e3ac293bc038d79cc0e9ac8197713c4fd626c2aff1e1702cc126a4ce3a4bda15

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03-05-2024 17:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11052605f721f5f6124596d7cbff1ca0_JaffaCakes118.html
Size

126KB
MD5

11052605f721f5f6124596d7cbff1ca0
SHA1

eed25d2eae146a0a2ef7ce38356935ced7b08a03
SHA256

e3ac293bc038d79cc0e9ac8197713c4fd626c2aff1e1702cc126a4ce3a4bda15
SHA512

6c8ac2ca2e6b0b27f2f995154d80f8ce1d2c952f8a26e5e04f798f43bcf4f6caeb7f4368c78ca15e62bf934afa758bf44161a893672731ff331f155b43f451bf
SSDEEP

3072:K8iu5AcyOJDD7fdjS18x38txFVA7CJRY/pSddFJF1kbngpBmlX:Eq

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2272	msedge.exe
2272	msedge.exe
1096	msedge.exe
1096	msedge.exe
640	identity_helper.exe
640	identity_helper.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 3712	1096	msedge.exe	83
PID 1096 wrote to memory of 3712	1096	msedge.exe	83
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 876	1096	msedge.exe	84
PID 1096 wrote to memory of 2272	1096	msedge.exe	85
PID 1096 wrote to memory of 2272	1096	msedge.exe	85
PID 1096 wrote to memory of 2252	1096	msedge.exe	86
PID 1096 wrote to memory of 2252	1096	msedge.exe	86
PID 1096 wrote to memory of 2252	1096	msedge.exe	86
PID 1096 wrote to memory of 2252	1096	msedge.exe	86
PID 1096 wrote to memory of 2252	1096	msedge.exe	86
PID 1096 wrote to memory of 2252	1096	msedge.exe	86
PID 1096 wrote to memory of 2252	1096	msedge.exe	86
PID 1096 wrote to memory of 2252	1096	msedge.exe	86
PID 1096 wrote to memory of 2252	1096	msedge.exe	86
PID 1096 wrote to memory of 2252	1096	msedge.exe	86
PID 1096 wrote to memory of 2252	1096	msedge.exe	86
PID 1096 wrote to memory of 2252	1096	msedge.exe	86
PID 1096 wrote to memory of 2252	1096	msedge.exe	86
PID 1096 wrote to memory of 2252	1096	msedge.exe	86
PID 1096 wrote to memory of 2252	1096	msedge.exe	86
PID 1096 wrote to memory of 2252	1096	msedge.exe	86
PID 1096 wrote to memory of 2252	1096	msedge.exe	86
PID 1096 wrote to memory of 2252	1096	msedge.exe	86
PID 1096 wrote to memory of 2252	1096	msedge.exe	86
PID 1096 wrote to memory of 2252	1096	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\11052605f721f5f6124596d7cbff1ca0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ff92e6e46f8,0x7ff92e6e4708,0x7ff92e6e4718
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,12613392510615749488,2859628909937516570,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,12613392510615749488,2859628909937516570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,12613392510615749488,2859628909937516570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12613392510615749488,2859628909937516570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12613392510615749488,2859628909937516570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,12613392510615749488,2859628909937516570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,12613392510615749488,2859628909937516570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12613392510615749488,2859628909937516570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12613392510615749488,2859628909937516570,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12613392510615749488,2859628909937516570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12613392510615749488,2859628909937516570,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,12613392510615749488,2859628909937516570,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62c02dda2bf22d702a9b3a1c547c5f6a

SHA1
8f42966df96bd2e8c1f6b31b37c9a19beb6394d6

SHA256
cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b

SHA512
a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
662B

MD5
8723ee2cfbc9169b0c9ea6c7b6fb44ac

SHA1
011a37bd09cdb6e992ce0a3bfdca96897e4ebbae

SHA256
a7eb9932abcf59d176eb1ee76475b79ac0eceb43c7f5d6b64a4d4af321de0095

SHA512
336293c32092448694c7dcf27d74d73306deab1b190a1743e7dbb61d4e28998f1f084cef8cf4dc5d9dfd9e593223e8b1b88e015276635d24417661a9875c9d4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1626b083aad4473ebcaf828b06a4ea64

SHA1
44852c19ba04e0d8acb798698f808ef6c9d36a6c

SHA256
a2b4b1453fe6a2f32076405b2ad90e288a7e89ee9c1cfb2e931ddfa536d7f6ca

SHA512
4f268c3776515215d5cd809726f30987893e4f451e59bc322f4575455fb46e04856fb0466058d5e7fe02c348d76758fdfde120fb6b9ab2ddecc0f427f6c0210b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
300eb2085ea30f93c79776ef3b551da4

SHA1
85b8b1943b4ce2ea159e9aeabce33976bfa100f9

SHA256
9991be9de14cf09c2c9674b68c4835373c12311627a67dcf9e6e954bfe74c335

SHA512
17f3f49e2be5041b9c08e202b78f0b1f5812e11a16008c770814c3025dce76291107edc5a0b6aff5f5a8c273770c17c2932780f02200a82e2bc82debb19c80b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
770d8e983d1cdbcbda8f2d3ca4527bfd

SHA1
14de09098551ec643fcadfc51ec1ffa1bac6e30e

SHA256
35d6033f80279980d4ddd31915b5fe1a72fdfdadb632d215f25acef508358a7e

SHA512
785f90d64a0373a0835767ead09810a6982defb7a653a66b52cdfd7c0fa97869ea1a947228920d0f80537bc1fc58f90016c0dd28ac9f42090cb6b861a12fecde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
5dc1017e784522eb51420c40d7364e39

SHA1
47474c63b4dcc2d986174fcd7753dace066ca321

SHA256
b2b6bcb459ec91a089211dca992cb6944cd6f87145ea776ab2ab1d1d3447384d

SHA512
7828d4f96fc7af936d232cf5fd868d9937f210412d0ab7ffc3abb78663071793bf4c3785d33001ab6b071670167d3dacd642917be69fe8f40a58db58d490dab1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57aece.TMP

Filesize
204B

MD5
1178f5228ee7df7b416edaed1e88fe4d

SHA1
d19e8233b18c760cd6604e1f049fdcccbe493f7b

SHA256
2d3e312b10fd206ce9739bfef04dc6f76aad954f3ce33238ea7c13b1243c0477

SHA512
7702ac9894635664811bdd77a22f7a925d76b340c1a457d34636656446a36e7d5dc719528e393bfe012cdef1cf6515a836b61d5a83471a7b33d8dff15dc3b238

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7f8ca436294ca6fd33a8d8dfee1836f4

SHA1
d3f6813108c78912dc8b00d8f6403cc997c108d2

SHA256
3dab1911fc377a193b902557e30207f843d1da2bc78a5bbf54997104660c0d57

SHA512
71a0d36a30bd8d13ac369884dfebfaac18fc6064bcee6d544b252d43f7d8847ddb598cabe015b900847e4bb97d717bcffdb4135824ba626b293546b7e82258e4

Download Submit