8e8159b2c2d0f0e0ba286903265191446657f858e3ffd057105b5c835af02985

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03-05-2024 06:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fed2ad842acf0bd9b991292b1abb987_JaffaCakes118.html
Size

171KB
MD5

0fed2ad842acf0bd9b991292b1abb987
SHA1

2f480a0eac17e2648d41e5afa95fae56b53425e8
SHA256

8e8159b2c2d0f0e0ba286903265191446657f858e3ffd057105b5c835af02985
SHA512

0ac399c2e452f62013fe80f24914d32742ba0e2d246c18279642e1f887b464bfeaff2460546e8b460d23d5286f718d195e32f9bb0d909e6e2ec8c16efa15fae2
SSDEEP

1536:+v227vLjIjdOA7jelP01SERyytDztWhaLVWkUI8UgibUlNkSYKSwtLE3yRb4ATG8:+O27TQ7jelcXwk7EKpztmX1t3

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
6056	msedge.exe
6056	msedge.exe
2764	msedge.exe
2764	msedge.exe
5568	identity_helper.exe
5568	identity_helper.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 5224	2764	msedge.exe	83
PID 2764 wrote to memory of 5224	2764	msedge.exe	83
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 2912	2764	msedge.exe	84
PID 2764 wrote to memory of 6056	2764	msedge.exe	85
PID 2764 wrote to memory of 6056	2764	msedge.exe	85
PID 2764 wrote to memory of 3672	2764	msedge.exe	86
PID 2764 wrote to memory of 3672	2764	msedge.exe	86
PID 2764 wrote to memory of 3672	2764	msedge.exe	86
PID 2764 wrote to memory of 3672	2764	msedge.exe	86
PID 2764 wrote to memory of 3672	2764	msedge.exe	86
PID 2764 wrote to memory of 3672	2764	msedge.exe	86
PID 2764 wrote to memory of 3672	2764	msedge.exe	86
PID 2764 wrote to memory of 3672	2764	msedge.exe	86
PID 2764 wrote to memory of 3672	2764	msedge.exe	86
PID 2764 wrote to memory of 3672	2764	msedge.exe	86
PID 2764 wrote to memory of 3672	2764	msedge.exe	86
PID 2764 wrote to memory of 3672	2764	msedge.exe	86
PID 2764 wrote to memory of 3672	2764	msedge.exe	86
PID 2764 wrote to memory of 3672	2764	msedge.exe	86
PID 2764 wrote to memory of 3672	2764	msedge.exe	86
PID 2764 wrote to memory of 3672	2764	msedge.exe	86
PID 2764 wrote to memory of 3672	2764	msedge.exe	86
PID 2764 wrote to memory of 3672	2764	msedge.exe	86
PID 2764 wrote to memory of 3672	2764	msedge.exe	86
PID 2764 wrote to memory of 3672	2764	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0fed2ad842acf0bd9b991292b1abb987_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb718546f8,0x7ffb71854708,0x7ffb71854718
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,16689854048146740116,5678562751933098793,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,16689854048146740116,5678562751933098793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,16689854048146740116,5678562751933098793,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2272 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16689854048146740116,5678562751933098793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16689854048146740116,5678562751933098793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,16689854048146740116,5678562751933098793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,16689854048146740116,5678562751933098793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16689854048146740116,5678562751933098793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16689854048146740116,5678562751933098793,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16689854048146740116,5678562751933098793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4476 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16689854048146740116,5678562751933098793,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,16689854048146740116,5678562751933098793,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62c02dda2bf22d702a9b3a1c547c5f6a

SHA1
8f42966df96bd2e8c1f6b31b37c9a19beb6394d6

SHA256
cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b

SHA512
a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
456B

MD5
fce27fd4a242107ebe468bd8510f1dcc

SHA1
173a943459af3c9df3e1ec561cc23ec7e372dd9b

SHA256
8b495cfed4bd6c449205025c0ba07b95133b1ea33f91b2ab32fa537cef3410a1

SHA512
b6ae85d966227a10ade1ae99b67e2f67a7beb652bf9d89aa68428465bce5aef5bc390dcda864e8bce88d4f1165412561cfd4b071ea9daba44e15ab186dc14635

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
882fcced9cd847ff85b7b8be42a1e16f

SHA1
109f802b76204af69d7cf578ad5132e1f58637ba

SHA256
2c324575769617e057a4401961eb72a28beba61d7baf055e744a0c365b4a6ad1

SHA512
e73ebd8dc4e21af12a2cbf657b69ebbfac8d462d0c9eb07d94ca7b19fedf6f0a5525a770066cdca6e09626152c22e1d164376d66b156d445675e4424c4f7a14c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9c7fc41890b3c73b9de0860b76de24d8

SHA1
6e44cc3395e8e73aa53f064af82eb3233dc84e3d

SHA256
0f044dd20553b436ede99953f8514501fc21c992c1a51680a7590fcf78de56cd

SHA512
32995b5ce30406a5b994bb3afb0fb6d8250e964a77e0bc777f73f113ff7aff498a734fc7e496f1818fe6253c3f89254c07b03cc1c2b390602c495f46e9e4834a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
00cd0d714937e4d5e9fe002ba996dd8b

SHA1
a99418b8882d845b3ec554c44cb0c92d80c79fc6

SHA256
b09cfd0089044f751f95309e5b8736e10469a308c90d2f7e20a6a7f692693d42

SHA512
64b1b66ec9465881b7ef70485ad9f0a77f1553dbf29ea53e824bd35bd12a643dc2439ec8e07f169a72429b5b95dd488c504f4a23546a0487526c7f40681acf22

Download Submit