f5fe792e1e368be460dcfacbe6509e0398d5b988e36f4c8b8c39ee7bd9fcd621

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 21:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

964fc593b6da109c85cd170467c0ef3f_JaffaCakes118.html
Size

206KB
MD5

964fc593b6da109c85cd170467c0ef3f
SHA1

3a30ea79499893a26f71f6a8e2690e573cb84b67
SHA256

f5fe792e1e368be460dcfacbe6509e0398d5b988e36f4c8b8c39ee7bd9fcd621
SHA512

f36fe30fd176082650efc4fc0c2824471a558b2b72b73ce7ddc929c22aff1e58bf51e7d025e6e0bf1d540fdc57511e672f8c3d8d590cac6c99423355d730405e
SSDEEP

6144:8530DH6NEQwjcHXxQRVufJc/09C4kaJ5k:8uDHQmjcxQRVufJc/ek

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1516	msedge.exe
1516	msedge.exe
2176	msedge.exe
2176	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 4628	2176	msedge.exe	82
PID 2176 wrote to memory of 4628	2176	msedge.exe	82
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 4436	2176	msedge.exe	83
PID 2176 wrote to memory of 1516	2176	msedge.exe	84
PID 2176 wrote to memory of 1516	2176	msedge.exe	84
PID 2176 wrote to memory of 872	2176	msedge.exe	85
PID 2176 wrote to memory of 872	2176	msedge.exe	85
PID 2176 wrote to memory of 872	2176	msedge.exe	85
PID 2176 wrote to memory of 872	2176	msedge.exe	85
PID 2176 wrote to memory of 872	2176	msedge.exe	85
PID 2176 wrote to memory of 872	2176	msedge.exe	85
PID 2176 wrote to memory of 872	2176	msedge.exe	85
PID 2176 wrote to memory of 872	2176	msedge.exe	85
PID 2176 wrote to memory of 872	2176	msedge.exe	85
PID 2176 wrote to memory of 872	2176	msedge.exe	85
PID 2176 wrote to memory of 872	2176	msedge.exe	85
PID 2176 wrote to memory of 872	2176	msedge.exe	85
PID 2176 wrote to memory of 872	2176	msedge.exe	85
PID 2176 wrote to memory of 872	2176	msedge.exe	85
PID 2176 wrote to memory of 872	2176	msedge.exe	85
PID 2176 wrote to memory of 872	2176	msedge.exe	85
PID 2176 wrote to memory of 872	2176	msedge.exe	85
PID 2176 wrote to memory of 872	2176	msedge.exe	85
PID 2176 wrote to memory of 872	2176	msedge.exe	85
PID 2176 wrote to memory of 872	2176	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\964fc593b6da109c85cd170467c0ef3f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e5e046f8,0x7ff9e5e04708,0x7ff9e5e04718
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,176706678896618071,13323900519419558984,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,176706678896618071,13323900519419558984,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,176706678896618071,13323900519419558984,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,176706678896618071,13323900519419558984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,176706678896618071,13323900519419558984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,176706678896618071,13323900519419558984,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,176706678896618071,13323900519419558984,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4840 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8bcde148e6de853e737a13ab5502350d

SHA1
40ab69d3cb4d933c043c2d5156e16148d1e49997

SHA256
61c50eafb8d079921156d252ec143e1ebbb8196a0cb2d29ff6abd7b5b93dfe18

SHA512
f1a53bfa4cbd26bd31832a3f62dfb7c21c6b3396fbd04a046e29712324c59f2ff34265ae46cb35dcff78c6f3bbdf8ee7721cf4f2f61cd0e8c714c2e1c154c2a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
af94fb04c2eb7e7de039996e22247714

SHA1
1d265caf6a30f1df4fca531436ca3611b7b1b5ab

SHA256
53fd9fb9502551f7c0b239adccfb004540fad5cca11a1fe4e649e911d781bf16

SHA512
275c714bc247494aa9d732c2ade230b52ac054efe441e7880d0d03fe03cc4d96b31b3f9fe3b803b2e0e4d16a26f5e7a588caf0a0a700b4702ccc38a1e167e404

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6b6d9aaa1df82b9fbf65ca11b84d0aca

SHA1
94fa8761ceda65fed01f3410f054e90af4e6b601

SHA256
65050da53830ec6919f44b219491f674ed35d4d27f264447ec05f3b8fc4da018

SHA512
be445ea05d43a5e582cc40e5ba3ea2651b2517c624c270d48c329807cc23cbfce49e62770b08ddb314fa063fb6897ad8ecfb5647be55106e4612bc355afae815

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
82b43f0c280286cce588acbda7d83f1b

SHA1
30f73ff21efee9bffcfd794d7ae30cd72de17be6

SHA256
4eb602c26ff7c7b0f357db3c4a03da4a0e5dfbc7c954515b866272cbd5ba73bf

SHA512
9d9251cfb3d56511a2524c052ea9371023c9fb779944f127255a290a3e535f5ca4edae27c7ff3e8197fb2ed275eeea138a53f91261a315fe50092ce944f93637

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d2a5384bd51780179d9a20530317f917

SHA1
ee488a76342932e51b00a073869df7a2aeed94ed

SHA256
ac683105bf1684cd1a75e96e2a70332a40a849af7c78ece3159b25c7d935801b

SHA512
364c16a8a760aa2b2d4de1e1b2b019e8c5baef83c07e21bcacf5ff2acf60a019ed0bc3580c2da641e0c318e1c67e86d6a44c2ecdd5cbf136d567c0013e51f5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57af99.TMP

Filesize
707B

MD5
0095db122dcbb55202e6e90b980c7b5b

SHA1
984a4a782fd76c19ad6bec49e287be94353b268f

SHA256
c024698d687d2bbd1ae8b80e5ba7aaccbb0aac81499af93d464da1f99b609b54

SHA512
d11de9a0a91bfe68f8d239f296a14807643cb533bbdb882e9d499dfbd9f9622f940a091c46e7aa7c2be1cc0186d6235c1c1258a710c9fcb2320b528b11241cbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4d32b38812fe2006fbefa3014e7b6a85

SHA1
a8249d9b05d49b32c8cda20dde2baeb17529c663

SHA256
7fd0fa468e3aed5ec28735b8e96184ca093f73884a9b92c4b5a149fb16a606e7

SHA512
6882793d2ed03993c2318208955598a076836dabe1bd2c94175cf732923fb1ff8b3c193eb1ae47cafe3736aed16e4829aca999346f34307a826cf84a5fa1d622

Download Submit