5b0caa32e01ba268f5651afeadf69478c419bf93b2f0c8c4902883afdc990cf5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 20:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23947edd087dd5622f372eaf4303984e_JaffaCakes118.html
Size

7KB
MD5

23947edd087dd5622f372eaf4303984e
SHA1

25f0a1a435b7dacb61a13ead16a591ac4a08f707
SHA256

5b0caa32e01ba268f5651afeadf69478c419bf93b2f0c8c4902883afdc990cf5
SHA512

ddf38ca3269e64e0ea3787772241cf0bf2292368c5e7bb02af0a9485c0f0fd8382377d9de493a44b186ec5b93b1c2c65c1bf85e91f1c95969930963fa1a36e2d
SSDEEP

96:SIniwv0HXt08IMnoXKjl63GL4X9U7tIm6DTIBDD4HsfuyxCDeD4XKQrgFf1Gj2w5:SIniwvePfo6olKGmNvfu046uw1aPvei

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1608	msedge.exe
1608	msedge.exe
3524	msedge.exe
3524	msedge.exe
2980	identity_helper.exe
2980	identity_helper.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 4564	3524	msedge.exe	80
PID 3524 wrote to memory of 4564	3524	msedge.exe	80
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 2512	3524	msedge.exe	81
PID 3524 wrote to memory of 1608	3524	msedge.exe	82
PID 3524 wrote to memory of 1608	3524	msedge.exe	82
PID 3524 wrote to memory of 1028	3524	msedge.exe	83
PID 3524 wrote to memory of 1028	3524	msedge.exe	83
PID 3524 wrote to memory of 1028	3524	msedge.exe	83
PID 3524 wrote to memory of 1028	3524	msedge.exe	83
PID 3524 wrote to memory of 1028	3524	msedge.exe	83
PID 3524 wrote to memory of 1028	3524	msedge.exe	83
PID 3524 wrote to memory of 1028	3524	msedge.exe	83
PID 3524 wrote to memory of 1028	3524	msedge.exe	83
PID 3524 wrote to memory of 1028	3524	msedge.exe	83
PID 3524 wrote to memory of 1028	3524	msedge.exe	83
PID 3524 wrote to memory of 1028	3524	msedge.exe	83
PID 3524 wrote to memory of 1028	3524	msedge.exe	83
PID 3524 wrote to memory of 1028	3524	msedge.exe	83
PID 3524 wrote to memory of 1028	3524	msedge.exe	83
PID 3524 wrote to memory of 1028	3524	msedge.exe	83
PID 3524 wrote to memory of 1028	3524	msedge.exe	83
PID 3524 wrote to memory of 1028	3524	msedge.exe	83
PID 3524 wrote to memory of 1028	3524	msedge.exe	83
PID 3524 wrote to memory of 1028	3524	msedge.exe	83
PID 3524 wrote to memory of 1028	3524	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\23947edd087dd5622f372eaf4303984e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa37e46f8,0x7ffaa37e4708,0x7ffaa37e4718
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,16582730443391790255,2577093460719571482,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,16582730443391790255,2577093460719571482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,16582730443391790255,2577093460719571482,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16582730443391790255,2577093460719571482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16582730443391790255,2577093460719571482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,16582730443391790255,2577093460719571482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,16582730443391790255,2577093460719571482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16582730443391790255,2577093460719571482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16582730443391790255,2577093460719571482,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16582730443391790255,2577093460719571482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16582730443391790255,2577093460719571482,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,16582730443391790255,2577093460719571482,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4912 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\619ad7ed-4ebc-4033-8ad2-094a85d0b394.tmp

Filesize
6KB

MD5
2c448d20c80a23dfbfe295749fa0e023

SHA1
e42a655fb3a59c8bc880382ae59613f008d840b4

SHA256
bc3a5fed8ff1999d9437358510e169a60c80303ef7d4d1ef997b8860b7ed27eb

SHA512
9383414a0c89700715b428570f3e931a400a01776ab7c199b9b035c6674b364dfa0e120d36747906839ab444ae36ec0eca368de8d603e7f696b2d86c7324bb20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
011f3b100ae1c416b7679e7d56bdbf12

SHA1
f6ba0e414282723bb108ecc27d179c199c83605e

SHA256
4c72ecb74698a0c947d3f6a2e70c1d430208dee6aa7f7435bc5f3760304727ce

SHA512
c46536bd66909dfb2099b7b0550c6c8153a3f09835973ff8dd59188d4d8ce4cb743cdac447a0127a1ac77f4da5ea96f9288b45b46ab1a99083c9159004d0c8dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2abc89990d9f13455a3c25737bff43c7

SHA1
412a96b036f1236f123cd3a16bca16fab26f1335

SHA256
99c454d15e9f351b963d84f3fe063e7e0a2fe170a65e4608f0f63740efbb4f28

SHA512
a921a3a3a8ce3044532bad46d835e07b3dec175fd4052f2fe5359c57e8dda52403e37d0dfc1b67e3d9dd92d3659911aa36222bb1dec673c61e500983ae97026c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1825660da9e332a9be9226af6a9af440

SHA1
14a92aaed5fdeab5dcd510dbd133d094c31ad107

SHA256
fcfc44c168d8089375837446547427024a3e3c9ed5388a38f0486830f71dc121

SHA512
7c184cd4de1ec00d6bc0c873c14aa0b35ca4b518750dec11b9c4a47669a01b8cec3b7ff9884f387e408ffc4219b087dd71cb09555698e28b280396a8307ef585

Download Submit