06e6de98758b4b2fbd048cc1678f1b282f5dc255e2c6311ab0cdfbbde8441abb

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 04:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4970816a04e007ab379f9eea05d5089c_JaffaCakes118.html
Size

15KB
MD5

4970816a04e007ab379f9eea05d5089c
SHA1

c1bbc351d2f5af52e9bd490ea90a8c96e16e81a9
SHA256

06e6de98758b4b2fbd048cc1678f1b282f5dc255e2c6311ab0cdfbbde8441abb
SHA512

16fef6ade6b88b37cf987dffff4262c7d84552b4afde043c81469ba464b97ce87c45ce1d2f172324289966bbda79324689b72ed1153369e3f21fbdb6bd4c7616
SSDEEP

384:vT6XBUDBMF4KTTwcOx4irvcQhX9eynrwx1:7MBUDCjGJvcq9eyrwx1

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3476	msedge.exe
3476	msedge.exe
2388	msedge.exe
2388	msedge.exe
2500	identity_helper.exe
2500	identity_helper.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 1684	2388	msedge.exe	84
PID 2388 wrote to memory of 1684	2388	msedge.exe	84
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 2448	2388	msedge.exe	85
PID 2388 wrote to memory of 3476	2388	msedge.exe	86
PID 2388 wrote to memory of 3476	2388	msedge.exe	86
PID 2388 wrote to memory of 4280	2388	msedge.exe	87
PID 2388 wrote to memory of 4280	2388	msedge.exe	87
PID 2388 wrote to memory of 4280	2388	msedge.exe	87
PID 2388 wrote to memory of 4280	2388	msedge.exe	87
PID 2388 wrote to memory of 4280	2388	msedge.exe	87
PID 2388 wrote to memory of 4280	2388	msedge.exe	87
PID 2388 wrote to memory of 4280	2388	msedge.exe	87
PID 2388 wrote to memory of 4280	2388	msedge.exe	87
PID 2388 wrote to memory of 4280	2388	msedge.exe	87
PID 2388 wrote to memory of 4280	2388	msedge.exe	87
PID 2388 wrote to memory of 4280	2388	msedge.exe	87
PID 2388 wrote to memory of 4280	2388	msedge.exe	87
PID 2388 wrote to memory of 4280	2388	msedge.exe	87
PID 2388 wrote to memory of 4280	2388	msedge.exe	87
PID 2388 wrote to memory of 4280	2388	msedge.exe	87
PID 2388 wrote to memory of 4280	2388	msedge.exe	87
PID 2388 wrote to memory of 4280	2388	msedge.exe	87
PID 2388 wrote to memory of 4280	2388	msedge.exe	87
PID 2388 wrote to memory of 4280	2388	msedge.exe	87
PID 2388 wrote to memory of 4280	2388	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4970816a04e007ab379f9eea05d5089c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1e7f46f8,0x7ffa1e7f4708,0x7ffa1e7f4718
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,12914748176945928728,14409896226297727486,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,12914748176945928728,14409896226297727486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,12914748176945928728,14409896226297727486,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12914748176945928728,14409896226297727486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12914748176945928728,14409896226297727486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,12914748176945928728,14409896226297727486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,12914748176945928728,14409896226297727486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12914748176945928728,14409896226297727486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12914748176945928728,14409896226297727486,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12914748176945928728,14409896226297727486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12914748176945928728,14409896226297727486,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,12914748176945928728,14409896226297727486,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3036 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
251B

MD5
276ac003f069914a1c792043350cf4fa

SHA1
dba9861d3f8e6576a93fbd5eb5c453d28f4a3912

SHA256
50e8a1432088a3bb7ba49e46b6384aca22f73430b68c3d356b4d5dd187e09713

SHA512
c9f44087c6d4ccf1ef0a8239ad345bd59b8836c0ee9031a27d0129787f815662ca158abb3a29e9baaf702d57a4d9e3893d85e637cd4e856b18acd193e3fccdc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
26ea17112c6955b558a0fb69d64ed2a4

SHA1
28b30cf56a91d151e8e510b695f08d99dacc9851

SHA256
efaf9e0ad36aeaa58ed2e082f445a6a4688ea2f0eafc6a0f3977cc3a0e0c5e6d

SHA512
c5b7dee809def67daf1f51cee5cc4110f2ad033d22db682977070689e38d8c11d7fac3d4b167e65e25cd84c519475b4cbd3a43e1f5390671799140155c977878

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d8abfe15b9979b9180ee1fd3051e350a

SHA1
3c57ea12b9c2352e8b43036e20f5991e9cd741b5

SHA256
c19d55e0d2c1930f863cd286c5349f286eaa71891fafc36592cefbb96187ed7a

SHA512
7e7a232640f343550a3def29571685bfaac10815a5480d5c71ba1f0e5501629d90d94f94e438895d882902e65b3f236e50ba7ac98abd19d78758d06bfaa39714

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f7a7c5008291d6d5b5aa8c878a6abf33

SHA1
dadf8294e5b866ca0b4262cf73eea181fddb5c49

SHA256
5a58528d860d2846bcb5e7692c7558e5e25194b7ce200ad27c8b4111098d06c7

SHA512
fc22947648a92d35e3d2a5cf9c3586a0af9c62e0787a171a990eafc32ce6bc70cf89e2285e6deab8b2e2b3755b0a93052d9c796c96c46d7eaac8d4e434e8102b

Download Submit