8fa0c00d84a5e50d21b233ebeda9aa0d516bd69027d7730a90e979b72cd1ddb9

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 06:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4eddcad5cc09765ac381461e39aaafa9_JaffaCakes118.html
Size

3KB
MD5

4eddcad5cc09765ac381461e39aaafa9
SHA1

7777e0009ad52e4d8b91ed35a06fb9bd5255d401
SHA256

8fa0c00d84a5e50d21b233ebeda9aa0d516bd69027d7730a90e979b72cd1ddb9
SHA512

e4ddc876a5accac09a0be2c51f10ac336dfa6f303392ce0af6a31ed73584f04a5874d6f5a5ab4488649613148a0476346fbf7484b59952421b763624f2a12f98

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
3992	msedge.exe
3992	msedge.exe
2576	identity_helper.exe
2576	identity_helper.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe
3992	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 1436	3992	msedge.exe	83
PID 3992 wrote to memory of 1436	3992	msedge.exe	83
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 412	3992	msedge.exe	84
PID 3992 wrote to memory of 4416	3992	msedge.exe	85
PID 3992 wrote to memory of 4416	3992	msedge.exe	85
PID 3992 wrote to memory of 3096	3992	msedge.exe	86
PID 3992 wrote to memory of 3096	3992	msedge.exe	86
PID 3992 wrote to memory of 3096	3992	msedge.exe	86
PID 3992 wrote to memory of 3096	3992	msedge.exe	86
PID 3992 wrote to memory of 3096	3992	msedge.exe	86
PID 3992 wrote to memory of 3096	3992	msedge.exe	86
PID 3992 wrote to memory of 3096	3992	msedge.exe	86
PID 3992 wrote to memory of 3096	3992	msedge.exe	86
PID 3992 wrote to memory of 3096	3992	msedge.exe	86
PID 3992 wrote to memory of 3096	3992	msedge.exe	86
PID 3992 wrote to memory of 3096	3992	msedge.exe	86
PID 3992 wrote to memory of 3096	3992	msedge.exe	86
PID 3992 wrote to memory of 3096	3992	msedge.exe	86
PID 3992 wrote to memory of 3096	3992	msedge.exe	86
PID 3992 wrote to memory of 3096	3992	msedge.exe	86
PID 3992 wrote to memory of 3096	3992	msedge.exe	86
PID 3992 wrote to memory of 3096	3992	msedge.exe	86
PID 3992 wrote to memory of 3096	3992	msedge.exe	86
PID 3992 wrote to memory of 3096	3992	msedge.exe	86
PID 3992 wrote to memory of 3096	3992	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4eddcad5cc09765ac381461e39aaafa9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8591c46f8,0x7ff8591c4708,0x7ff8591c4718
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,16270008786171269952,863202255867685262,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,16270008786171269952,863202255867685262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,16270008786171269952,863202255867685262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16270008786171269952,863202255867685262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16270008786171269952,863202255867685262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,16270008786171269952,863202255867685262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,16270008786171269952,863202255867685262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16270008786171269952,863202255867685262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16270008786171269952,863202255867685262,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16270008786171269952,863202255867685262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,16270008786171269952,863202255867685262,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,16270008786171269952,863202255867685262,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1db889677ba3ea1b2296afeaa31f358e

SHA1
9ff1e60f55b183ec227b670cb3a500a48f265817

SHA256
453db157f3c4ac710e9f3d21e1856a604bc9e882255be9faffbd89677aa83e15

SHA512
68358d9c0182b6a36deee1a870a6885c4db2a94eb620002c7f3a2c6a8f47b168be7054ada4ac6f82d8d3cf1f2530840bfbdfa891933231e66a3609b124f07db9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b4549b52d1406228f07a793bf70e9c96

SHA1
d189ed30a957b031f717ca2e82d290c4d25c9d25

SHA256
afad253415a361de1b50ea2016b602ace3166adc1b1c0f7db63da1329e35715c

SHA512
c249735f393c3f41c1cf6d2ba9b027f187b1b3c762eacf5a4727633d571fa9b4f0432c905477361f8822e0ef53812e85caf1e59cc4e0b2c8f0f81378cb90ecbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f1baa449-dd67-40c0-9c47-1fc9bb7e0cec.tmp

Filesize
276B

MD5
63e94862b42530f86676ad4d8dad984d

SHA1
3fd2230f79711e641c7d8bc1fc8f6d671319aec8

SHA256
02bd271fbf1d8f8cfeb229ec24d7bfb1c261116853c2e66a3f5d0b3536f59a25

SHA512
8f57ba1d96f3a97a7867f7eb43efd22baea3a78766fd88e87affcbc1e2e1699de833cbe9d78d22fa784ebf9602bd2006ee315ea13aebbcb79b56ec137c7a5aff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
97c2ece72e4e7e00be5bd4edd52a4175

SHA1
c97e8e26ed31490a093aec0577c5eca7baf93e75

SHA256
a39fa0f57c3a6b67f50ba77444ebe0e0366b5527336bca930e4e8feea2b0fac5

SHA512
bb39e103507e46db1e10faeade0f2cdc1b7ab19773f2bc541cc5f35efd14e91cc598f4a201a5a1c66730079708ebe42ed94f5bf5ef42e6386ce24b259963f6ab

Download Submit