da3db4e8aa36339dce42adce5d60a72267959b7cec243ce49c9333c7506c4896

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 04:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

896832b46d72cda8ec61655e68a09953_JaffaCakes118.html
Size

22KB
MD5

896832b46d72cda8ec61655e68a09953
SHA1

3f1c79cbbe644c4ac50eccbfd8e98868972d103f
SHA256

da3db4e8aa36339dce42adce5d60a72267959b7cec243ce49c9333c7506c4896
SHA512

0ec100019f8429ee8579e040729c2e34a5f2e8084e96fbd0f27fe3f51cbac7e199385bca60a8ac4c69f6b9b4d115411ecc3f2ea4599e2200d104f0e2fa67d59a
SSDEEP

384:S2h9DuEKqgNLS1r3PV7jX/mAPcuzFoNK8/+rJI8O5i1:SuQegNLGZjK8O5i1

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2900	msedge.exe
2900	msedge.exe
3116	identity_helper.exe
3116	identity_helper.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2400	2900	msedge.exe	83
PID 2900 wrote to memory of 2400	2900	msedge.exe	83
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2884	2900	msedge.exe	84
PID 2900 wrote to memory of 2624	2900	msedge.exe	85
PID 2900 wrote to memory of 2624	2900	msedge.exe	85
PID 2900 wrote to memory of 544	2900	msedge.exe	86
PID 2900 wrote to memory of 544	2900	msedge.exe	86
PID 2900 wrote to memory of 544	2900	msedge.exe	86
PID 2900 wrote to memory of 544	2900	msedge.exe	86
PID 2900 wrote to memory of 544	2900	msedge.exe	86
PID 2900 wrote to memory of 544	2900	msedge.exe	86
PID 2900 wrote to memory of 544	2900	msedge.exe	86
PID 2900 wrote to memory of 544	2900	msedge.exe	86
PID 2900 wrote to memory of 544	2900	msedge.exe	86
PID 2900 wrote to memory of 544	2900	msedge.exe	86
PID 2900 wrote to memory of 544	2900	msedge.exe	86
PID 2900 wrote to memory of 544	2900	msedge.exe	86
PID 2900 wrote to memory of 544	2900	msedge.exe	86
PID 2900 wrote to memory of 544	2900	msedge.exe	86
PID 2900 wrote to memory of 544	2900	msedge.exe	86
PID 2900 wrote to memory of 544	2900	msedge.exe	86
PID 2900 wrote to memory of 544	2900	msedge.exe	86
PID 2900 wrote to memory of 544	2900	msedge.exe	86
PID 2900 wrote to memory of 544	2900	msedge.exe	86
PID 2900 wrote to memory of 544	2900	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\896832b46d72cda8ec61655e68a09953_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b7db46f8,0x7ff9b7db4708,0x7ff9b7db4718
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,17838388745207447357,13767355542182628991,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,17838388745207447357,13767355542182628991,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,17838388745207447357,13767355542182628991,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17838388745207447357,13767355542182628991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17838388745207447357,13767355542182628991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,17838388745207447357,13767355542182628991,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,17838388745207447357,13767355542182628991,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17838388745207447357,13767355542182628991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17838388745207447357,13767355542182628991,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17838388745207447357,13767355542182628991,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17838388745207447357,13767355542182628991,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,17838388745207447357,13767355542182628991,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4772 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
445B

MD5
c3473d5274166a56f2cdc9dd3d7090f4

SHA1
67a3de6238e230884d8813c5016834d69b269e4d

SHA256
4e081bf2213739859f3dc90c092742ac2ff0b0b7ee932d79cb083d61d3217cfc

SHA512
3150872c11d0ee771107227884f80d667a923e5b936c5583f1eca04eb585b491629d5f730e81117bbbd5db53c5a2309990780fcb96e41ff9603228293380626d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5c78dfa752ae345af02979c563c9bae9

SHA1
677c0781189e87aba0210cf9c5b66882b812cbf3

SHA256
f09cdbb43330a012d17e1e8d97115b85c65a7c8493818e8ecc14ff44e4820b9c

SHA512
d8f53ba30882067f40adc065c9b4a39f84d42b5c508ebc5c6e75857f1fb16eda22a2414f758095856ed6cd4811a78ad9795024fb1865d26bcdcbcb11fdf235fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0c36af318b52c8e57abd0d3df50acfb1

SHA1
bb60d7b712cf41c359bc91e6803f345ccd008e2b

SHA256
03f7ee7f2279c638d26207fec2088c92a4438a7d197d2bb36fa0999bb03585cb

SHA512
f97a84f6ad213f7043921875d3ac46ccfe937d58b5e0b8caf9aca4c5a8064608e16c27a3d931d2065bcca02cded7fb7e39a6ab8882dc2b16358e8fe6fbab65c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f4d6932e-c6a4-46ef-9840-0a081640fd63.tmp

Filesize
6KB

MD5
0c07fb04dee3c882c60fe5f1041cd6ed

SHA1
215593225b9f59eeb7f0f061709ba2e6c4cc8c35

SHA256
4686369d0c62fa761dba7cd7890a458671181132feb1f6cd3fd8aecae8e8510c

SHA512
c80effb54744d3d5d48421e3b9f5f8fd49dc3794193ce2dd35c65d772a1bc3938f8f40bcf1809b8beb74ac6f3d4f4aae715364df02541e3530304bf91647b6bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ae86e44e81344a6cae037452c0b7ab02

SHA1
2bd87195d8d59abd2828c1e1d1ff9c716f71f279

SHA256
3ba9e1792031202064f3234e418ed018843988a5036dc6f65491a225a1e8c1a4

SHA512
67ce89f73089ea279253763dcc77328d08ab4df1fec4d1a82389fda6c3f230acad557699425786033844926b14a1d8c434aa312bda9f586687deffe7c7cd99e8

Download Submit