34856712b2e75c03366da5695c41b46d61d5f904b09478550c340d694303c982

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 13:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d52143211d402b0ee9836921ee64f4fc_JaffaCakes118.html
Size

136KB
MD5

d52143211d402b0ee9836921ee64f4fc
SHA1

c8c6d0a2ac0700689ae83418d2032f5a8e03d121
SHA256

34856712b2e75c03366da5695c41b46d61d5f904b09478550c340d694303c982
SHA512

f17a929e39268007478a49c380489ad0e0d2d9390506a97f025347f07aabef58e1e05638b44bd33a48669767287c520fec6fc498fa60c0760ee6e41ec2695ebf
SSDEEP

768:hswAvT8wNrS0dFWBFXjn1ywxJaXRT1ZanTLNCfzwpX7RzwpmlRePT0yobN21wZLY:hFAvT8300Yq0zBcN+peMGTO

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
4512	msedge.exe
4512	msedge.exe
3096	identity_helper.exe
3096	identity_helper.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4356	4512	msedge.exe	86
PID 4512 wrote to memory of 4356	4512	msedge.exe	86
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 1824	4512	msedge.exe	87
PID 4512 wrote to memory of 5076	4512	msedge.exe	88
PID 4512 wrote to memory of 5076	4512	msedge.exe	88
PID 4512 wrote to memory of 3484	4512	msedge.exe	89
PID 4512 wrote to memory of 3484	4512	msedge.exe	89
PID 4512 wrote to memory of 3484	4512	msedge.exe	89
PID 4512 wrote to memory of 3484	4512	msedge.exe	89
PID 4512 wrote to memory of 3484	4512	msedge.exe	89
PID 4512 wrote to memory of 3484	4512	msedge.exe	89
PID 4512 wrote to memory of 3484	4512	msedge.exe	89
PID 4512 wrote to memory of 3484	4512	msedge.exe	89
PID 4512 wrote to memory of 3484	4512	msedge.exe	89
PID 4512 wrote to memory of 3484	4512	msedge.exe	89
PID 4512 wrote to memory of 3484	4512	msedge.exe	89
PID 4512 wrote to memory of 3484	4512	msedge.exe	89
PID 4512 wrote to memory of 3484	4512	msedge.exe	89
PID 4512 wrote to memory of 3484	4512	msedge.exe	89
PID 4512 wrote to memory of 3484	4512	msedge.exe	89
PID 4512 wrote to memory of 3484	4512	msedge.exe	89
PID 4512 wrote to memory of 3484	4512	msedge.exe	89
PID 4512 wrote to memory of 3484	4512	msedge.exe	89
PID 4512 wrote to memory of 3484	4512	msedge.exe	89
PID 4512 wrote to memory of 3484	4512	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d52143211d402b0ee9836921ee64f4fc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ff8214e46f8,0x7ff8214e4708,0x7ff8214e4718
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,17639077760201235713,17302809323173060548,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1464 /prefetch:2
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,17639077760201235713,17302809323173060548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,17639077760201235713,17302809323173060548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17639077760201235713,17302809323173060548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17639077760201235713,17302809323173060548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17639077760201235713,17302809323173060548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17639077760201235713,17302809323173060548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,17639077760201235713,17302809323173060548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,17639077760201235713,17302809323173060548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17639077760201235713,17302809323173060548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2204 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17639077760201235713,17302809323173060548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17639077760201235713,17302809323173060548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17639077760201235713,17302809323173060548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,17639077760201235713,17302809323173060548,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2628 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
47b2c6613360b818825d076d14c051f7

SHA1
7df7304568313a06540f490bf3305cb89bc03e5c

SHA256
47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

SHA512
08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e0811105475d528ab174dfdb69f935f3

SHA1
dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

SHA256
c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

SHA512
8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
b306b7c088a3d16e7f83234b2d0ffb9d

SHA1
961ca584bfac8736bef7ef6e15c211eb8fe6b83f

SHA256
fe4d201222cb110f4ddff02fd95070d3543005495a105e2d41faded842667bbd

SHA512
c1de2a168dbb687f6eede1b1470eca0803cad4ebf70b18eb7ab4ee6c6811c437108756dd1f71793558d0d8e8829f77aa294a3c0fecbb80fbc3118f4fef806b5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3a056a5d00fb133a9dab7c4ef4f2cf3e

SHA1
322dc19c2caddd489d087803c87f5415e08cfcbf

SHA256
ef8d6ecef0d69f000a01d6710244d6d292629b34e9e98dbd05c5e941abfc6d42

SHA512
2de0a47968a76a6a2a16733a484d7fd259952088d3fcf6a3bd6130c713f6956a8fb96eff41ee513a6044c0a8d94aff52103df6dad006c5a06646e9b29b8d20ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ad7560788d859e2bd6fed95f87b9740b

SHA1
86893000ce9ff56e7d8a230811aa12f46701f23d

SHA256
7ecd8886d8c2a608006b401694d2567e0eee10d33e3b6127855a9658a929cd46

SHA512
d4c704a09eea18896b7fa92fa06d896ae2fa993a51eb729f31690ffb4e4f77bddab42f2b6ab5c90caa63447c12431a568b51f40597d9c48e00e7edd682a02c84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4da236637a2103f49fd2d196993ed805

SHA1
ec6a24c3ecf574137b4eae04cd5bd38e2641f4d7

SHA256
90448782ea55f5db8be8165f1f16722da75c3c65f672ff823cf2f31d964bb956

SHA512
07893af1642358768741dd076ae8e13b4c577668848a18dd2e26e9b75cdfc7f5f8fd8eddbf537442c8618dbd4b110b00ab9fa2fe2b093346cefd151f7cc77c82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b7608853cacaac582e7c5259688caa0e

SHA1
1cd193f9bee9d3f66c7bda386cf952cbdbd67b8d

SHA256
668ddeb39b9aeaab9e2b3d4c194a8c9520fb798792464f175aca47125b3f20ab

SHA512
ac22759750d695e59f2c74867c0094e45878f896ca3c3117c6bf92f4b61309bb0e2a542e22887e13ecb2fcabd0f9176ba0f9c1d1799199735e75373ef7f7ba4a

Download Submit