34915e542c6bdb9d756c0d1a66d3e3b55b64ed6ada0a6ab31b0f027c9a8514d6

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 03:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2310c56641b7615c132092788eb7939f_JaffaCakes118.html
Size

34KB
MD5

2310c56641b7615c132092788eb7939f
SHA1

33c04e3b36e9c13467d1348113117d25b6e4f5dd
SHA256

34915e542c6bdb9d756c0d1a66d3e3b55b64ed6ada0a6ab31b0f027c9a8514d6
SHA512

41fc9f9444ff2b425960a8954997837dd67d6ae5220227f4fee8556ef4cfb0afbc719fa18693e05f229c92d08d58832593c86069a82b25780ce2c06c87e51acb
SSDEEP

768:2yThijIr7aq05vz1f75LkHy1zvExAHNab:2gijIr75OvLkHy1zvExAHNab

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
1516	msedge.exe
1516	msedge.exe
1884	identity_helper.exe
1884	identity_helper.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 3956	1516	msedge.exe	85
PID 1516 wrote to memory of 3956	1516	msedge.exe	85
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4376	1516	msedge.exe	86
PID 1516 wrote to memory of 4512	1516	msedge.exe	87
PID 1516 wrote to memory of 4512	1516	msedge.exe	87
PID 1516 wrote to memory of 4860	1516	msedge.exe	88
PID 1516 wrote to memory of 4860	1516	msedge.exe	88
PID 1516 wrote to memory of 4860	1516	msedge.exe	88
PID 1516 wrote to memory of 4860	1516	msedge.exe	88
PID 1516 wrote to memory of 4860	1516	msedge.exe	88
PID 1516 wrote to memory of 4860	1516	msedge.exe	88
PID 1516 wrote to memory of 4860	1516	msedge.exe	88
PID 1516 wrote to memory of 4860	1516	msedge.exe	88
PID 1516 wrote to memory of 4860	1516	msedge.exe	88
PID 1516 wrote to memory of 4860	1516	msedge.exe	88
PID 1516 wrote to memory of 4860	1516	msedge.exe	88
PID 1516 wrote to memory of 4860	1516	msedge.exe	88
PID 1516 wrote to memory of 4860	1516	msedge.exe	88
PID 1516 wrote to memory of 4860	1516	msedge.exe	88
PID 1516 wrote to memory of 4860	1516	msedge.exe	88
PID 1516 wrote to memory of 4860	1516	msedge.exe	88
PID 1516 wrote to memory of 4860	1516	msedge.exe	88
PID 1516 wrote to memory of 4860	1516	msedge.exe	88
PID 1516 wrote to memory of 4860	1516	msedge.exe	88
PID 1516 wrote to memory of 4860	1516	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2310c56641b7615c132092788eb7939f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8a7246f8,0x7ffe8a724708,0x7ffe8a724718
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,9731411812048438249,750082702190836679,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,9731411812048438249,750082702190836679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,9731411812048438249,750082702190836679,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9731411812048438249,750082702190836679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9731411812048438249,750082702190836679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,9731411812048438249,750082702190836679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,9731411812048438249,750082702190836679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9731411812048438249,750082702190836679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9731411812048438249,750082702190836679,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9731411812048438249,750082702190836679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9731411812048438249,750082702190836679,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,9731411812048438249,750082702190836679,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3004 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
187B

MD5
363f8beb6ca49afa2094ccce7f4fe76b

SHA1
22fb6375fe18a602902f082f88f652cc13d7f5d6

SHA256
f8b2117420fba3a45dd963d15d0402d344087cae9765ef3349cad17580ae2d93

SHA512
05984d66df1946f4af3a41318cd18854fff4e5bf05edb6129520b68a0053320451f790b6639015dd25e3a36beef84d1d51d0acb62962622416ff3f4a46ee2e06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a620e6bbaadaeae2f740bf06e620ab90

SHA1
70f4e27c8b28476f4cf881333e4e4fb0be124d8a

SHA256
5276736164e4701a41d77a4391d0aa840e6baa54009efe9c76ed77a0502ef3fc

SHA512
1ec3305d549c1b8f56a6cf71f2f2fc2bba02ed48fffdab7708642bd2259db14dc688e92b08733d2fee79691556c4252371a74af82d68eed04650bfdcd943d898

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1ddf633424c7473e4421e115cdad0a2d

SHA1
4a8afbda2f3ee9ac11d145d678578706046804bc

SHA256
bbabd3393f651b6cf017f6c91dbb529b82ce1b8ce9ea4f80e7c1b004becb85fc

SHA512
c6bf04a3db1714a459b864b6b364eeddb4a495eb496a0af924b9ac0006bec66670dcf083b550f7be34c7ae978264a7aaa923832bc49837ceb760a27a86510566

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e628ae4e7d09840f7f28de1d0a5aacc7

SHA1
0d0c47fff2bf8792802cd1df675829c3d676c6e5

SHA256
98a6270cc62301e5eba76b8ec9cf7ae96a19328c14d8ced68b24e6c3dd96556e

SHA512
078ef98093caab1642379a85749f2e25c07903b5c344c409c7f50aa3026ca8c1be069b68e937d35512847b6092caa0eee458e908b5af6ba4c5afb11a9f6702aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
49240ebdb8e9ca8d43e6d843c9634882

SHA1
fbfef4d1e882ec03f5445dfcd1292401c6b2ef9c

SHA256
551a4cbba5f7566f631af58db7bbbf9de65cae03e0eae41131ad1443003ce6da

SHA512
537a3f10f053e79342c4cb4b1aaff0631f0ff8ab9846911b9464bb85c83bf46954c8d3e1743a4f927f779587c0a41db4ba574c5c8b3d3f79cbd7bbfaaf569d55

Download Submit