 wrote to memory of 688	1384	msedge.exe	85
PID 1384 wrote to memory of 688	1384	msedge.exe	85
PID 1384 wrote to memory of 688	1384	msedge.exe	85
PID 1384 wrote to memory of 688	1384	msedge.exe	85
PID 1384 wrote to memory of 688	1384	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\46d8086667b279ebfba3a240736c9c54_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef99446f8,0x7ffef9944708,0x7ffef9944718
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,8443534841665199790,13462055397936114010,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,8443534841665199790,13462055397936114010,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2564 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,8443534841665199790,13462055397936114010,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8443534841665199790,13462055397936114010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8443534841665199790,13462055397936114010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,8443534841665199790,13462055397936114010,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,8443534841665199790,13462055397936114010,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8443534841665199790,13462055397936114010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8443534841665199790,13462055397936114010,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8443534841665199790,13462055397936114010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8443534841665199790,13462055397936114010,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,8443534841665199790,13462055397936114010,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\683b677e-88d2-4716-a32b-95a40cee95c1.tmp

Filesize
11KB

MD5
5db4ee664af3c7ac6a3b5cfb1c93cb8a

SHA1
0233fe51f999d12203951e2b74a4d36c2b3854f1

SHA256
1389e1f6a6938f1e642c53f3e26c85a2db1e9731d3d4ce0c38f6fdc47c5506f3

SHA512
73f1072c63cd60cd082d8f57b93007441d0e93a5d093ae1d8ef9af84a884ca584625e9a24b557026e7fa2a8800e81f9827c4691c0c14c474d7a40e9481fc743e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
468B

MD5
88407b922efc734822282ceff54fe907

SHA1
05f955f6105ee09b085ecd177222bc2f089f1db5

SHA256
bb5845dd2be1e63040d97ac18ead61e4788ee3620475fa5d727c77b64b309bcd

SHA512
b8f621006ea9fc257b669de70e6e40c50093e45febaf94520cd22947ec891f408b70bee51319acd5ee3804d6d794440890e5291f78099bffecb2c643eb26b7b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ae6dc378c96a8ee5ab366b5633ffcd60

SHA1
b4f8858a10d577d5c7e1f70b5ae2abf76844b908

SHA256
7cb3ba13e9cd2200c7811d486c93680de7418806d5e534a5ae84aa8ccb9b87da

SHA512
abd048cfb0bf39e79dc2dcabb2d30b5cc165e3dceb17b7685e12379fa50a2767d81bbb75b5a9d010ba707650c4a6c2d763f0db0e529e06fb46f38a3c89a549bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
87b7f8a0486e4009d5e34d40600aed06

SHA1
4c410d981afe9dfe4faf316f62adb820b23b1387

SHA256
ecfe166d9d5baa370928d539a25f6e2c5f177739700df1f8e87daa5e2fee4c0b

SHA512
fd6559c2fd3cbe9e6a0c9f6ba9de071078350362ac21a028302f833582c747540eda53b373742a5a121c21e70da3cd9513f6654caddb50daa038151e65a46065

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit