160e0b14918658bb843002f582fb1f12b9e2ef6a195a2b660212ed836296077a

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68bd08d00b4120ca0b2aa10c5f46bbda_JaffaCakes118.html
Size

195KB
MD5

68bd08d00b4120ca0b2aa10c5f46bbda
SHA1

65a365d2a60056b2e008d8aee838a5a3bde6010e
SHA256

160e0b14918658bb843002f582fb1f12b9e2ef6a195a2b660212ed836296077a
SHA512

13ec1b3f215fad126212a42f672d3a644a67dfdbb8e6ed5f5ec6cbde708f19343d35494ff7deb643ba901abd5454519beff713bc040f964391bef9457565f427
SSDEEP

3072:2zSmEt4w4DQLcNlcC3o+jdfTsFarJq6zzvS0iyZMqWQUzuQDERSZX+gbuxFQ:2GYHrJIcgv

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
512	msedge.exe
512	msedge.exe
3576	msedge.exe
3576	msedge.exe
2904	identity_helper.exe
2904	identity_helper.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

3576 msedge.exe
3576 msedge.exe
3576 msedge.exe
3576 msedge.exe
3576 msedge.exe
3576 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3576 wrote to memory of 4268	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4268	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2304	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 512	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 512	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2652	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2652	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2652	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2652	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2652	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2652	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2652	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2652	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2652	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2652	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2652	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2652	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2652	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2652	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2652	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2652	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2652	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2652	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2652	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2652	3576	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68bd08d00b4120ca0b2aa10c5f46bbda_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x40,0x7ffd6b7d46f8,0x7ffd6b7d4708,0x7ffd6b7d4718
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,749788212886345926,17934785368927022369,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,749788212886345926,17934785368927022369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,749788212886345926,17934785368927022369,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,749788212886345926,17934785368927022369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,749788212886345926,17934785368927022369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,749788212886345926,17934785368927022369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,749788212886345926,17934785368927022369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,749788212886345926,17934785368927022369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,749788212886345926,17934785368927022369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,749788212886345926,17934785368927022369,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,749788212886345926,17934785368927022369,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,749788212886345926,17934785368927022369,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5780 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
727B

MD5
04aa4e88b009a8b34b646a98d92ce1db

SHA1
bd32034eba17425cb646a1e3e8f3194205eac536

SHA256
dfe1ff66e0e9f5cb4b773c25682a599a4d06b5b81b53902d79a9559266cffc6f

SHA512
ea9ca9a4ff872019fccadaa6a5742a36aab32e93f39b542a42c4cee927c31d31a2caf7ccdf5862127b51a9713c1c13ecf84de1ec21375ebb6c6ed4c989f1a365

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c82c91cc66b73f9205eb764b30d865b6

SHA1
a020c1bc6546621fff9136490f9f70270818e81c

SHA256
c80905a0bf8a27fcbfd26d31d40723313671a248a630c63bf3f939922c190740

SHA512
cd09167f54d9219541e7bf40344f60318c116d0815559c76a70116bb2cf528e2d1675d720354b72980e589fa55d4c329231f07490a22154387d04029395aa229

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
89398ba1447096f9c44501e90c05e3e1

SHA1
e3a04d7ba3fe43f50a0ae0530b2857d1cb2c89dc

SHA256
6c054f14ff9bddfc9315a362fb236d64e2b5e389762d20821eec412717e60528

SHA512
6d4c8d18910751f00c9b89fdcd5814c46718e40a626a7542cbb517af9164bb288d4b8017d4c2fba15737a23b332d8566127ad137d58cd754bb4256764b5ba2a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a77dc0e79ccfd4db72fd0b17401fcffc

SHA1
4edc4b53686af8fc2f3249c427655eb665fead52

SHA256
dbc2e613317ce633b34ec68220e770eaf7a03c8e95c241216d21160edaaabcbd

SHA512
729ea6843bc84f9016afa835517d21ba38356ad2dece1384fba55cac12ec6192377536cfd7b216e18d436d9cb6b3aa3bd380c9f280cd71cb6a264d8c41f26c96

Download Submit
\??\pipe\LOCAL\crashpad_3576_SDNGATQJWMGWSQIW

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit