08ed1998754055adc7151e0e6081954e1e5a79a583bf5ccf048d5295158cc8d5

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 00:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2271fbfb36800164ee247bdb8ac52e42_JaffaCakes118.html
Size

325KB
MD5

2271fbfb36800164ee247bdb8ac52e42
SHA1

0c8fa4e67449fdc530ff93906fdd2fbba6eb5e0d
SHA256

08ed1998754055adc7151e0e6081954e1e5a79a583bf5ccf048d5295158cc8d5
SHA512

beccbf9ce1d83870e89864085f7f4f8694d090ef35934f95db77a6fd84bd48f827f2762c5105446d19fc75dd9530ae5b28fbaa3c9cd4eb31d544d8ffa29d9c27
SSDEEP

3072:Y/8JPaXdkqxqd85j6JwawzSKIY2VRKpYtAgOlMccGxCARBGdCm+8dCrh2T8uWMR7:749u2qZZL8Nck8Eh2o0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2320	msedge.exe
2320	msedge.exe
2384	msedge.exe
2384	msedge.exe
4324	identity_helper.exe
4324	identity_helper.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 4688	2384	msedge.exe	84
PID 2384 wrote to memory of 4688	2384	msedge.exe	84
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 3716	2384	msedge.exe	85
PID 2384 wrote to memory of 2320	2384	msedge.exe	86
PID 2384 wrote to memory of 2320	2384	msedge.exe	86
PID 2384 wrote to memory of 1600	2384	msedge.exe	87
PID 2384 wrote to memory of 1600	2384	msedge.exe	87
PID 2384 wrote to memory of 1600	2384	msedge.exe	87
PID 2384 wrote to memory of 1600	2384	msedge.exe	87
PID 2384 wrote to memory of 1600	2384	msedge.exe	87
PID 2384 wrote to memory of 1600	2384	msedge.exe	87
PID 2384 wrote to memory of 1600	2384	msedge.exe	87
PID 2384 wrote to memory of 1600	2384	msedge.exe	87
PID 2384 wrote to memory of 1600	2384	msedge.exe	87
PID 2384 wrote to memory of 1600	2384	msedge.exe	87
PID 2384 wrote to memory of 1600	2384	msedge.exe	87
PID 2384 wrote to memory of 1600	2384	msedge.exe	87
PID 2384 wrote to memory of 1600	2384	msedge.exe	87
PID 2384 wrote to memory of 1600	2384	msedge.exe	87
PID 2384 wrote to memory of 1600	2384	msedge.exe	87
PID 2384 wrote to memory of 1600	2384	msedge.exe	87
PID 2384 wrote to memory of 1600	2384	msedge.exe	87
PID 2384 wrote to memory of 1600	2384	msedge.exe	87
PID 2384 wrote to memory of 1600	2384	msedge.exe	87
PID 2384 wrote to memory of 1600	2384	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2271fbfb36800164ee247bdb8ac52e42_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e61746f8,0x7ff9e6174708,0x7ff9e6174718
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,10562755662147427603,12162816370549784672,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,10562755662147427603,12162816370549784672,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,10562755662147427603,12162816370549784672,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10562755662147427603,12162816370549784672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10562755662147427603,12162816370549784672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,10562755662147427603,12162816370549784672,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,10562755662147427603,12162816370549784672,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10562755662147427603,12162816370549784672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10562755662147427603,12162816370549784672,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10562755662147427603,12162816370549784672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,10562755662147427603,12162816370549784672,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,10562755662147427603,12162816370549784672,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5004 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\02bd0acd-c87c-4105-bbee-cef4d8fb2654.tmp

Filesize
11KB

MD5
4ee44866818b6304a2cfd5883d4a52dd

SHA1
a36197d15875c5d5bec20cdeb7717ae8251fdd92

SHA256
cccdb7a5a0eb20edd87557eda96c27d79e41441a7f6de4b307e7587b9aa6707b

SHA512
a772db4955a13291e73f037fa70502be87d966b60b5265c0144f639df5a3682c95971290d506c8592d8e80020804e88fd5bb663ca3c2d9d2b97c4295727470d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
954B

MD5
732ac7e54038add37e0087c696d33664

SHA1
70b1b00d2467bce078d60b88392903b551e8c450

SHA256
09fac1bff7dc9900e270261288d054ee33ba57b62707e987b514f64227367d77

SHA512
91760e401750666efc5d91fe91bb98864013f36c1ac342f55274c009eaf778d9d3c3cbd0a8869bdc90fb8c0e888edb084c9f5f3831b0cdd660621708ef5b65b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cc3603ff8923e9f8987e9244e5c45b15

SHA1
15b034dd755d616e480dcceba3cae92756b09fd6

SHA256
2508338d02199008742075306ab28fa42ea8555554c9d1b069d35cfe69e64d4c

SHA512
b3bef713e545191f30e88629173346b94e120c7256cf50e3ede0653f851b8775c170a572da238f379d00ee8da58dcecba4ac854700e2bc179f66823cdc37511e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
824db69a913f5650527cbaf9a4adc9b4

SHA1
d56a1451289e3b39afd177b0b49365959fb3dd56

SHA256
dd7b48fd450cb57d57ae47de406e0a677f687c90c71c55373373bb4ab9722677

SHA512
bfffb398a0a079bbd213387923a16535b621202dac0c8a67da2ba4667dc707eeeb97a551e49b960391a8d012ac5a8cb2248dfb6228c7ae7e3b7b868023bac46c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
536B

MD5
613aac155282c358eb4129a3db42adaf

SHA1
ea0fedb70d5e7eee966ee059f77a5421324d659b

SHA256
a397908c2768b93cc56933ab4344fe22914c6cd29e0b9430db552f5fd0b8ad66

SHA512
dbb354e1ce7a6e6cf2e3bccc73fb062fefe824c7b210f3d6cea28aa61a7aa6022b4c5d1a997da30446bb06ca0a2ccf771edf4142ae81c7f9dc28b8557d1dc21d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bb61.TMP

Filesize
538B

MD5
e35c153795d652e3d8f382d90d3344c1

SHA1
c47ac3fcae83b142d4700a6ba739c826bedcd4e9

SHA256
ac339e55104842921bf3d217af05cf39cd1055d56065ce6c54bf71014c7eb7f0

SHA512
731c0d823a037fcd01aa8b2ca26440bb07cfed5a99553d6d2d6f6f519e8da00b390e9a51cde2e3f356e2c9e036c4f8db347fa0c41b96a6a0ffa4b5513e56a810

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit