5860eaa980a1f24b5ae5b0fdee2336ca254475b0b158c37c32077eff37e26303

Analysis

max time kernel
145s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 11:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

126f1a017059b158d03c532c77851cc7_JaffaCakes118.html
Size

530KB
MD5

126f1a017059b158d03c532c77851cc7
SHA1

42ce22b0e93438479c797e3c3602bcd386545396
SHA256

5860eaa980a1f24b5ae5b0fdee2336ca254475b0b158c37c32077eff37e26303
SHA512

6ba878b6f23218bd070ccafcbf79098baa754d720baa37d04c20e3d1b4e0c48aa274471f1a0cea860d858f0a173171c164c8e8aa2d51a427eb9ea78ab688c705
SSDEEP

6144:S5sMYod+X3oI+Y7meFekQesMYod+X3oI+Y7meFeklsMYod+X3oI+Y7meFekw:g5d+X30eZ5d+X30el5d+X30eE

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
3272	msedge.exe
3272	msedge.exe
1336	identity_helper.exe
1336	identity_helper.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 1680	3272	msedge.exe	83
PID 3272 wrote to memory of 1680	3272	msedge.exe	83
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2560	3272	msedge.exe	84
PID 3272 wrote to memory of 2196	3272	msedge.exe	85
PID 3272 wrote to memory of 2196	3272	msedge.exe	85
PID 3272 wrote to memory of 3856	3272	msedge.exe	86
PID 3272 wrote to memory of 3856	3272	msedge.exe	86
PID 3272 wrote to memory of 3856	3272	msedge.exe	86
PID 3272 wrote to memory of 3856	3272	msedge.exe	86
PID 3272 wrote to memory of 3856	3272	msedge.exe	86
PID 3272 wrote to memory of 3856	3272	msedge.exe	86
PID 3272 wrote to memory of 3856	3272	msedge.exe	86
PID 3272 wrote to memory of 3856	3272	msedge.exe	86
PID 3272 wrote to memory of 3856	3272	msedge.exe	86
PID 3272 wrote to memory of 3856	3272	msedge.exe	86
PID 3272 wrote to memory of 3856	3272	msedge.exe	86
PID 3272 wrote to memory of 3856	3272	msedge.exe	86
PID 3272 wrote to memory of 3856	3272	msedge.exe	86
PID 3272 wrote to memory of 3856	3272	msedge.exe	86
PID 3272 wrote to memory of 3856	3272	msedge.exe	86
PID 3272 wrote to memory of 3856	3272	msedge.exe	86
PID 3272 wrote to memory of 3856	3272	msedge.exe	86
PID 3272 wrote to memory of 3856	3272	msedge.exe	86
PID 3272 wrote to memory of 3856	3272	msedge.exe	86
PID 3272 wrote to memory of 3856	3272	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\126f1a017059b158d03c532c77851cc7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc325346f8,0x7ffc32534708,0x7ffc32534718
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,5193878979161530997,11896362534055403420,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,5193878979161530997,11896362534055403420,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,5193878979161530997,11896362534055403420,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2960 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5193878979161530997,11896362534055403420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5193878979161530997,11896362534055403420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5193878979161530997,11896362534055403420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5193878979161530997,11896362534055403420,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,5193878979161530997,11896362534055403420,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,5193878979161530997,11896362534055403420,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5193878979161530997,11896362534055403420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5193878979161530997,11896362534055403420,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,5193878979161530997,11896362534055403420,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5776 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c0152fb547909a9b47b6ade03c69047a

SHA1
be2d6e32343edc3f1bfd33dbd44683f065f1e238

SHA256
cfe6b566888160f4873f76e3a6a8eb0497c41a5818eb6d4458669132464f9d9b

SHA512
29122dcde2e626d3d483c44762128c99597ec36f2e1b3cd0db10289dbb83cb3d38d60bd22b0f8b0948815465aa520fdc1257ce21f02c87499da0db521838c7ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
04db6c750b7912abd9cf53e5a0f30941

SHA1
15052646cb20199e4341f3e4a05bec40b1e9b980

SHA256
ecb3b814ef2ea04896aa1b9416527aec867086eadfaa37b4c68cc1b22429d954

SHA512
5dc34065150e1d90d5ff652040eb1dc8f6226051b53923989d8f30a24dfe486443bb7eb97ef7f04c094cc095e87b931786bf0247199912ffb3af3a82178b3e13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
08837d997d72644d0b11c3123b0744f5

SHA1
2ae3b64c2205615bebaa0d9f13f553162d87588b

SHA256
f0e9fdf0b322fd89558d213f50930f50cb2e5f95aa19bfd5c6938eff2c96deac

SHA512
4d8306564e966763ffdd9ff5b2338c88cdd48eb9dbe2e8ab6f692b059339ce3c367800ab6fcbc43a89c307df135fc7aad38a036f7913954eaa06a79a9709fa78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f5a0220ffa8edfb380f9177a2312da67

SHA1
7bfa651173e1c43c5174c129dbdd350dbf3fe8e5

SHA256
e059e3eaac34f7c8dfcad8709cb8500693d4304a601645749bf7b524638ffbf7

SHA512
72372d9763d189e3008eaf288bcc7df9b3efcb31218cab5166bde4ffb72397589f79d804bed7ac68323d57648dd484339e194075203fd78c1181c9cc95191055

Download Submit