d95c8ce9f66cc69cf57ecf08c8450b4a4adba2a5e207e498e855d276c4e840fb

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 15:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

25904e0844cfaf2389e14a1fa22b0da8_JaffaCakes118.html
Size

36KB
MD5

25904e0844cfaf2389e14a1fa22b0da8
SHA1

8c482982f3d4b1d65b70dc0028c329c40cfaefca
SHA256

d95c8ce9f66cc69cf57ecf08c8450b4a4adba2a5e207e498e855d276c4e840fb
SHA512

26348ad2530c033f6bda89d43224e7e4107de09d9615a69c819d8ec95571b71f483bddb648a054ca735e1ae79e132fe1d79548a03923afa0f854470d127cd203
SSDEEP

768:zwx/MDTHNl88hARkZPXHE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TyaLx66f9U56lLu:Q/XbJxNVuufSW/d8lK

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
916	msedge.exe
916	msedge.exe
5036	msedge.exe
5036	msedge.exe
2760	identity_helper.exe
2760	identity_helper.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 1572	5036	msedge.exe	79
PID 5036 wrote to memory of 1572	5036	msedge.exe	79
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 3592	5036	msedge.exe	80
PID 5036 wrote to memory of 916	5036	msedge.exe	81
PID 5036 wrote to memory of 916	5036	msedge.exe	81
PID 5036 wrote to memory of 212	5036	msedge.exe	82
PID 5036 wrote to memory of 212	5036	msedge.exe	82
PID 5036 wrote to memory of 212	5036	msedge.exe	82
PID 5036 wrote to memory of 212	5036	msedge.exe	82
PID 5036 wrote to memory of 212	5036	msedge.exe	82
PID 5036 wrote to memory of 212	5036	msedge.exe	82
PID 5036 wrote to memory of 212	5036	msedge.exe	82
PID 5036 wrote to memory of 212	5036	msedge.exe	82
PID 5036 wrote to memory of 212	5036	msedge.exe	82
PID 5036 wrote to memory of 212	5036	msedge.exe	82
PID 5036 wrote to memory of 212	5036	msedge.exe	82
PID 5036 wrote to memory of 212	5036	msedge.exe	82
PID 5036 wrote to memory of 212	5036	msedge.exe	82
PID 5036 wrote to memory of 212	5036	msedge.exe	82
PID 5036 wrote to memory of 212	5036	msedge.exe	82
PID 5036 wrote to memory of 212	5036	msedge.exe	82
PID 5036 wrote to memory of 212	5036	msedge.exe	82
PID 5036 wrote to memory of 212	5036	msedge.exe	82
PID 5036 wrote to memory of 212	5036	msedge.exe	82
PID 5036 wrote to memory of 212	5036	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\25904e0844cfaf2389e14a1fa22b0da8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc451e46f8,0x7ffc451e4708,0x7ffc451e4718
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,10777001596290706265,2966113250986648939,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,10777001596290706265,2966113250986648939,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,10777001596290706265,2966113250986648939,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10777001596290706265,2966113250986648939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10777001596290706265,2966113250986648939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,10777001596290706265,2966113250986648939,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,10777001596290706265,2966113250986648939,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10777001596290706265,2966113250986648939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10777001596290706265,2966113250986648939,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10777001596290706265,2966113250986648939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10777001596290706265,2966113250986648939,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,10777001596290706265,2966113250986648939,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5748 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
614B

MD5
d697dd17c5f8b30b823b100b52d24c3f

SHA1
f3adc9f7d94e5ab84996ca4e27cffb5f14696d4d

SHA256
762ff7b9dd87b1f0bad5da138568e29c8013f9c1ef621c7b188e443e9866f089

SHA512
d9cf3deeb54ea937da9a9d2f1f779f31d5b051bdabb8d061ec33cabf1cfd35fd5b734bfb2a5b9344fdab287fd835be5987b5d51c41559d9d15f98e489cd75c34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9781ec372513a73b348853cc688c1b21

SHA1
5ddc28915a6e55804acadb6558d06dd7ebd962c7

SHA256
e6c4ea615f427853e5f36710fc84e074be64dd17148b58f9c535f19e35a42cda

SHA512
b2491a8322581477ee54d9398a194bd2ee6a6a55843c692abb02ed4a2f9475c44078d964c893234b182078ec4a849e2e5cb9fc7b3779c2abea04b19e13972eb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2c2772fdb2a911f602799126397e7895

SHA1
f0b481a1de31db15b28f0eb8b171c898a40b5206

SHA256
f87380d18fc31da23eb3eb04987ddb67d717bc9885548a37f84a4d35db64bff6

SHA512
809e8bab87ad29ebcdada8077e1c4a57bf764e061b045fcb8f1a58172c25d8dcc1027340b990057ab7a5cc3ea41edd2f9b9acb9b7a7df8f548edf73982deceeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
07dc12994ad27f4a04ad0d610602bb31

SHA1
dd3899204a8fc354223a00dd79a032357faf471e

SHA256
9d8c6eebf1b92ab1dcf2aad51d6f7e0986ab5ffc63295566dc50fcfce4e5d683

SHA512
15acbb632a5394cedda35f53f513e5cff7b7ef760a064f3654b4de68e176dc854f8f224fbbeb799730334f5e93d858d47d2ea3110eb8b8d122d9833ca5539ca3

Download Submit