7a7fcb4ac372e4b86b0a68e948427ccffdb8dc2cfb3ef9bce2fa8861331845dd

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 17:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

233ea1ff6fb25b29f51f7ba48e83b7d6_JaffaCakes118.html
Size

8KB
MD5

233ea1ff6fb25b29f51f7ba48e83b7d6
SHA1

020d21793004e280e4de7388a733128c9fd0e218
SHA256

7a7fcb4ac372e4b86b0a68e948427ccffdb8dc2cfb3ef9bce2fa8861331845dd
SHA512

3d2eac9840875639225a965e2d1cc63ebc45ea358c5208d8dfaf7a6c2075c4374073921fefaefc468ce9ba3bfcebc9be5bfd823fb918e303ec8bbe5a6dda3ba6
SSDEEP

192:leHtdRsj+mT8bZuDlVky7G7nAj6AKP+HrnHQQtPuyM:MHtdWjnTOk3OAj6pP+HrnbtmyM

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4016	msedge.exe
4016	msedge.exe
1808	msedge.exe
1808	msedge.exe
2664	identity_helper.exe
2664	identity_helper.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 3492	1808	msedge.exe	82
PID 1808 wrote to memory of 3492	1808	msedge.exe	82
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 2264	1808	msedge.exe	83
PID 1808 wrote to memory of 4016	1808	msedge.exe	84
PID 1808 wrote to memory of 4016	1808	msedge.exe	84
PID 1808 wrote to memory of 1704	1808	msedge.exe	85
PID 1808 wrote to memory of 1704	1808	msedge.exe	85
PID 1808 wrote to memory of 1704	1808	msedge.exe	85
PID 1808 wrote to memory of 1704	1808	msedge.exe	85
PID 1808 wrote to memory of 1704	1808	msedge.exe	85
PID 1808 wrote to memory of 1704	1808	msedge.exe	85
PID 1808 wrote to memory of 1704	1808	msedge.exe	85
PID 1808 wrote to memory of 1704	1808	msedge.exe	85
PID 1808 wrote to memory of 1704	1808	msedge.exe	85
PID 1808 wrote to memory of 1704	1808	msedge.exe	85
PID 1808 wrote to memory of 1704	1808	msedge.exe	85
PID 1808 wrote to memory of 1704	1808	msedge.exe	85
PID 1808 wrote to memory of 1704	1808	msedge.exe	85
PID 1808 wrote to memory of 1704	1808	msedge.exe	85
PID 1808 wrote to memory of 1704	1808	msedge.exe	85
PID 1808 wrote to memory of 1704	1808	msedge.exe	85
PID 1808 wrote to memory of 1704	1808	msedge.exe	85
PID 1808 wrote to memory of 1704	1808	msedge.exe	85
PID 1808 wrote to memory of 1704	1808	msedge.exe	85
PID 1808 wrote to memory of 1704	1808	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\233ea1ff6fb25b29f51f7ba48e83b7d6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe85ef46f8,0x7ffe85ef4708,0x7ffe85ef4718
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,15069323332905115283,1538967581529904172,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,15069323332905115283,1538967581529904172,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,15069323332905115283,1538967581529904172,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15069323332905115283,1538967581529904172,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15069323332905115283,1538967581529904172,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,15069323332905115283,1538967581529904172,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,15069323332905115283,1538967581529904172,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15069323332905115283,1538967581529904172,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15069323332905115283,1538967581529904172,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15069323332905115283,1538967581529904172,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15069323332905115283,1538967581529904172,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,15069323332905115283,1538967581529904172,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
250B

MD5
b61c9745f6eb4d0cc6f2d9db8b7b4581

SHA1
7d37b4c764fa9b5f968e5dc2f5d51fc6db79b68d

SHA256
6c9bf7e627eb5f64f850f7b9f5553b0a9296cb27772ddfa042eac93691c74959

SHA512
21cf56504f4e5f8ad8c182a28b6298de54846a75447fe0930cda8140a6d9450a80d32777993b2ed94a0ccf9f570a8a5c8944cab96aa7a7c58b997e57e478aec7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
49f63d321cd5b95290eb9856e827bf02

SHA1
4e6b94b4ca78a36eeed698c1e61952b06f01237c

SHA256
205ae25f069db57f6b1bdea5831e785ec2a92350c467a854acf57cf0793a7678

SHA512
e81ccc27a5634d0c2dcb7bfe33e953861de3b437a3c1f8da3abe41f786661487b306a917df318f764239f1a3e4c6e299336a1807c5465d27261145e6ae005d08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8735d68a31a1bc96903900f78334cc76

SHA1
d91d29c3431da4e6f04aa86513814b5bdd1b3649

SHA256
eef109bd79686313d1c50dd2e15e7d4aa518f7d30627d261ade8e0c58a1f04b7

SHA512
affd5278b0e4dbdee151deb3a267faa9c328a6e124b1073ba2af52354504fcd43f630ef765300d70b152d2eb4a19d2d218ebc90d733e2d9a2d7c1aa447f0dd8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5ac49bd657429e50c5135d4d8ca30a55

SHA1
a1693e03d8ff245d331688452b91e93a514d5ffb

SHA256
3a1f08b63cfbe891f7f8d48a317a60de2b8fe0af204154d88d8eb39354b9cd78

SHA512
fdef0186b3366d1b672bca1d5e5c1748f2617cd5cf82cbac7b36f28db8985f0fb08539209e24c16c1435155c3b8e92a5a1d1a2174bcb2e8f9b06097b6890f33c

Download Submit