ede925ed28fd00dad9dd26572140e04f8234e6a392aad7bdb9f2641901c6e816

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4bb4fe1192cb42c1febc5fadaffb00fd_JaffaCakes118.html
Size

28KB
MD5

4bb4fe1192cb42c1febc5fadaffb00fd
SHA1

f60bf3ba8858508d7486807c6adc0bfbce1f8ed1
SHA256

ede925ed28fd00dad9dd26572140e04f8234e6a392aad7bdb9f2641901c6e816
SHA512

8dbc4850153c40049396a98aba8e681c3386d4bfcfa44bfb5359a34cbbec19f97a96d4c57a4b82e5098c3290e9273d0b5d8fea0a427985572fd0fd3ef4296cdb
SSDEEP

768:SlzdsFqvfudlQVV1C5m1CCCcmzm3C/CnCQGGXzIHXbz2:StdsFqvfug1C5m1CCCcmzm3C/CnCQ9sm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
884	msedge.exe
884	msedge.exe
1276	identity_helper.exe
1276	identity_helper.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 4324	884	msedge.exe	83
PID 884 wrote to memory of 4324	884	msedge.exe	83
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 400	884	msedge.exe	84
PID 884 wrote to memory of 3020	884	msedge.exe	85
PID 884 wrote to memory of 3020	884	msedge.exe	85
PID 884 wrote to memory of 3048	884	msedge.exe	86
PID 884 wrote to memory of 3048	884	msedge.exe	86
PID 884 wrote to memory of 3048	884	msedge.exe	86
PID 884 wrote to memory of 3048	884	msedge.exe	86
PID 884 wrote to memory of 3048	884	msedge.exe	86
PID 884 wrote to memory of 3048	884	msedge.exe	86
PID 884 wrote to memory of 3048	884	msedge.exe	86
PID 884 wrote to memory of 3048	884	msedge.exe	86
PID 884 wrote to memory of 3048	884	msedge.exe	86
PID 884 wrote to memory of 3048	884	msedge.exe	86
PID 884 wrote to memory of 3048	884	msedge.exe	86
PID 884 wrote to memory of 3048	884	msedge.exe	86
PID 884 wrote to memory of 3048	884	msedge.exe	86
PID 884 wrote to memory of 3048	884	msedge.exe	86
PID 884 wrote to memory of 3048	884	msedge.exe	86
PID 884 wrote to memory of 3048	884	msedge.exe	86
PID 884 wrote to memory of 3048	884	msedge.exe	86
PID 884 wrote to memory of 3048	884	msedge.exe	86
PID 884 wrote to memory of 3048	884	msedge.exe	86
PID 884 wrote to memory of 3048	884	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4bb4fe1192cb42c1febc5fadaffb00fd_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff956ee46f8,0x7ff956ee4708,0x7ff956ee4718
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,871360330964749782,17943195606640474502,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,871360330964749782,17943195606640474502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,871360330964749782,17943195606640474502,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2488 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,871360330964749782,17943195606640474502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,871360330964749782,17943195606640474502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,871360330964749782,17943195606640474502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,871360330964749782,17943195606640474502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,871360330964749782,17943195606640474502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,871360330964749782,17943195606640474502,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,871360330964749782,17943195606640474502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,871360330964749782,17943195606640474502,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2652 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,871360330964749782,17943195606640474502,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
ed61ba87291c5d073ef050f4d1d3fa0f

SHA1
22dde11199d0e4dfa8d9e9a754ff83fd13632371

SHA256
ff99e627b58025cc4736c3f63902101be1189818a122e31385e09b6bb1d2a094

SHA512
423ab6963b8c60da3450b5f2cf2af5c90ff75399ef064685e530afb5f788e24752b17530aeb719806585ef0b42188e1088900c4d37618a838ca0b9aeba8f065f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
775B

MD5
0b30912de59d18e67203e5fc8b41ce4e

SHA1
68852051d943b587daa98e02d9f4dfe8382f0b29

SHA256
5f7a498be66ac3fd0f92eca2bd7e709dc1ebfbf877d75d3e9a81680724d8bc68

SHA512
254415c2fa96ba7dbda597e23107ba68f71142642b13f9cd77abb81f1a2e278a174ab1d75f914bb61413fb190a401fd7c3a50714f7378ce8f0c05a8a725f6398

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8c123c6ed93e67af2746c6db37ac28f0

SHA1
89b7253a30f5e1f6696ae0f07c67c333cb29ec57

SHA256
364753c9e8bbdf435a52fd2c30d6df02ee0d02160082844ea3c64bbd7d719b98

SHA512
14db1bfe00111c85ed95bc40e3c85af6cf4312bfa9ccd651f120d045c3b544f04c481d262692693eaa88f564dc16dbac562a176cbe59144469a9269d689baf0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b547b23f20cc08a6f1f90072d2ea19c8

SHA1
2c571b9239123a4c4949980d95ad11a31dd48881

SHA256
f8874ab44c45c149d0e01856f8ad2bd6165744f76c021a6215553e854012e6e0

SHA512
166284f221ed5125aecf693f5795e1a998f6a4eeb34663d1121d66bcc01c4b32093988d8be65cfb4a88a6b3fde3314a4ba2b387d20350d41a8f7102ed398dba0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2926e101b7d20c2e761d1e06c5e38d3c

SHA1
3500fd374cb30c400b2acf4873c4cf53cae914dc

SHA256
d0bc1e68f45acd95ca3d8275c759df15092b0cf06702a10585fb9a9277fb7dc8

SHA512
747c5369863596ec47546433732e66ecbedfa6c78f35c7ea2146e5cbce951d2145aae21c3b6f046c8ebfab981ce327fa1ffc454a1213bfe0218dabb725379fa1

Download Submit