f124b7e569706e560adbc80fe447eb0f3fffa2285700d58ebab654ae7621279c

Analysis

max time kernel
145s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 16:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25c303df1bc371df2738b873a2df8ad9_JaffaCakes118.html
Size

73KB
MD5

25c303df1bc371df2738b873a2df8ad9
SHA1

64ab62b52930e7473ed07cb3df5f9f4193757bf0
SHA256

f124b7e569706e560adbc80fe447eb0f3fffa2285700d58ebab654ae7621279c
SHA512

ae28e384a2c4285e64bb8f2c48e63ce1c5112236450f2e047c245808cf399df991aab8639edfe8c76ce6980eb278385ff64bd3a8fa977b60ea00bca20fed6503
SSDEEP

1536:JPuIfSdvIlvIDTzNen0tbrga94hcuNnQC:J2MivIlvIDTzNUq4hcuZX

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2988	msedge.exe
2988	msedge.exe
4572	msedge.exe
4572	msedge.exe
1284	identity_helper.exe
1284	identity_helper.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 2876	4572	msedge.exe	80
PID 4572 wrote to memory of 2876	4572	msedge.exe	80
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 4460	4572	msedge.exe	82
PID 4572 wrote to memory of 2988	4572	msedge.exe	83
PID 4572 wrote to memory of 2988	4572	msedge.exe	83
PID 4572 wrote to memory of 2128	4572	msedge.exe	84
PID 4572 wrote to memory of 2128	4572	msedge.exe	84
PID 4572 wrote to memory of 2128	4572	msedge.exe	84
PID 4572 wrote to memory of 2128	4572	msedge.exe	84
PID 4572 wrote to memory of 2128	4572	msedge.exe	84
PID 4572 wrote to memory of 2128	4572	msedge.exe	84
PID 4572 wrote to memory of 2128	4572	msedge.exe	84
PID 4572 wrote to memory of 2128	4572	msedge.exe	84
PID 4572 wrote to memory of 2128	4572	msedge.exe	84
PID 4572 wrote to memory of 2128	4572	msedge.exe	84
PID 4572 wrote to memory of 2128	4572	msedge.exe	84
PID 4572 wrote to memory of 2128	4572	msedge.exe	84
PID 4572 wrote to memory of 2128	4572	msedge.exe	84
PID 4572 wrote to memory of 2128	4572	msedge.exe	84
PID 4572 wrote to memory of 2128	4572	msedge.exe	84
PID 4572 wrote to memory of 2128	4572	msedge.exe	84
PID 4572 wrote to memory of 2128	4572	msedge.exe	84
PID 4572 wrote to memory of 2128	4572	msedge.exe	84
PID 4572 wrote to memory of 2128	4572	msedge.exe	84
PID 4572 wrote to memory of 2128	4572	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\25c303df1bc371df2738b873a2df8ad9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ff8c50746f8,0x7ff8c5074708,0x7ff8c5074718
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,12430737920700364399,3961640108990415600,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,12430737920700364399,3961640108990415600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,12430737920700364399,3961640108990415600,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12430737920700364399,3961640108990415600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12430737920700364399,3961640108990415600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,12430737920700364399,3961640108990415600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,12430737920700364399,3961640108990415600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12430737920700364399,3961640108990415600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12430737920700364399,3961640108990415600,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12430737920700364399,3961640108990415600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12430737920700364399,3961640108990415600,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,12430737920700364399,3961640108990415600,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4784 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3500547b-f29c-483e-8f2c-f3d894c767dc.tmp

Filesize
11KB

MD5
8cd8074b3248b9f3a3f811ae9fcdf7d5

SHA1
05934d68a909ca99712a76ed5d5984a9feda9ec3

SHA256
a9b021eb729c2913ad0530af929f5a920af4a4fe7e174c1db3c97d5d05ecce13

SHA512
82d2865d15b6730a746245026655908aea68c2961301df21257983560b6a77d75dd2b6166747673667d4fc344e7cfbcd68bac1edfbcf44533af37a5b7f4fe133

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
67868c4899cb31135bcf64b84139f63e

SHA1
65a336138774446b6a7ebee3b4a493725288b462

SHA256
972284f3db8d01646d8f4e15f65059bef0fc3172d32ee372ec86717b37d2f626

SHA512
856ed50255f2751c83d85d176042905933137e7b64064cb453860b67b6c09b299c3001809f828b9bd37b06cb2a753995f2b66ad2aa8227ab28c57d1d7fd6f22d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
72c9934f6be589c57a8482b0c972706c

SHA1
376f057fbdb7d201d227eda2ea6c89bfae3c4915

SHA256
e3d481aa42ead1c38b86f0d604789701f1fa4d4aa79dc165bdb66b3a722eae85

SHA512
c93eade2a1d2ef605e4dbe4daad0c4fb5373d31fb8a3d3bedffce46b915ef7deac14ac70bdff9fa0ebab59d9b5869c8e2c2ae79fa6bf6716790a9877d61feece

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit