a913ab7baa0210b8ff22bf5464953f5eb1bd1c3ae350307d4f6146acd38ecb6f

Analysis

max time kernel
145s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 14:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4b856f263c88f65a3b8412f90fa122a7_JaffaCakes118.html
Size

24KB
MD5

4b856f263c88f65a3b8412f90fa122a7
SHA1

408b9be2be3faa5303ec538c0381301ffc9bca66
SHA256

a913ab7baa0210b8ff22bf5464953f5eb1bd1c3ae350307d4f6146acd38ecb6f
SHA512

a0ef0b2f75b99b6275163794fa26e9ac6ab77bebd3acef9b9a5ea96627350a941e73dd54152843267fc27e535bb86e88930589250f45635eb2e34441d4117735
SSDEEP

384:SIq4Uc4SXR6kZzJImEjcZ4ZuWa3NEy8qnoX6kq2J87CF:SN4Uc4SXRpaqWa3qyxo4X7CF

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3260	msedge.exe
3260	msedge.exe
5348	msedge.exe
5348	msedge.exe
5528	identity_helper.exe
5528	identity_helper.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5348 wrote to memory of 816	5348	msedge.exe	82
PID 5348 wrote to memory of 816	5348	msedge.exe	82
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 1488	5348	msedge.exe	83
PID 5348 wrote to memory of 3260	5348	msedge.exe	84
PID 5348 wrote to memory of 3260	5348	msedge.exe	84
PID 5348 wrote to memory of 1012	5348	msedge.exe	85
PID 5348 wrote to memory of 1012	5348	msedge.exe	85
PID 5348 wrote to memory of 1012	5348	msedge.exe	85
PID 5348 wrote to memory of 1012	5348	msedge.exe	85
PID 5348 wrote to memory of 1012	5348	msedge.exe	85
PID 5348 wrote to memory of 1012	5348	msedge.exe	85
PID 5348 wrote to memory of 1012	5348	msedge.exe	85
PID 5348 wrote to memory of 1012	5348	msedge.exe	85
PID 5348 wrote to memory of 1012	5348	msedge.exe	85
PID 5348 wrote to memory of 1012	5348	msedge.exe	85
PID 5348 wrote to memory of 1012	5348	msedge.exe	85
PID 5348 wrote to memory of 1012	5348	msedge.exe	85
PID 5348 wrote to memory of 1012	5348	msedge.exe	85
PID 5348 wrote to memory of 1012	5348	msedge.exe	85
PID 5348 wrote to memory of 1012	5348	msedge.exe	85
PID 5348 wrote to memory of 1012	5348	msedge.exe	85
PID 5348 wrote to memory of 1012	5348	msedge.exe	85
PID 5348 wrote to memory of 1012	5348	msedge.exe	85
PID 5348 wrote to memory of 1012	5348	msedge.exe	85
PID 5348 wrote to memory of 1012	5348	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4b856f263c88f65a3b8412f90fa122a7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1ec946f8,0x7ffa1ec94708,0x7ffa1ec94718
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,9570371472987249606,10662290628034204749,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,9570371472987249606,10662290628034204749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,9570371472987249606,10662290628034204749,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9570371472987249606,10662290628034204749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9570371472987249606,10662290628034204749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,9570371472987249606,10662290628034204749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,9570371472987249606,10662290628034204749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9570371472987249606,10662290628034204749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9570371472987249606,10662290628034204749,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9570371472987249606,10662290628034204749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9570371472987249606,10662290628034204749,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,9570371472987249606,10662290628034204749,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
39d21afbeacf8d35dd61e893ffe2618a

SHA1
b1f09cb97652a43bd233c36bf89382f10b28c566

SHA256
2369ad1b5f6f64e9b5fa88d098ceca5ccc8c7efe8b34316f39bdd4ed6502995b

SHA512
01fda96b0f5ecb5ab2edafe3b5a3fbd3024f845efbee641685db77fac025f5f98a8e7ab4a544a8b0116af8748fe4e3b00f12a2fb63c2086b35307817d882e41c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
918e458bb8227612da16b8442f2fef85

SHA1
866297a29cabb72b5016d33b159223f59ca86728

SHA256
146992baa8ad2b3efc7a44b1448ecf0ee67afd566d852cf043d49a0d1f051f92

SHA512
5cfad0c2d3bb345c54513eff15994df5f922d739de6442e014e9bab06bbad809758b05e98ba4bd688fc3af7b936ab7644c4362b3cf863f34ed0d8b02d391c6c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
36a92142aabed83644c37cf5974d29a0

SHA1
7afbca186a86ffd1a091edd794f9c8d5b63bd955

SHA256
101521305df18f14ec4c8c0b7778c4a0b24e558c9735d6e521bff1ec30923a37

SHA512
696c5361b809a301dcf6550c607f349161ba246a6847ff287097913df0d63664405c41254432870985eb597b6c1be39ee76035c66d89a2272d0502a11cb3f231

Download Submit