5170606223131bbf2c71835c7b15d32e3cda7e5e551ca98f24d8b450b891e81c

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63be478cafa4f228736929fc944e0d5c_JaffaCakes118.html
Size

53KB
MD5

63be478cafa4f228736929fc944e0d5c
SHA1

651983d90bdff77dde4220bebb8d5a434aa221b7
SHA256

5170606223131bbf2c71835c7b15d32e3cda7e5e551ca98f24d8b450b891e81c
SHA512

795cf9e15e258c7b74caaf2a1043753524592eb580bc80b9d85cafec3e4dc5095cc265b5a377795cc6659d58614a40097019e574f334fa7b31977376bf2ffe06
SSDEEP

1536:ADNTc9i0MQBtjGebPEHTClbw8MXb5yUIyssv:YNTc9i0MX9Xgg

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

4372 msedge.exe
4372 msedge.exe
4848 msedge.exe
4848 msedge.exe
4592 msedge.exe
4592 msedge.exe
4592 msedge.exe
4592 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

msedge.exe

pid process

4848 msedge.exe
4848 msedge.exe
4848 msedge.exe
4848 msedge.exe

pid	process
4372	msedge.exe
4372	msedge.exe
4848	msedge.exe
4848	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4848 wrote to memory of 1308	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 1308	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 3700	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 4372	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 4372	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 396	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 396	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 396	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 396	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 396	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 396	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 396	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 396	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 396	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 396	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 396	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 396	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 396	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 396	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 396	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 396	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 396	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 396	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 396	4848	msedge.exe	msedge.exe
PID 4848 wrote to memory of 396	4848	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\63be478cafa4f228736929fc944e0d5c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c0ef46f8,0x7ff8c0ef4708,0x7ff8c0ef4718
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,15332154520679798944,10156428821074763880,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,15332154520679798944,10156428821074763880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,15332154520679798944,10156428821074763880,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3000 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15332154520679798944,10156428821074763880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15332154520679798944,10156428821074763880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15332154520679798944,10156428821074763880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15332154520679798944,10156428821074763880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,15332154520679798944,10156428821074763880,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
6863bba1317e363e895e36f0f7113975

SHA1
d4332076182924b55df3f36140c3fd04ca4cdcc8

SHA256
09107ed08e57fe158722986f570bd6067360d520f088a282ba6a1c15052cd0e5

SHA512
d83ba831399b6267f1878e1d1998ab6d67895381607c593c2f18d0165676c5183da1be8cdf85c9687c7506b8761645df83ae19f10c6ce06430e6a6fe9e4e3128

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4a739a0f13bcf56673b6c7e803def32e

SHA1
a66b272144bf69ef58665562edf4bdf0077ce39f

SHA256
6eac1896067241596eb59614975c255cbb251e473297a77def506bbfccccca2b

SHA512
3ce8938c452dff784d49dea3c1f886922f18012a73db980ec134b8338afd0972ef6a9083337acc91125537938a145f2cb2a73ee8bda7ed8a0a868b3a2b8bc4b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
597536c06a11bb0fc11cd8606c49708e

SHA1
0386081fb84b26ec4f7146f3d17ae09d528087a0

SHA256
4e2b7c9b37f8cf26b9c93d82dafeb0292b0f97efd3f62ecd260e0003c849c776

SHA512
b3a8c8ea6eb4e907eda5ca8728d531c108b7d5a55c8e6330d87fdb263de8a202fe4b86947003c86b938ba84fb09888a5b854b96eaf37408b169c7f0323d7be07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
1da12c6df510b465334423857d5e2244

SHA1
defda9819f2ec3fbee30403bb153a817b578e83b

SHA256
663a4f1183db9d4bf025b61ccaed31835fb2a55be605f72a6bf8496fdedcecf0

SHA512
42e56f1fd024aecd240e3759b3bb9d1228246330d222b68e6fda01e46c6506bc887cfc5e1959febe305b584e06950304c6f5161844a7e9ae9432768de87af635

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58248a.TMP

Filesize
538B

MD5
fadefcc21a9f50d66782c01cfea34a9e

SHA1
b6b298587afd24c74695121c7add6d2183907240

SHA256
50537b6e5281e8e26db50cea0b9e553eacca06c53fbe90f17b661c4445eacadc

SHA512
6af0518fc380d10ed24c0f6c27f85372cb239f7b49d8028fb33ccd8a7e2c47fbcd48ceececae8f5539d834186ef331a98f4ce39dce2fc1477818ad978cc83509

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a7a3254a-7473-412f-8070-53735c952965.tmp

Filesize
5KB

MD5
30192e8d95cbb6ce87e0a1d5fe56a434

SHA1
09a37e7a79cf74a4f475c1ff8f9295888f214d41

SHA256
fe0202857fdb21078d501d91983e2b6ac0ba8e5e1f2d4db2ba9afb7d8938fa83

SHA512
0d629d19e89d1329d846c571648002e70232e7ad2227589b68e2062a255bc2e84a2c7c51554a766d7ef439df76bdfb0db59443c32db0b8d9099ebe9b49391a29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
982bb2d550af220422504391a54e4744

SHA1
064d0970b71ce91f9c6b063c9dec7208b657ee00

SHA256
8b905bd55dd2afd5e39815b63eb78afcbbf75a738b85c5b822fb59edaeac64e3

SHA512
0e361b29a1e6b5f115fd591a50b2fe18f2c87132b593b3325de48fe0b8ae0568ffb3306316a191145eb24e9561d071099877d2bab93fa851ad3b40cfa40f3dd1

Download Submit
\??\pipe\LOCAL\crashpad_4848_AZAWPMOJFCJXOLNZ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit