d561ddaa5d981c1fa172021427eb88a939e7f5b84f0dae409d552b3b947160ca

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2024 22:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

967035e06738220ba2be76b7c3d55343_JaffaCakes118.html
Size

59KB
MD5

967035e06738220ba2be76b7c3d55343
SHA1

af5d270193a77e58342c6c645dc8745df65150c4
SHA256

d561ddaa5d981c1fa172021427eb88a939e7f5b84f0dae409d552b3b947160ca
SHA512

cfde5e9da54fa091df607a1723640496d985800888a7e09e38f1953dc061e206e93ffa1919f901a2f5ad0cf9dab0c93fe0fe29e515623b00f24a99e2b648eaf5
SSDEEP

768:TKyw0wIwYwLwbwWMj1bfr0eTdooVPdLMHJXxK7m0orRVX96nxgVo5jeLDwLDBKDZ:myRZxAsKQWrwpBctEIZWg6c9QIhVMd

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
216	msedge.exe
216	msedge.exe
4496	identity_helper.exe
4496	identity_helper.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 4368	216	msedge.exe	83
PID 216 wrote to memory of 4368	216	msedge.exe	83
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 956	216	msedge.exe	84
PID 216 wrote to memory of 436	216	msedge.exe	85
PID 216 wrote to memory of 436	216	msedge.exe	85
PID 216 wrote to memory of 4996	216	msedge.exe	86
PID 216 wrote to memory of 4996	216	msedge.exe	86
PID 216 wrote to memory of 4996	216	msedge.exe	86
PID 216 wrote to memory of 4996	216	msedge.exe	86
PID 216 wrote to memory of 4996	216	msedge.exe	86
PID 216 wrote to memory of 4996	216	msedge.exe	86
PID 216 wrote to memory of 4996	216	msedge.exe	86
PID 216 wrote to memory of 4996	216	msedge.exe	86
PID 216 wrote to memory of 4996	216	msedge.exe	86
PID 216 wrote to memory of 4996	216	msedge.exe	86
PID 216 wrote to memory of 4996	216	msedge.exe	86
PID 216 wrote to memory of 4996	216	msedge.exe	86
PID 216 wrote to memory of 4996	216	msedge.exe	86
PID 216 wrote to memory of 4996	216	msedge.exe	86
PID 216 wrote to memory of 4996	216	msedge.exe	86
PID 216 wrote to memory of 4996	216	msedge.exe	86
PID 216 wrote to memory of 4996	216	msedge.exe	86
PID 216 wrote to memory of 4996	216	msedge.exe	86
PID 216 wrote to memory of 4996	216	msedge.exe	86
PID 216 wrote to memory of 4996	216	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\967035e06738220ba2be76b7c3d55343_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff850fe46f8,0x7ff850fe4708,0x7ff850fe4718
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,8813938672519394062,7935645262215439358,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,8813938672519394062,7935645262215439358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,8813938672519394062,7935645262215439358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8813938672519394062,7935645262215439358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8813938672519394062,7935645262215439358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,8813938672519394062,7935645262215439358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,8813938672519394062,7935645262215439358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8813938672519394062,7935645262215439358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8813938672519394062,7935645262215439358,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2016 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8813938672519394062,7935645262215439358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8813938672519394062,7935645262215439358,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,8813938672519394062,7935645262215439358,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4784 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
513B

MD5
f68b3885627d10b3966593ac36b2ac3a

SHA1
784fca88b749c884eb24ca112f5e7985e930aa8c

SHA256
d51571849ddc2b5e11468d8aec703ccdb75f14abd85baa57350f620c09ac7c9f

SHA512
9b3da061cde1b91f966fae96e6803e14bbe4615ad80dc5d758b6078fe1db8c43476df19f4fd2dab50960bcc6869a3a883037ea5bcaf9902e8c0850896f53155a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b340d68de3f21e426b92c0548d70e594

SHA1
20ebb6755592aa3bb276b4e3f30702483ee91edc

SHA256
735241c80ccb5bf7cb36cd8458be1652503782b87dfb86605385d6106a102c65

SHA512
48050dbc214ff506f9914470e08374631501d5abcae64f005ff821074c5d1bf4207e2766a669e78af44376a3a91fbdb64db63fb30d3c12528f5f8c1657e4aff0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2fe8c691c06ed315fd669e792d7cf650

SHA1
18bae83ad8ef8dee522501f78243aed9891bc11b

SHA256
c05e2b65891e8e48e5b5ff39cc9ad88fca88f6352955fa0b5d0b92052b9c29b7

SHA512
dfc2b8ec3e5c27b3c5f84a5369ed7ef8758d986bb2ecbb92b8f3905c23f58cfdda57388cd832c518fde9487b85f0735289b5d545d65b36fd3bb882f4eb5bea9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
61421be51dc26d3cd4449e4461c9b85f

SHA1
fdcc770450b73516bdc1199cca3d03625215937e

SHA256
3b18483d09dbcf3247c11598609d7e4d47d690003ebdb44af6a7692b674fcf99

SHA512
6cba971f7cbc7ecbbd6993c9cdaeee0dfbe79ffac8db78500682bef360f8b8c572ed7a22bdcb6421472063fbd9befafb2ce0d156341858a9e4cc4c70a74ebf87

Download Submit