55fc2db94eb7ccc7e6f12a628007ed39dca322bc13f16248dcaf5814a2168ad8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 14:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63b36427042467c06f895bd48c8718eb_JaffaCakes118.html
Size

92KB
MD5

63b36427042467c06f895bd48c8718eb
SHA1

6effcce2b89df05cd295faff7ceda5d777ea488e
SHA256

55fc2db94eb7ccc7e6f12a628007ed39dca322bc13f16248dcaf5814a2168ad8
SHA512

eda75159cdfb2450596d45e382ace5f1b18619fa949985b608bc6ab598092598be301a86864766dea4ac632947b6937c38166c0396321c413a12ea123843fdfc
SSDEEP

1536:zDnO9mCBgMeb0ASTBgSGUTBge+wKHBgcqitzGd1zjBgyrSBgkKbfrGBgLqL/Xg6r:m9bBg+BgQBg5Bg5BgjBgt6Bg8WBzj9G

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
316	msedge.exe
316	msedge.exe
368	msedge.exe
368	msedge.exe
4492	identity_helper.exe
4492	identity_helper.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 1628	368	msedge.exe	83
PID 368 wrote to memory of 1628	368	msedge.exe	83
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 1556	368	msedge.exe	84
PID 368 wrote to memory of 316	368	msedge.exe	85
PID 368 wrote to memory of 316	368	msedge.exe	85
PID 368 wrote to memory of 984	368	msedge.exe	86
PID 368 wrote to memory of 984	368	msedge.exe	86
PID 368 wrote to memory of 984	368	msedge.exe	86
PID 368 wrote to memory of 984	368	msedge.exe	86
PID 368 wrote to memory of 984	368	msedge.exe	86
PID 368 wrote to memory of 984	368	msedge.exe	86
PID 368 wrote to memory of 984	368	msedge.exe	86
PID 368 wrote to memory of 984	368	msedge.exe	86
PID 368 wrote to memory of 984	368	msedge.exe	86
PID 368 wrote to memory of 984	368	msedge.exe	86
PID 368 wrote to memory of 984	368	msedge.exe	86
PID 368 wrote to memory of 984	368	msedge.exe	86
PID 368 wrote to memory of 984	368	msedge.exe	86
PID 368 wrote to memory of 984	368	msedge.exe	86
PID 368 wrote to memory of 984	368	msedge.exe	86
PID 368 wrote to memory of 984	368	msedge.exe	86
PID 368 wrote to memory of 984	368	msedge.exe	86
PID 368 wrote to memory of 984	368	msedge.exe	86
PID 368 wrote to memory of 984	368	msedge.exe	86
PID 368 wrote to memory of 984	368	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\63b36427042467c06f895bd48c8718eb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff810c446f8,0x7ff810c44708,0x7ff810c44718
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,10505727390081158705,4320847801190666703,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,10505727390081158705,4320847801190666703,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,10505727390081158705,4320847801190666703,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10505727390081158705,4320847801190666703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10505727390081158705,4320847801190666703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,10505727390081158705,4320847801190666703,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,10505727390081158705,4320847801190666703,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10505727390081158705,4320847801190666703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10505727390081158705,4320847801190666703,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10505727390081158705,4320847801190666703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10505727390081158705,4320847801190666703,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,10505727390081158705,4320847801190666703,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4880 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:64

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
550B

MD5
2c1b272c3b9fd870a9395547cae2a8ba

SHA1
d3db81670ef28a26fd0eb65cf56af8cbdb73ad79

SHA256
867959caf3a53e04038f778a84694a508234931e90fa787571da6c2f2a375d1f

SHA512
f151fc5a11304f801c2f1d2262cb03a94ef13d901b7979b8e0a14804547c236e22cca6a8df025eac8e68e693938989fe89c8a2e6c525b072e3f321c50d3a87a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0db05e98b06e075199f67af6b6c75351

SHA1
e67a6bebb540299111468badd8eba27d4c4b059e

SHA256
cdbb2d51c8f915e322427362f89fe05547ff3e0d33fcd4d09ecf11e36b572734

SHA512
afb7749b8fd6b45872ae14e43e4b31e1aa14026d682381bc6d3e56ac82852739b9b31013d35103b8bc1dd493e3feca3302c66ea01576b0c6a984b127cd2b5148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b0b42eeaf2ab1e4cf88d039925860a80

SHA1
61d0c1acfc4a5df31f8b8ac7a731edde2ba2301f

SHA256
8956b2f5a7f67f0748cf85032d9ec39e62e04e145b07486574da8accd6cf62f9

SHA512
79e3d20e739b0867ee43beba3030be42c988012b8c569e15078c4fc98dc617910e79c5f5c1585af2eb8dd8ea95a23cbd9fb6cfcd1f6bf51d19b1365b1beb334d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a38763887dd1e48159277c04584aea0e

SHA1
c4f49854c3de4999a206b93d3d5e3e2e1da64969

SHA256
4bed8b67fc07cfdde2ea27d5b49889abda9774b5fdfd96dfded089cce18b5a2b

SHA512
ee22acf1d2495cec976f392eeff1321c8a2db17c4b3a2f8f8efda437cd3cc615fe0e69f7faf6b20a80bdefc49855e577bd740997fb04f2d523a105f4c1ce24e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4e8fb5ef2c9d27064226918abe401dcd

SHA1
56974146ed49f11e479c8ec863c5de92d9a43697

SHA256
9f9ba6ddc7f3fe4efc9c42912f164b9f8a69be286e6e2e310281a4003e0c9d96

SHA512
9a9385f887ebb8841f7ffee12a9572d479c61b6d023dbab031307d70994590f6cc63866ffe347229c54970ebbec6726f0a63fba47ab1e1f2fde1b7e3ece87225

Download Submit