a8bf73d9db24c79e0b66051ca41f4c30a796b6bd9455354ad314d77c9bf86453

Analysis

max time kernel
147s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8ea11b6107a58247bb415a27b777be4_JaffaCakes118.html
Size

41KB
MD5

e8ea11b6107a58247bb415a27b777be4
SHA1

7b8a9ea472748af3edcdb8211357473e14256604
SHA256

a8bf73d9db24c79e0b66051ca41f4c30a796b6bd9455354ad314d77c9bf86453
SHA512

0db2071171f882f8887fc1d3de9a180dc30cfd57fedde5c9a3810d1c77c1030345e7de1ea9fc26e25aae6c43efc27f4369ca1086f79477d20444125986f7b006
SSDEEP

768:1dZ6Fd+QiaDboaB/KRZdTDgtfEf8z6Yu3m:1dZ6Fd+QiaDEaB/sZdTDSfEf8P

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2904	msedge.exe
2904	msedge.exe
4436	msedge.exe
4436	msedge.exe
4440	identity_helper.exe
4440	identity_helper.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 2108	4436	msedge.exe	85
PID 4436 wrote to memory of 2108	4436	msedge.exe	85
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2032	4436	msedge.exe	87
PID 4436 wrote to memory of 2904	4436	msedge.exe	88
PID 4436 wrote to memory of 2904	4436	msedge.exe	88
PID 4436 wrote to memory of 2616	4436	msedge.exe	89
PID 4436 wrote to memory of 2616	4436	msedge.exe	89
PID 4436 wrote to memory of 2616	4436	msedge.exe	89
PID 4436 wrote to memory of 2616	4436	msedge.exe	89
PID 4436 wrote to memory of 2616	4436	msedge.exe	89
PID 4436 wrote to memory of 2616	4436	msedge.exe	89
PID 4436 wrote to memory of 2616	4436	msedge.exe	89
PID 4436 wrote to memory of 2616	4436	msedge.exe	89
PID 4436 wrote to memory of 2616	4436	msedge.exe	89
PID 4436 wrote to memory of 2616	4436	msedge.exe	89
PID 4436 wrote to memory of 2616	4436	msedge.exe	89
PID 4436 wrote to memory of 2616	4436	msedge.exe	89
PID 4436 wrote to memory of 2616	4436	msedge.exe	89
PID 4436 wrote to memory of 2616	4436	msedge.exe	89
PID 4436 wrote to memory of 2616	4436	msedge.exe	89
PID 4436 wrote to memory of 2616	4436	msedge.exe	89
PID 4436 wrote to memory of 2616	4436	msedge.exe	89
PID 4436 wrote to memory of 2616	4436	msedge.exe	89
PID 4436 wrote to memory of 2616	4436	msedge.exe	89
PID 4436 wrote to memory of 2616	4436	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e8ea11b6107a58247bb415a27b777be4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaee6846f8,0x7ffaee684708,0x7ffaee684718
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,11822271763668490169,1335235737234168933,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,11822271763668490169,1335235737234168933,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,11822271763668490169,1335235737234168933,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11822271763668490169,1335235737234168933,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11822271763668490169,1335235737234168933,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,11822271763668490169,1335235737234168933,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,11822271763668490169,1335235737234168933,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11822271763668490169,1335235737234168933,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11822271763668490169,1335235737234168933,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11822271763668490169,1335235737234168933,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11822271763668490169,1335235737234168933,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,11822271763668490169,1335235737234168933,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4968 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
601B

MD5
a4dfa91d803db9a5f19f04fe6183ad90

SHA1
a5807f0b29354cb5885a500ebc182534f0f1e1a2

SHA256
53a10187fc50c70ddd0bf7b13a17aae77853f3ed4eb13b11b2c99188177d648f

SHA512
7fd876dbf834b3a5a3a21ca7b19c19670ef7c74dfefaa1e476f136628525958f7e0a2b23352f2b6d81cef8ec102221c5e8196304facf6caed89ad04603ddfd60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e871c282e256b5eafe129a85b68b6149

SHA1
bd260d1574605b3b9d3a66e1eb1de492326093ff

SHA256
077f476204a09a0bb90944197b8b445753f07de1d0f06f5689ff2a365ef76bf4

SHA512
d50d83fa732e1d95d3dea361988b7c014e89673fb0d5be46f9c31253a88511b9d4a174234491e1dd390d308808941154cb1a702038cebfc223268c9142225ce2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f3d042210b6bbec303fcc608fdcf7ee0

SHA1
9791a4585d4cd55c08a00e96113ce273a115c9d1

SHA256
3f0fc211961100914d509ad3327a838a1781473467ab4427c9f61d4bb78521e1

SHA512
5f7b943f5b246e06c576bd7e144ae2b3ff76b80ae5898b86bad92ab47fc4333487e0ee9b0cc1ada95b3de656f5408f7fa5680249cc5ef2264b439ac06f517cc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
79d491fd2993876667250a80bf58ac06

SHA1
9e7bf1b381bd076942c19a76584851d3d3475008

SHA256
472f33df4d775c54de9ab6515af18e4e6a2c7683f2172fe4773cb510d8de74fe

SHA512
f7bed33044273c668912f467bfdd0645db5ca9d54015b1b916f38dc1efbe02f8fb76d2a2c40af8562c4b959a14f035d6d6d069fe9632e0b589c173cd2064e052

Download Submit