2a3c3f7b4b4fd2a9c116b588a3d3ce1423db88d46b5ebfd2fba0c8a76bca0d97

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 23:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27466e7c2cbcfc41504fe9b905e18de1_JaffaCakes118.html
Size

54KB
MD5

27466e7c2cbcfc41504fe9b905e18de1
SHA1

d3846e3da425a67a6153ce5d8910a2ce0d51db66
SHA256

2a3c3f7b4b4fd2a9c116b588a3d3ce1423db88d46b5ebfd2fba0c8a76bca0d97
SHA512

0f77b54aad1902c270cffe4b2c2e1b9a460edc320950387938fa3b476ce97e68b79cfec9ce3bfad2e0c93e3ccb1657cfd6a70ce95ed91b6f87c8013d695825db
SSDEEP

1536:/n76rz0zX2s0jI9FZGnx3eZT1Kf97u8ozSeJ1B3T1WTiM1c1ayLF23Lc6XG0ZVgP:/n76IXK0FZGnZ4e9a8oueJ1B3T1WTiM4

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2696	msedge.exe
2696	msedge.exe
2428	msedge.exe
2428	msedge.exe
1680	identity_helper.exe
1680	identity_helper.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 4116	2428	msedge.exe	80
PID 2428 wrote to memory of 4116	2428	msedge.exe	80
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 4656	2428	msedge.exe	81
PID 2428 wrote to memory of 2696	2428	msedge.exe	82
PID 2428 wrote to memory of 2696	2428	msedge.exe	82
PID 2428 wrote to memory of 2892	2428	msedge.exe	83
PID 2428 wrote to memory of 2892	2428	msedge.exe	83
PID 2428 wrote to memory of 2892	2428	msedge.exe	83
PID 2428 wrote to memory of 2892	2428	msedge.exe	83
PID 2428 wrote to memory of 2892	2428	msedge.exe	83
PID 2428 wrote to memory of 2892	2428	msedge.exe	83
PID 2428 wrote to memory of 2892	2428	msedge.exe	83
PID 2428 wrote to memory of 2892	2428	msedge.exe	83
PID 2428 wrote to memory of 2892	2428	msedge.exe	83
PID 2428 wrote to memory of 2892	2428	msedge.exe	83
PID 2428 wrote to memory of 2892	2428	msedge.exe	83
PID 2428 wrote to memory of 2892	2428	msedge.exe	83
PID 2428 wrote to memory of 2892	2428	msedge.exe	83
PID 2428 wrote to memory of 2892	2428	msedge.exe	83
PID 2428 wrote to memory of 2892	2428	msedge.exe	83
PID 2428 wrote to memory of 2892	2428	msedge.exe	83
PID 2428 wrote to memory of 2892	2428	msedge.exe	83
PID 2428 wrote to memory of 2892	2428	msedge.exe	83
PID 2428 wrote to memory of 2892	2428	msedge.exe	83
PID 2428 wrote to memory of 2892	2428	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\27466e7c2cbcfc41504fe9b905e18de1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc2ac46f8,0x7ffdc2ac4708,0x7ffdc2ac4718
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,1732363248163018052,11163108442733986536,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,1732363248163018052,11163108442733986536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,1732363248163018052,11163108442733986536,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1732363248163018052,11163108442733986536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1732363248163018052,11163108442733986536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,1732363248163018052,11163108442733986536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,1732363248163018052,11163108442733986536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1732363248163018052,11163108442733986536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1732363248163018052,11163108442733986536,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1732363248163018052,11163108442733986536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1732363248163018052,11163108442733986536,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,1732363248163018052,11163108442733986536,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4832 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
381B

MD5
1b70f82ad8b272cb46ec2bb24bce37a2

SHA1
f7407c86a16a49d936e11c30d951c6e7146321fa

SHA256
6745131425094e76c8bc55dfe00c43c45f34d9df43804130ab68cbc5f9d59813

SHA512
8cd56880b2838486fcfb1d15d900c31c50eca6ba5104e4ca96d8108c15a148eb16436d88e5f293c9b9d1c8fc54779aa784fea555aaee22a7fb740f2c98d4cded

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f794cc4005e3d2b6934d7a1916d3f382

SHA1
cdaba23022973a7a376e94d7188391dfb3c2b24f

SHA256
fe97eeb7aec3dd84a75a683f267e6c363385fd95861c0dc7fce02eb009b6ecfc

SHA512
4d22990be45136fc2318a279e3ec2135222b8ca4172dfd54a6159314c3c827db4fd7fd81b2a2fa5db3db9ed913b67e9d75cfae1341334630064a7b907bed4429

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
32e93117272077908e25ebcef6dbdf7c

SHA1
36fa9765e1a5410e0eb15dc70324940b4067b859

SHA256
71e7d9c2edc11f87bc52a8565496fac941f098cd7a18b08c170b120e644f7b11

SHA512
da909341006e0d9992eedfb63f2cda5de172b94a0f0b114b6f916b89d92e401b95a99a1530947a8adbfe5b1234acb8591d64388b467a071c35e8c90f5b19d58e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
870eedb9fbefef4f2ddc51ec80a6603a

SHA1
5a1f5857c78021810925e0da761d52ce57455e42

SHA256
d8c777c899928d2f0a5784889541d7fd71acb089d0325c3d87a76f2c25abb580

SHA512
0846ea15beafdda7ab9a73d182023c3838325584c776854e0d1eda5222805e8e045d82d2c5a314fb3fe992e553c6a9c181251d8ccfa94025279f90b845582b15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b3efc169d97b17e74a7d3e1349c8a0e7

SHA1
af838240070b949be9af5f10aac96b62e308c35e

SHA256
611e23cefc86c2e21a774dbfe4e8a9071d94cc03ceb5c326f4b3eb18e0625839

SHA512
caf59d80915b1b4f6f8678c98538825cc0b97a1a04a6cd90acf7c644c2626a00460193edba0acfb363ee57d9278a14d270992c2584d77a8ac4320c11ccb7b77a

Download Submit