580d8067ea7642b1ceb4d8ef66cff93ca00e0be572872378595ffb870ae568ab

Analysis

max time kernel
145s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1fb09f634f6a0a55365f5ca18f0c0aa7_JaffaCakes118.html
Size

67KB
MD5

1fb09f634f6a0a55365f5ca18f0c0aa7
SHA1

c31f5880521cb98500fd6e7db82a28a371a63b81
SHA256

580d8067ea7642b1ceb4d8ef66cff93ca00e0be572872378595ffb870ae568ab
SHA512

f64eaeff8a3e3f60573c658beaa8d481ff5b167bb32cc7f1edf759df043a28b683aacf718a397c102ebb865fd1cf02a95e4650dce16daaeed5d23de2b441d117
SSDEEP

768:JiAgcMiR3sI2PDDnX0g66ajXYDoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVG8X:JEkocTzNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1452	msedge.exe
1452	msedge.exe
2436	msedge.exe
2436	msedge.exe
2936	identity_helper.exe
2936	identity_helper.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 796	2436	msedge.exe	84
PID 2436 wrote to memory of 796	2436	msedge.exe	84
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 3160	2436	msedge.exe	85
PID 2436 wrote to memory of 1452	2436	msedge.exe	86
PID 2436 wrote to memory of 1452	2436	msedge.exe	86
PID 2436 wrote to memory of 4512	2436	msedge.exe	87
PID 2436 wrote to memory of 4512	2436	msedge.exe	87
PID 2436 wrote to memory of 4512	2436	msedge.exe	87
PID 2436 wrote to memory of 4512	2436	msedge.exe	87
PID 2436 wrote to memory of 4512	2436	msedge.exe	87
PID 2436 wrote to memory of 4512	2436	msedge.exe	87
PID 2436 wrote to memory of 4512	2436	msedge.exe	87
PID 2436 wrote to memory of 4512	2436	msedge.exe	87
PID 2436 wrote to memory of 4512	2436	msedge.exe	87
PID 2436 wrote to memory of 4512	2436	msedge.exe	87
PID 2436 wrote to memory of 4512	2436	msedge.exe	87
PID 2436 wrote to memory of 4512	2436	msedge.exe	87
PID 2436 wrote to memory of 4512	2436	msedge.exe	87
PID 2436 wrote to memory of 4512	2436	msedge.exe	87
PID 2436 wrote to memory of 4512	2436	msedge.exe	87
PID 2436 wrote to memory of 4512	2436	msedge.exe	87
PID 2436 wrote to memory of 4512	2436	msedge.exe	87
PID 2436 wrote to memory of 4512	2436	msedge.exe	87
PID 2436 wrote to memory of 4512	2436	msedge.exe	87
PID 2436 wrote to memory of 4512	2436	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1fb09f634f6a0a55365f5ca18f0c0aa7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f8ab46f8,0x7ff8f8ab4708,0x7ff8f8ab4718
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,12463378777963957704,12807236584441386312,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,12463378777963957704,12807236584441386312,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,12463378777963957704,12807236584441386312,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12463378777963957704,12807236584441386312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12463378777963957704,12807236584441386312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,12463378777963957704,12807236584441386312,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,12463378777963957704,12807236584441386312,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12463378777963957704,12807236584441386312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12463378777963957704,12807236584441386312,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12463378777963957704,12807236584441386312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12463378777963957704,12807236584441386312,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,12463378777963957704,12807236584441386312,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
06129d6ff9a7cf3073f8534c72d21070

SHA1
44d2750c356bf9e0159bdd0e8db4afa5e6cacbde

SHA256
31aefd607b57cd31fb64c5536d63a831a739bf37d5ce5801662fb605d62318ea

SHA512
195c93ac29e6dcc11bf0c75f4e283742b51a15eef1d814d4cf81a17989ea7e32533b5b933ea02e64f0cb96f8e134e87bef1a4899127a9330fc4da0d423edc01a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
75c46569c88699a4cf69ac7c9336dba9

SHA1
dae3e947529df9389969ab27c05133a81ec98cfe

SHA256
407770c2d1308144fc88975d4ad0593c54f90641818c9178260d668d11d8ae3a

SHA512
e236a903719bf74b3974e117eda455a4aaba47d9b904ebdb6af55d7e499ef15479c0a2fc8d7a3d79883e36aafe76cd9e2c8c3f3ae88f5e29f518e6b422b5372f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
89021d7f43f246a5caae7e6cab50c469

SHA1
d4e8d7e597c6037990389a967a6ef24ca502e342

SHA256
8a00415a1b7f64fab1a59e2b846aafe85e405ae0438ba21ba37c820e3e2f7b0e

SHA512
b32a259c1ef1021930e38705ff5a9ca960649c4d87374151d48c3711ba7b534bb6ed897d34b23686b941aeb6d39d242024e1b8b834bfa2f899077153d9f31562

Download Submit