addba5cd086e8fc2fa726a4d2ad3cabf0db8f0f3e5284b1ab7b0511c99ebed04

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 09:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f440b5c1e5f85cdb478c046d12055af_JaffaCakes118.html
Size

96KB
MD5

4f440b5c1e5f85cdb478c046d12055af
SHA1

32a15a7959841ed8c453396e77fb7298b5f1d17f
SHA256

addba5cd086e8fc2fa726a4d2ad3cabf0db8f0f3e5284b1ab7b0511c99ebed04
SHA512

7f96f37bbaecedeb6028ca8f19b6afb556a90ce04a5d6bf6c1ce891350f0d6cba8c30835f8f14f0e6819dfda961077ce1e0a5fd3ea31dab63ce7156143f3b541
SSDEEP

1536:Ldl0PRsg2o4yUaTJS7+9hwwLMkwY2zJjD:LdusgjUa1S7+9adYgJjD

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe
4792	msedge.exe
4792	msedge.exe
4032	identity_helper.exe
4032	identity_helper.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 4424	4792	msedge.exe	84
PID 4792 wrote to memory of 4424	4792	msedge.exe	84
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 620	4792	msedge.exe	85
PID 4792 wrote to memory of 5068	4792	msedge.exe	86
PID 4792 wrote to memory of 5068	4792	msedge.exe	86
PID 4792 wrote to memory of 836	4792	msedge.exe	87
PID 4792 wrote to memory of 836	4792	msedge.exe	87
PID 4792 wrote to memory of 836	4792	msedge.exe	87
PID 4792 wrote to memory of 836	4792	msedge.exe	87
PID 4792 wrote to memory of 836	4792	msedge.exe	87
PID 4792 wrote to memory of 836	4792	msedge.exe	87
PID 4792 wrote to memory of 836	4792	msedge.exe	87
PID 4792 wrote to memory of 836	4792	msedge.exe	87
PID 4792 wrote to memory of 836	4792	msedge.exe	87
PID 4792 wrote to memory of 836	4792	msedge.exe	87
PID 4792 wrote to memory of 836	4792	msedge.exe	87
PID 4792 wrote to memory of 836	4792	msedge.exe	87
PID 4792 wrote to memory of 836	4792	msedge.exe	87
PID 4792 wrote to memory of 836	4792	msedge.exe	87
PID 4792 wrote to memory of 836	4792	msedge.exe	87
PID 4792 wrote to memory of 836	4792	msedge.exe	87
PID 4792 wrote to memory of 836	4792	msedge.exe	87
PID 4792 wrote to memory of 836	4792	msedge.exe	87
PID 4792 wrote to memory of 836	4792	msedge.exe	87
PID 4792 wrote to memory of 836	4792	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4f440b5c1e5f85cdb478c046d12055af_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff871a346f8,0x7ff871a34708,0x7ff871a34718
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,12733966321781694383,5728667575051340477,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,12733966321781694383,5728667575051340477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,12733966321781694383,5728667575051340477,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12733966321781694383,5728667575051340477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12733966321781694383,5728667575051340477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12733966321781694383,5728667575051340477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,12733966321781694383,5728667575051340477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,12733966321781694383,5728667575051340477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12733966321781694383,5728667575051340477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12733966321781694383,5728667575051340477,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12733966321781694383,5728667575051340477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12733966321781694383,5728667575051340477,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,12733966321781694383,5728667575051340477,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1304 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
20KB

MD5
397383c90a2d930f866f405747e27466

SHA1
7bb6b5d6cee104c877dc5c3462f61232ffe5b360

SHA256
a67db01d19e15d8fa76e5a075e336e195325d79d277a83aadb6a440acf887c47

SHA512
4357eddc0581e3cd6209646540bf59756cb4035d7dba47d5cb6b0050e6c202bda65721d4e9d644f37e3cd105bc5fa240574cfa96649f01e2769b796b523e08aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
9a88885ed2741ad645e7b0f8cf99269d

SHA1
6069b96bfc8e0acf2808a79a8d29c0100406f35b

SHA256
037fae470ec64441e75210d4d7e0944549256a8fb044632d9c4e22e02d68546d

SHA512
944d3f222da58634b7950ee8733337f5410956ac5ad0af81a90004d35dc35a9ebbd4cfe41e4dba21973af28f70a44afb1d13907326e523dbbd49b8ec106cef82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0624be84f906bde982ce17a0c6687c4c

SHA1
e2323b9c9cc4ad347fc28b6899b757a7a5cdce92

SHA256
7f4d282e02f10671f727d179c29136842633ac77d25be7db6e8e599263985814

SHA512
76ce2cbdc884371a5f9e4f87cf0319717bcbd9c59d4283415e51510b1ff3de65961b10d575838f5a8e99467b4e68629598a55325c5f1cb75d450134abdcea655

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
50ed28d261fa1874abc0af0e85a84092

SHA1
2a3184a5caa7478d421b19f31d59c4a5d0fbbab5

SHA256
26b5fbb87799de56d7b5d83492b42802744e5e3a44c4045ee5fa93173e98771d

SHA512
a782c18d1f2aaec29f9aaba2c16d931be6268bc6dfbba99977d19ef5ee7fb74a8656e5643cb663d08e9416e5a9e42b699631bf953e4537c0c86ad0dc415eeb9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
14860a80357aef466fb5220835e8ebf0

SHA1
dc579bc244b957e017835abe75732ed23337c9b1

SHA256
9dff12fbd376b36bb7504e4220602f1850457318e4b43b0da9d1faca97603859

SHA512
cf0dc8863d1db84130bbe48f6169f3a53d78148831abeb44114d1af45975c114d11ed6f1b2f4e4c55c5447cb2d358232c70ee0ebc67dee4fa540effc2b89c6a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3b9b1ee44be50928110cb2a22416e023

SHA1
3930733d435e89bd522129a4f96fe1509d554a6e

SHA256
586e5b1193441cdca846f8bc5554b3cd19797029650017b6375ae500786ea3fe

SHA512
51f3c1b39fa5805784a19dda4be70529a565afa4c1197e0133933fcb058c066283d8e6220230341baae27f15fb778777b907d11bf9efd07444ffdf8de0b2c79f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6a8f6e9cc6b55265c96506574e883e4f

SHA1
495872072ca104d77c33c3f632bc06a7ad4d1d2a

SHA256
995b7977e79bc49fa272f7dbdbe5365c2c2f15760015f390e8eb7b9da9458000

SHA512
174da4cc6b9d4e48ed3052defa3a8890955cf49f4016ba80e45b7d19f71a81871bb2bb58600c4ba1af46fa54cc8ce19e7675805b05d04a28d06563b5d734928d

Download Submit