852bc017bf948c998b35e0e4a152d8ca0597811c9aea0af71e1df01a4f726efb

Analysis

max time kernel
145s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 22:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

26f30620b8ad75677e2611c7706f73c6_JaffaCakes118.html
Size

36KB
MD5

26f30620b8ad75677e2611c7706f73c6
SHA1

59fc6e2f29072446d3479de3ae1918fcb82d20b6
SHA256

852bc017bf948c998b35e0e4a152d8ca0597811c9aea0af71e1df01a4f726efb
SHA512

a4faae1d2ccdf1a0ea3a1fd702051384aafc32e7aa32985c94980311472e57e9ff4d4cebf916adddb4cb2bdb1f667e8c7853a7ddd429929abfd1a154801c6810
SSDEEP

384:RYG2iSPEjSFlWs+MqjIHu2BprbaZ4apqdSI14LFKun3DFgx:TRCqjIhpvaZ4gLxDFgx

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2248	msedge.exe
2248	msedge.exe
1912	msedge.exe
1912	msedge.exe
1676	identity_helper.exe
1676	identity_helper.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 1960	1912	msedge.exe	83
PID 1912 wrote to memory of 1960	1912	msedge.exe	83
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2068	1912	msedge.exe	84
PID 1912 wrote to memory of 2248	1912	msedge.exe	85
PID 1912 wrote to memory of 2248	1912	msedge.exe	85
PID 1912 wrote to memory of 1472	1912	msedge.exe	86
PID 1912 wrote to memory of 1472	1912	msedge.exe	86
PID 1912 wrote to memory of 1472	1912	msedge.exe	86
PID 1912 wrote to memory of 1472	1912	msedge.exe	86
PID 1912 wrote to memory of 1472	1912	msedge.exe	86
PID 1912 wrote to memory of 1472	1912	msedge.exe	86
PID 1912 wrote to memory of 1472	1912	msedge.exe	86
PID 1912 wrote to memory of 1472	1912	msedge.exe	86
PID 1912 wrote to memory of 1472	1912	msedge.exe	86
PID 1912 wrote to memory of 1472	1912	msedge.exe	86
PID 1912 wrote to memory of 1472	1912	msedge.exe	86
PID 1912 wrote to memory of 1472	1912	msedge.exe	86
PID 1912 wrote to memory of 1472	1912	msedge.exe	86
PID 1912 wrote to memory of 1472	1912	msedge.exe	86
PID 1912 wrote to memory of 1472	1912	msedge.exe	86
PID 1912 wrote to memory of 1472	1912	msedge.exe	86
PID 1912 wrote to memory of 1472	1912	msedge.exe	86
PID 1912 wrote to memory of 1472	1912	msedge.exe	86
PID 1912 wrote to memory of 1472	1912	msedge.exe	86
PID 1912 wrote to memory of 1472	1912	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\26f30620b8ad75677e2611c7706f73c6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9d0c46f8,0x7ffd9d0c4708,0x7ffd9d0c4718
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,7979043327155588872,7809531090251912840,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,7979043327155588872,7809531090251912840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,7979043327155588872,7809531090251912840,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7979043327155588872,7809531090251912840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7979043327155588872,7809531090251912840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,7979043327155588872,7809531090251912840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,7979043327155588872,7809531090251912840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7979043327155588872,7809531090251912840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7979043327155588872,7809531090251912840,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7979043327155588872,7809531090251912840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7979043327155588872,7809531090251912840,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,7979043327155588872,7809531090251912840,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3008 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
182B

MD5
136a8627c9f4b9e2c7d3a90d2556f6d1

SHA1
a0950a4a78f7bf1a4d08fe5dc8040d25e5e7094b

SHA256
06d0224a7ed0c632fe0d506783ac4be33fdfa3c3b3b4a46dcfd4bbf0a1a08ea5

SHA512
2399bbaeaf845478196f713f1e78c222568650d1cddaac47ffd82d93ef2a60d1cc7e40bed100afff0101713e70373793d2608f90e75e471f849888c19c88af1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f1ed808b9438c15bc4115417e292a160

SHA1
28d2786d4afc48b00cefcfd9b03a51e83b3f904e

SHA256
245c92a665f2d5ad56dc319a21b89d99899f2aa4a0a54b805c618a11e40203d7

SHA512
01b60ae2969916c6ee418deeb87fd49c1b3a5f6a395657871a5df2ea8b1846550601f8dd9297f7a15c9d5b5a82ead204f49c97c678dacce092644585516b7363

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
020cd7526ab440c747fc4f34f70d6f89

SHA1
285af983b026b78c37074f902413dfd92060ba3d

SHA256
58b534f8de079fde50dcb393e5a2d7dbaba9410dca2ea21bdcbf8522013b76f3

SHA512
c282c1a0fc3be149c3755491ed259f82a567174ff91bfda216a8fd98df73313fb4627c5e75dfa61d6ded4e65dffb06fc5a537b3217850ad3f7716230314284f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
314d956ba772be0e0b68d197ec64e5b9

SHA1
faf3134c57b989989cae8314e97d36aaab56ebf2

SHA256
a2e9d1c3c13d41e86d9f9bb77f0bcdc77e3b85b8f3009e72591e3c830d151018

SHA512
9da9d3395e2f38ee1f208c4b6217717976e130a38c698120a25d19a2b0d240689d2483dc03c2c0d52636cc121031e5c434c80095aeb0012a6f96c699b2464219

Download Submit