6d3a81da2727e4c6dddbcc954e362e12f1be034f03fd6d7f6ab935edc0cfb6d0

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

90cbe09871f7b458c05cbefe1c1fa1ce_JaffaCakes118.html
Size

277KB
MD5

90cbe09871f7b458c05cbefe1c1fa1ce
SHA1

bdc74fdb70af6439fa25f76b69a631e690cdb5fc
SHA256

6d3a81da2727e4c6dddbcc954e362e12f1be034f03fd6d7f6ab935edc0cfb6d0
SHA512

671e1b00c72f07483261a148c841fd0246c91a21c793533d981f2b269cb770e0c9f94df4a51e5010a5c5cba7745c313e2cb85cd1bbab68e54ff864817ccf5a2b
SSDEEP

3072:F32inzK1v7sXOzNAT7fzNqAe2nAhxvifzNqAe2nAhxvnkCqsdSllYPtUP4wtkY3w:F3QvnNAnbsiW4bsiWwYPtfWy

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
1268	msedge.exe
1268	msedge.exe
3568	identity_helper.exe
3568	identity_helper.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 3464	1268	msedge.exe	84
PID 1268 wrote to memory of 3464	1268	msedge.exe	84
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 1644	1268	msedge.exe	85
PID 1268 wrote to memory of 4932	1268	msedge.exe	86
PID 1268 wrote to memory of 4932	1268	msedge.exe	86
PID 1268 wrote to memory of 3624	1268	msedge.exe	87
PID 1268 wrote to memory of 3624	1268	msedge.exe	87
PID 1268 wrote to memory of 3624	1268	msedge.exe	87
PID 1268 wrote to memory of 3624	1268	msedge.exe	87
PID 1268 wrote to memory of 3624	1268	msedge.exe	87
PID 1268 wrote to memory of 3624	1268	msedge.exe	87
PID 1268 wrote to memory of 3624	1268	msedge.exe	87
PID 1268 wrote to memory of 3624	1268	msedge.exe	87
PID 1268 wrote to memory of 3624	1268	msedge.exe	87
PID 1268 wrote to memory of 3624	1268	msedge.exe	87
PID 1268 wrote to memory of 3624	1268	msedge.exe	87
PID 1268 wrote to memory of 3624	1268	msedge.exe	87
PID 1268 wrote to memory of 3624	1268	msedge.exe	87
PID 1268 wrote to memory of 3624	1268	msedge.exe	87
PID 1268 wrote to memory of 3624	1268	msedge.exe	87
PID 1268 wrote to memory of 3624	1268	msedge.exe	87
PID 1268 wrote to memory of 3624	1268	msedge.exe	87
PID 1268 wrote to memory of 3624	1268	msedge.exe	87
PID 1268 wrote to memory of 3624	1268	msedge.exe	87
PID 1268 wrote to memory of 3624	1268	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\90cbe09871f7b458c05cbefe1c1fa1ce_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffedb2d46f8,0x7ffedb2d4708,0x7ffedb2d4718
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,6353996554572509992,1474911893909016755,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,6353996554572509992,1474911893909016755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,6353996554572509992,1474911893909016755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6353996554572509992,1474911893909016755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6353996554572509992,1474911893909016755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6353996554572509992,1474911893909016755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,6353996554572509992,1474911893909016755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,6353996554572509992,1474911893909016755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6353996554572509992,1474911893909016755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6353996554572509992,1474911893909016755,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6353996554572509992,1474911893909016755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6353996554572509992,1474911893909016755,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,6353996554572509992,1474911893909016755,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4940 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c51ce23287e5aa76629d23fabff4b772

SHA1
5bb6323fff532dd8844abeb9bdbb3d7b270cd72e

SHA256
c5b248218cfe781fa682025412ea71494f1c3adc5bc5f8a2dfe2ed46a6c7282a

SHA512
dd10720275e29cf08ffa6de278fd63e673389131fdfae9810ba0fed51524e7feeaa7a01ddb9b89a1a0a8045e895da103cb5ed7c3481f4d815783099d9a0dda51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
feb4b38e964e0a67ea4fe8487237da8f

SHA1
076cbb19011dfa413192a1902ca87387e22a18bd

SHA256
5dba7e8c27d5c49bd388c9df5fb199b403db70ac7964d8fdaa7950752eddab45

SHA512
c98ce62bee05bc36732641cdc666600bd4c67d6ea366e43a07a6e852b42642477a08bc7e9ed6ea765b1dea6b931cb67efd68493610e6037470d7f0e795071cc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
082008c454f4b2e30e9b23c1f38e083d

SHA1
c8399bab0f43622990be41f3bc45f0554dc6bded

SHA256
4e5ede8841c86f62266ae06def8f0bc5d45196869220dbbb96b93e8bf29dd75e

SHA512
c538a9001e1aaa90f858fcb161df2c9cec165bed9a34c9a78890e51385ef258d41ab03ccf0c9477c350ba6fd2c06beec3f7c1fdfdb6abe38ba5c920d3baab3ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
096016a5fdb649f1209fc75ef68e7ce7

SHA1
9ae9a7e4f11dcee5f8e867978e7d7daeb39f9125

SHA256
d2db77a645a197f496d0ad5d75665793b46c5f0ed66fadb7f3311f71fd72befd

SHA512
65594d0ec0c081e79e2e8a474df1db326d34778815313b63c2c077f0ce388994a85614051a090d40ab0c14542a158f97eecb12243e1c248fb13b3d84794a2dcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
60dd270c82445521dc3243d5f3fe1d29

SHA1
5b08d17933bafae301c2a423ab9f0f989765616e

SHA256
b17e0fbd5dc21da2d6ebfbd38c325f0ced5e54a7a21fcf96cb1b0459f25e35b1

SHA512
d02a43225c6b794190eb2911c3fc726d5fa9a7e89e189ee1b336014c0f817f1786d3b7eb6415f2ab39b2eac944151a650a3da27b334e9f30d3ba49d2073feccc

Download Submit