80c5ddc69500fb075d66c9727723bd34bc1256c8c43089e80a86d3a54dc767f2

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

faf100a29ecc4f837c97525ae41708d9_JaffaCakes118.html
Size

49KB
MD5

faf100a29ecc4f837c97525ae41708d9
SHA1

ba7e77815efc10c3fde8b4cb961c5f8c62d2b94e
SHA256

80c5ddc69500fb075d66c9727723bd34bc1256c8c43089e80a86d3a54dc767f2
SHA512

a70294e3c02be528fad49ebbfd968f17cf2381fbab63eddbcd090c2b6f417bbbfea532413470dbecc4c7bbb0c7511a300ff9632e87817b1d943625adb5bd22d3
SSDEEP

768:StkV65Wl9aVx4cQV3fsbQkw2y9Dq6LBfw887vCb296eeI1P05tP9SIg/MKlhA1x0:Swr9Y4cQV3fsbQkJyUVNllhA12

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
3716	msedge.exe
3716	msedge.exe
3120	identity_helper.exe
3120	identity_helper.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 5004	3716	msedge.exe	86
PID 3716 wrote to memory of 5004	3716	msedge.exe	86
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 3212	3716	msedge.exe	87
PID 3716 wrote to memory of 4000	3716	msedge.exe	88
PID 3716 wrote to memory of 4000	3716	msedge.exe	88
PID 3716 wrote to memory of 4868	3716	msedge.exe	89
PID 3716 wrote to memory of 4868	3716	msedge.exe	89
PID 3716 wrote to memory of 4868	3716	msedge.exe	89
PID 3716 wrote to memory of 4868	3716	msedge.exe	89
PID 3716 wrote to memory of 4868	3716	msedge.exe	89
PID 3716 wrote to memory of 4868	3716	msedge.exe	89
PID 3716 wrote to memory of 4868	3716	msedge.exe	89
PID 3716 wrote to memory of 4868	3716	msedge.exe	89
PID 3716 wrote to memory of 4868	3716	msedge.exe	89
PID 3716 wrote to memory of 4868	3716	msedge.exe	89
PID 3716 wrote to memory of 4868	3716	msedge.exe	89
PID 3716 wrote to memory of 4868	3716	msedge.exe	89
PID 3716 wrote to memory of 4868	3716	msedge.exe	89
PID 3716 wrote to memory of 4868	3716	msedge.exe	89
PID 3716 wrote to memory of 4868	3716	msedge.exe	89
PID 3716 wrote to memory of 4868	3716	msedge.exe	89
PID 3716 wrote to memory of 4868	3716	msedge.exe	89
PID 3716 wrote to memory of 4868	3716	msedge.exe	89
PID 3716 wrote to memory of 4868	3716	msedge.exe	89
PID 3716 wrote to memory of 4868	3716	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\faf100a29ecc4f837c97525ae41708d9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9142646f8,0x7ff914264708,0x7ff914264718
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,552868306329503427,4861680546990856484,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,552868306329503427,4861680546990856484,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,552868306329503427,4861680546990856484,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,552868306329503427,4861680546990856484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,552868306329503427,4861680546990856484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,552868306329503427,4861680546990856484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,552868306329503427,4861680546990856484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3720 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,552868306329503427,4861680546990856484,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,552868306329503427,4861680546990856484,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,552868306329503427,4861680546990856484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,552868306329503427,4861680546990856484,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,552868306329503427,4861680546990856484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2224 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,552868306329503427,4861680546990856484,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,552868306329503427,4861680546990856484,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9519bc058003dbea34765176083739e

SHA1
ef49b8790219eaddbdacb7fc97d3d05433b8575c

SHA256
e034683bc434a09f5d0293cb786e6a3943b902614f9211d42bed47759164d38b

SHA512
a1b67ccf313173c560ead25671c64de65e3e2599251926e33ce8399fde682fce5cb20f36ee330fcd8bb8f7a9c00ef432da56c9b02dfd7d3f02865f390c342b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb138796dbfb37877fcae3430bb1e2a7

SHA1
82bb82178c07530e42eca6caf3178d66527558bc

SHA256
50c55ba7baeebe1fa4573118edbca59010d659ea42761148618fb3af8a1c9bdd

SHA512
287471cccbe33e08015d6fc35e0bcdca0ec79bebc3a58f6a340b7747b5b2257b33651574bc83ed529aef2ba94be6e68968e59d2a8ef5f733dce9df6404ad7cc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8f4514f4-ea01-4bd5-9391-4845c49075a9.tmp

Filesize
6KB

MD5
a2e45a7817d067bae4acfc98cdbf96e2

SHA1
e4be4a9f2f1d1268f26901f70ad7461475414b0f

SHA256
cfcb6c5088e289cdb5e4f647ca5a4b7be1cf30f8e5c160ee5ef638e7d831164f

SHA512
8769e2f1d3747d0f0b6425d48c322249b0c9667c67e68c144c8757a9093b683d52ac23223f9b8cb75d16cdd4fba3c60db9c63f5a998531a8ca78daefabf7b271

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
477B

MD5
b5561bd8bee2e0d1e45e723c486d9b72

SHA1
b8e2f70d5e0274cf76e39b2cee0e0968af941bee

SHA256
2e5334a320eed5bbae9ccc0a89af8ec7b6ddf6eeeb59748b78c3dc48ad459ab4

SHA512
cdbe232d4814f9e6f59bf0aec0d79da9e82eb4273d3e193fbb0c2f97a4409ef7f61281281cd77334de4bbfa46a2b60e5d4db6cc37f0f0fd4635793cefe876e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c4ddc0c5720bab56dbd3b8eb3462fc0a

SHA1
9a3f47f01d49f660a8ae8dfe156b5f05bb1653f1

SHA256
2e634dc7a5e96cd1f20957e40b3fc955850b491a836aac8582984cb24e4eeecc

SHA512
810eb3e82729a543e1d9e804e2df903c838f9627cdc344167bf3a9506ef9ed472ff9b0ddf4d7a0af51f0e3acdd87a9280444407782d226f3fecfc6b9ed9a7c76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bf3f12bf80c9432540faa1260aa49a50

SHA1
8fb8630fe5ff724855b7961180272c6e916dbe89

SHA256
15fa0d1b25164d0127693b95ade854876ebd78ed2b40637ded3c5ab58872fc1b

SHA512
3ffc8752aeb12dc9b9f0e598a83658c645683d85d3277403c3cb3073ef46c5937cdb5faea86f5f8b067d9b8077168920aa7df08437bd06e8e59d18a85579a5c4

Download Submit