b9e3fc98c276600f918137545bfaad787edd016c4bc708926d05875a74701fe6

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 03:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70ca98a22343f4a5313252c9b52d78c8_JaffaCakes118.html
Size

3KB
MD5

70ca98a22343f4a5313252c9b52d78c8
SHA1

f0c85557829f782b1391f71522f8d4951120850f
SHA256

b9e3fc98c276600f918137545bfaad787edd016c4bc708926d05875a74701fe6
SHA512

d94d3e92ca800c5f0e95fc0cbd0c221319bc67c78259f6264d1942fad3bb0e07ec73f182d78f123fd897bc665d88e1c1c4bdc0b529782418fc87573806ac5e33

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3656	msedge.exe
3656	msedge.exe
3884	msedge.exe
3884	msedge.exe
2656	identity_helper.exe
2656	identity_helper.exe
5616	msedge.exe
5616	msedge.exe
5616	msedge.exe
5616	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 1368	3884	msedge.exe	83
PID 3884 wrote to memory of 1368	3884	msedge.exe	83
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 2616	3884	msedge.exe	84
PID 3884 wrote to memory of 3656	3884	msedge.exe	85
PID 3884 wrote to memory of 3656	3884	msedge.exe	85
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86
PID 3884 wrote to memory of 5116	3884	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\70ca98a22343f4a5313252c9b52d78c8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d05046f8,0x7ff8d0504708,0x7ff8d0504718
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,17849946671379643284,11828187593817517423,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,17849946671379643284,11828187593817517423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,17849946671379643284,11828187593817517423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17849946671379643284,11828187593817517423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17849946671379643284,11828187593817517423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,17849946671379643284,11828187593817517423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,17849946671379643284,11828187593817517423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17849946671379643284,11828187593817517423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17849946671379643284,11828187593817517423,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17849946671379643284,11828187593817517423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17849946671379643284,11828187593817517423,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,17849946671379643284,11828187593817517423,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2616 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
276B

MD5
63e94862b42530f86676ad4d8dad984d

SHA1
3fd2230f79711e641c7d8bc1fc8f6d671319aec8

SHA256
02bd271fbf1d8f8cfeb229ec24d7bfb1c261116853c2e66a3f5d0b3536f59a25

SHA512
8f57ba1d96f3a97a7867f7eb43efd22baea3a78766fd88e87affcbc1e2e1699de833cbe9d78d22fa784ebf9602bd2006ee315ea13aebbcb79b56ec137c7a5aff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
13e0bac435fba1795427fd8093dd9212

SHA1
9ed681165934fead01be20e6856c9abbfaafae72

SHA256
f035137efd5a07aa1e9343f207bd6c467e248363c938a72288e48e1a792928c2

SHA512
5962aaf9bba900a11c2b375215a912e8ff646abdfe606fb5e37944c866c017a0f347b2a4fb79661834f20bd24962a54fa8e46050c26a0fd8e4fac611c448af67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aeba0395bc8a8fb862ceb333a8bd965a

SHA1
afd6063e7b403daae4eaddabd014fd4c1ada0f57

SHA256
8abc1f9506f7644858ab9c0fd80ca6070f7d675015965b63afb70b0b61dc7d1d

SHA512
9b8a279982e05298c1cffe8794defd795c57d17c0070ed4049625b7100d42c0bd7110a5a0d756f5317bc37844d7b633a089e9aaaef8bbc5ccdbbcb4d47c97a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d254b682e8632aa649b6a334085ba774

SHA1
3d2147cf40aefd8c0b916f1f814e4dbfbc77bd06

SHA256
a77a2ade2816c08ecd74036117a8b0e089a90d4d8792654a3a920475f855fcad

SHA512
28ca52c50387dca6a60ffb4e0a9fa8aa941572d0ace340346021dd5463860de2dae132034a168d9a9190cf3222d822a0afa90f92c370d450c7bfc3a73b6c67bf

Download Submit