31a333a9c305a21eae89935fcf71e2e46807168e75f02c04cec20af4e014bd5b

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 03:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

15aed88c7d78e4e4736e17d528cb37eb_JaffaCakes118.html
Size

36KB
MD5

15aed88c7d78e4e4736e17d528cb37eb
SHA1

60c024d1e51bd1870b273fc7f715105af2672274
SHA256

31a333a9c305a21eae89935fcf71e2e46807168e75f02c04cec20af4e014bd5b
SHA512

ee517b2acc64c10b8ca221493d23444cbaaa0bde75d490d6b0780778473ff0f4a46e11d16e1af0cbd38f0d0116a2173a7344f1ff099797a1edcb2623761caa88
SSDEEP

768:zwx/MDTH/H88hARKZPXxE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6ThZOg6f9U56lLRw:Q/XbJxNVNufSM/P8xK

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3868	msedge.exe
3868	msedge.exe
1020	msedge.exe
1020	msedge.exe
3320	identity_helper.exe
3320	identity_helper.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 4036	1020	msedge.exe	83
PID 1020 wrote to memory of 4036	1020	msedge.exe	83
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 2580	1020	msedge.exe	84
PID 1020 wrote to memory of 3868	1020	msedge.exe	85
PID 1020 wrote to memory of 3868	1020	msedge.exe	85
PID 1020 wrote to memory of 1416	1020	msedge.exe	86
PID 1020 wrote to memory of 1416	1020	msedge.exe	86
PID 1020 wrote to memory of 1416	1020	msedge.exe	86
PID 1020 wrote to memory of 1416	1020	msedge.exe	86
PID 1020 wrote to memory of 1416	1020	msedge.exe	86
PID 1020 wrote to memory of 1416	1020	msedge.exe	86
PID 1020 wrote to memory of 1416	1020	msedge.exe	86
PID 1020 wrote to memory of 1416	1020	msedge.exe	86
PID 1020 wrote to memory of 1416	1020	msedge.exe	86
PID 1020 wrote to memory of 1416	1020	msedge.exe	86
PID 1020 wrote to memory of 1416	1020	msedge.exe	86
PID 1020 wrote to memory of 1416	1020	msedge.exe	86
PID 1020 wrote to memory of 1416	1020	msedge.exe	86
PID 1020 wrote to memory of 1416	1020	msedge.exe	86
PID 1020 wrote to memory of 1416	1020	msedge.exe	86
PID 1020 wrote to memory of 1416	1020	msedge.exe	86
PID 1020 wrote to memory of 1416	1020	msedge.exe	86
PID 1020 wrote to memory of 1416	1020	msedge.exe	86
PID 1020 wrote to memory of 1416	1020	msedge.exe	86
PID 1020 wrote to memory of 1416	1020	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\15aed88c7d78e4e4736e17d528cb37eb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe39fc46f8,0x7ffe39fc4708,0x7ffe39fc4718
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,9941642608448706752,10118142687609101824,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,9941642608448706752,10118142687609101824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,9941642608448706752,10118142687609101824,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9941642608448706752,10118142687609101824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9941642608448706752,10118142687609101824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,9941642608448706752,10118142687609101824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,9941642608448706752,10118142687609101824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9941642608448706752,10118142687609101824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9941642608448706752,10118142687609101824,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9941642608448706752,10118142687609101824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9941642608448706752,10118142687609101824,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,9941642608448706752,10118142687609101824,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2936 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
614B

MD5
b2718ad17e151badbf09cbc1203b2843

SHA1
4a62fe779363e130e5a95173728221099f0a1317

SHA256
ac6e22781c42d75883101d57b525d81ea1998da723962bafce2b867e67c456d1

SHA512
92b70a166bcbca53e7df3dc4f6a56b35675db2d9cf5df0fddad7c6848afcfc83f9dfc063fde331e43ca331b71d0a1d6e2004accef20d18ad236f5369a43be135

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
39d9296309bdfbe83ee8e98780c46939

SHA1
5f21c4137f5d88eee7f383603cbcedcc34b7fa3b

SHA256
a7b36a1409a85ca7b5196f6cbd84c2772e7ebc95a88d4314f2342c789af961b1

SHA512
d631657fc0d4d34a1a7a20e9098cdabd9eafe6c417e4e0186a06967e749cca4ec8849261dc33555c4eb907ca3680c470897267fc98b025dc9b3411b1924e2291

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
66c37cf6dcb96d747aee1bb86df0303b

SHA1
9d5161a5e415071b4639104b87ba9cbf59806d92

SHA256
f0c90c426df073789eb4ae3d08d0b45b4a9900a63612e4404a064b81fbe7351b

SHA512
115f3ae966d4839e415c3d5dc68d82d27731277ad24e20ec1b9502eeb6c32f7a0d55be30105d4e0888a9ad9a353568517b0b476342588012fd74e6d24e1b079d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4ab9bcd6ecf722a42896c74ba8f3b1d6

SHA1
fc5997df2215b6aac4646926f37302556720c1ba

SHA256
7222daa3fed2e16f4ad7db42ee42d9828184376b10bb944b3dc9755cc8c96539

SHA512
f3cce5faf5b3bcfa4d30c1935010a3a861b8c1238fc08aa8b1981e4c8555b44531398cdc0820aa719b9c7112a391634dbaa1471a5a004dfe4d1833f6f3202072

Download Submit