fe66bb7b8f931cb909b2ce5542e170d2752ede8428b11b9a6b70df70663b17f3

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 21:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d303b37d72861948b1ccd2b1b041017_JaffaCakes118.html
Size

94KB
MD5

4d303b37d72861948b1ccd2b1b041017
SHA1

f65a70c358adf446b09059f3ef5bde7941b42933
SHA256

fe66bb7b8f931cb909b2ce5542e170d2752ede8428b11b9a6b70df70663b17f3
SHA512

e5d9245282ddbda8ab537024ad2107e734e87e3160f20022e8c76ebec7c37313ba05bcdcf4e1f1197c4165a9c1377e4f4e5007e46294ece4c1106edaf7f42a7d
SSDEEP

1536:WMLiNV+v7LQWVCNti4GFprAUBIRAf9FDZ1iy3y6BdkrY8mgHC+qpEyW:WAiwj7BdkrY8mgHC+qpEyW

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
4900	msedge.exe
4900	msedge.exe
212	identity_helper.exe
212	identity_helper.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 3628	4900	msedge.exe	82
PID 4900 wrote to memory of 3628	4900	msedge.exe	82
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 4548	4900	msedge.exe	83
PID 4900 wrote to memory of 3224	4900	msedge.exe	84
PID 4900 wrote to memory of 3224	4900	msedge.exe	84
PID 4900 wrote to memory of 3704	4900	msedge.exe	85
PID 4900 wrote to memory of 3704	4900	msedge.exe	85
PID 4900 wrote to memory of 3704	4900	msedge.exe	85
PID 4900 wrote to memory of 3704	4900	msedge.exe	85
PID 4900 wrote to memory of 3704	4900	msedge.exe	85
PID 4900 wrote to memory of 3704	4900	msedge.exe	85
PID 4900 wrote to memory of 3704	4900	msedge.exe	85
PID 4900 wrote to memory of 3704	4900	msedge.exe	85
PID 4900 wrote to memory of 3704	4900	msedge.exe	85
PID 4900 wrote to memory of 3704	4900	msedge.exe	85
PID 4900 wrote to memory of 3704	4900	msedge.exe	85
PID 4900 wrote to memory of 3704	4900	msedge.exe	85
PID 4900 wrote to memory of 3704	4900	msedge.exe	85
PID 4900 wrote to memory of 3704	4900	msedge.exe	85
PID 4900 wrote to memory of 3704	4900	msedge.exe	85
PID 4900 wrote to memory of 3704	4900	msedge.exe	85
PID 4900 wrote to memory of 3704	4900	msedge.exe	85
PID 4900 wrote to memory of 3704	4900	msedge.exe	85
PID 4900 wrote to memory of 3704	4900	msedge.exe	85
PID 4900 wrote to memory of 3704	4900	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4d303b37d72861948b1ccd2b1b041017_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9afb046f8,0x7ff9afb04708,0x7ff9afb04718
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,18407257451175099238,3746290025122457456,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,18407257451175099238,3746290025122457456,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,18407257451175099238,3746290025122457456,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,18407257451175099238,3746290025122457456,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,18407257451175099238,3746290025122457456,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,18407257451175099238,3746290025122457456,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,18407257451175099238,3746290025122457456,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,18407257451175099238,3746290025122457456,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,18407257451175099238,3746290025122457456,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,18407257451175099238,3746290025122457456,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,18407257451175099238,3746290025122457456,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,18407257451175099238,3746290025122457456,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
178B

MD5
efb3e41ddcb00d4e436d59962fe73c4d

SHA1
4b9f2cbd664cf2136cd6966774f9ee04b4efa46a

SHA256
edc776d59064e412098066a07cba55cbabb1e7d18534e1292d34003961ad3bb6

SHA512
85a53139125a0e589b222ebee00d1c593eb24c8059b9f3f86196f8ef346cf7fc988493bb6f5cebf7aec2d0debc5017eff291b04e8aa37180d1ec5a6e2bb362ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9dfca484996698224f9661d4746b04cd

SHA1
81168fb2065b2df7a7a1b2d7d9fe360b5731a754

SHA256
3e5fee63af36f207042b4decdeabcf537abfdd3ece4c32e2224b74c803510fae

SHA512
6e05421e14282f900ef2c9f097fbfb7e87fa080446405b271a3acc4db6b5f61cfb8f4b67d2f790afe84207bc8d44899083fc8fadfd9a29712b7776602df4f2b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bedf64a884035ba9af24a1eea2959f17

SHA1
aad5408654ade7f53dfd07ac5e9d4f908d5603e4

SHA256
4ba4bff3c4eb7be7c355631cdb548d45941d6a2dca4a708ef2f887aca7393513

SHA512
e950ecc505c293bd326c76db1de978347a1fc2d0f7867a41a5bb121210647281b495b4466ffc89b590cff480d08e4df080edbf4c8998da83af699cbf68e7e3ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e044f728f38cdc0c7ade989550c43ec0

SHA1
51dcac1eca2d5f9f7d746c07d288c71cdd830b47

SHA256
d7a2e98bc32edd508404a6e92212320df28165ca78b520407b0972f886c58cef

SHA512
9f9d5e379a476f4f53214668deaa2eae0e2c557f2f2c5706d5d67305b96b72a042cc25b68de2632de2e8ac5728e0e1805e2a28502feacf68750f168e91a08d7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
41b0e57abda5ec0fb5f6f7862d766e83

SHA1
829e10ec8094065117ec12bb7e5f5078db42c06d

SHA256
bbfe63b5e83f28c7efa317b6f2f9434c266704e71138890f896b38f761e28157

SHA512
fb821ff363fb27908f4f0dc61e192b59e57154f0d90bf3a384f3c17b8d11f51a1757dc3370892337d1b875034d05889b30e74478b3fa1240d174733c8b8da061

Download Submit