ed6ef13e150ae8cd101424be2c001cc70e486f2bcf161c7fcd8d1400bd804554

Analysis

max time kernel
138s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 08:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89d924d8db2c39afcb52dbd8f9f7df3a_JaffaCakes118.html
Size

53KB
MD5

89d924d8db2c39afcb52dbd8f9f7df3a
SHA1

85e9ef8d570987f52a389a4360de0b9f58d6b6b1
SHA256

ed6ef13e150ae8cd101424be2c001cc70e486f2bcf161c7fcd8d1400bd804554
SHA512

2dfe4001844a60ce4b075d723f913d686e58a54e618acff02f9e891900756f1f53ab5987bf6bf788c756f2f4b71e055ffb4c2bd92b28207dc3b05c9adbbbc541
SSDEEP

1536:B4Lkc/z9lfaoUsmgyxW73sGGUOROJ1+2qAWUwOxAU9IqPg0xDqilqPg49DkiAu7u:WLkc/z9lio9Pg0xDqilqPg49kiAu7s8u

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2440	msedge.exe
2440	msedge.exe
3296	msedge.exe
3296	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
2920	identity_helper.exe
2920	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 2056	3296	msedge.exe	84
PID 3296 wrote to memory of 2056	3296	msedge.exe	84
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 1260	3296	msedge.exe	85
PID 3296 wrote to memory of 2440	3296	msedge.exe	86
PID 3296 wrote to memory of 2440	3296	msedge.exe	86
PID 3296 wrote to memory of 1104	3296	msedge.exe	87
PID 3296 wrote to memory of 1104	3296	msedge.exe	87
PID 3296 wrote to memory of 1104	3296	msedge.exe	87
PID 3296 wrote to memory of 1104	3296	msedge.exe	87
PID 3296 wrote to memory of 1104	3296	msedge.exe	87
PID 3296 wrote to memory of 1104	3296	msedge.exe	87
PID 3296 wrote to memory of 1104	3296	msedge.exe	87
PID 3296 wrote to memory of 1104	3296	msedge.exe	87
PID 3296 wrote to memory of 1104	3296	msedge.exe	87
PID 3296 wrote to memory of 1104	3296	msedge.exe	87
PID 3296 wrote to memory of 1104	3296	msedge.exe	87
PID 3296 wrote to memory of 1104	3296	msedge.exe	87
PID 3296 wrote to memory of 1104	3296	msedge.exe	87
PID 3296 wrote to memory of 1104	3296	msedge.exe	87
PID 3296 wrote to memory of 1104	3296	msedge.exe	87
PID 3296 wrote to memory of 1104	3296	msedge.exe	87
PID 3296 wrote to memory of 1104	3296	msedge.exe	87
PID 3296 wrote to memory of 1104	3296	msedge.exe	87
PID 3296 wrote to memory of 1104	3296	msedge.exe	87
PID 3296 wrote to memory of 1104	3296	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\89d924d8db2c39afcb52dbd8f9f7df3a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5a3e46f8,0x7ffe5a3e4708,0x7ffe5a3e4718
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,7530287655984576254,830534361412329493,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,7530287655984576254,830534361412329493,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,7530287655984576254,830534361412329493,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7530287655984576254,830534361412329493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7530287655984576254,830534361412329493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,7530287655984576254,830534361412329493,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4840 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,7530287655984576254,830534361412329493,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,7530287655984576254,830534361412329493,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7530287655984576254,830534361412329493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7530287655984576254,830534361412329493,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2336 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7530287655984576254,830534361412329493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7530287655984576254,830534361412329493,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
740B

MD5
0fcf0c48c2433719c7b0a9e3d4629557

SHA1
f29ec6b75014a32e78320464cfbdaaf0237fb251

SHA256
b12cbf0f376979a4f7ce88e668c3c90b46c0b0b91f28f347cf070b1f343ed68f

SHA512
b0953d0b2d67cbe9bc7cd3c12a7b6ba4f7451e9711c6983bc6b06277044da53db6090327003290dc93a5afce2a2c6cea539cfaeaab50571d0cdcd91ba8d4147a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
309B

MD5
8b8aa29a8640e26da100f70ce4736aa3

SHA1
fb952d31ec1e702bf7216af7dedebf01255418af

SHA256
e21ba3cb90706710b340fde06bba904cb036177bef3d732e496765c1f8fadb3b

SHA512
94c2b704ad130f2b9411db2c1977b199f009047d83afbfeaa43a80d08b8f86483c48a6e5016c1af267b7aab7e1646a63c3574f1df93e605e15381f87d6355b84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cc678d9d21542dda4540f4ff7902b47e

SHA1
523ec3f53eedca74337a7145a170e11b626fef1f

SHA256
448da8ab66437ef9d4bfaac0b5e36ef85a440fe74c05f130a8820607204ac8d3

SHA512
54418c0ca2f6a12a48bde26cfc97538c1187501abc48971581bfd09c5527a3428594eca0f21667965808a7f814f40463bca3a7f5619cf92ec77d31930ab185c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
507b8b01d47b6bafd7ba95fc0b9eccd1

SHA1
cc39dcb3c718a7352e0ab33887eee5b1ea35fc84

SHA256
9e66407e2920a2150a84dfc2127541aef5bd45477d2e156966898dd61d109a96

SHA512
ff35fb9ca9141f134b7351debb727e26865e3ebbedb9188fa464e759a594ba319e98a891f784da21e6ecb35ee4762833be367766b07830fa258a0a4f54c5eadc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6d148803c6b4c3ecfc89a5fb4220aa8a

SHA1
2ae2535eb351be21b751b3adf1d46ae440ab5fd4

SHA256
f3a3e864c1ccb249422bb469a34b6e88e023596d000f43c4e14d91f9e5cea723

SHA512
17ab7fab575af5cd483ca3cc3e30d6dd21ef42f14393985ff3b1a2941f2d30b2b7ca2a13ca8a1c1ea5ec18b67642ce870f788addad7e8cbf544c121bf22f01ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
88df91b1cd30e9539dd68399d2216457

SHA1
50e72b25e89de7965ad99f2168a23a20efded487

SHA256
6cb25df0eac8fd71f9c3e19c802d6812e3b858beb3692cbe376d7eead62495b2

SHA512
3545bb861df507cb70c63421e1091ba37525c999067a225436961a7c191d2fdfafb27c48361afe85e53ec0429d0031f4401ec61d0d13503ff29e784a8c972816

Download Submit