53ebe0a37d59d13da96d56f499c0d66833d37a5ffcbb36a5297d1ff06f1dd01b

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 19:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

264a8458adeeed66e93105d8e315a0d7_JaffaCakes118.html
Size

94KB
MD5

264a8458adeeed66e93105d8e315a0d7
SHA1

a65146ab333af40abf5d690cbd626705a258dd57
SHA256

53ebe0a37d59d13da96d56f499c0d66833d37a5ffcbb36a5297d1ff06f1dd01b
SHA512

edaa1cbb8ef4abc7b7f5160aa6dff0d5f18301206bfca1bb3c105d3345cfa2df25cb3b1dfd6062ed9da44fccacaa9e67a4f7c2b71a5598792235df615009501d
SSDEEP

768:STmWZs5vfzEB03grxy5h1i4M8N0G/Y6iYfw:STmWqBfzEB03g1Ah1i4dd/Y6iYfw

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
4180	msedge.exe
4180	msedge.exe
4916	identity_helper.exe
4916	identity_helper.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 1316	4180	msedge.exe	79
PID 4180 wrote to memory of 1316	4180	msedge.exe	79
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4872	4180	msedge.exe	80
PID 4180 wrote to memory of 4988	4180	msedge.exe	81
PID 4180 wrote to memory of 4988	4180	msedge.exe	81
PID 4180 wrote to memory of 4184	4180	msedge.exe	82
PID 4180 wrote to memory of 4184	4180	msedge.exe	82
PID 4180 wrote to memory of 4184	4180	msedge.exe	82
PID 4180 wrote to memory of 4184	4180	msedge.exe	82
PID 4180 wrote to memory of 4184	4180	msedge.exe	82
PID 4180 wrote to memory of 4184	4180	msedge.exe	82
PID 4180 wrote to memory of 4184	4180	msedge.exe	82
PID 4180 wrote to memory of 4184	4180	msedge.exe	82
PID 4180 wrote to memory of 4184	4180	msedge.exe	82
PID 4180 wrote to memory of 4184	4180	msedge.exe	82
PID 4180 wrote to memory of 4184	4180	msedge.exe	82
PID 4180 wrote to memory of 4184	4180	msedge.exe	82
PID 4180 wrote to memory of 4184	4180	msedge.exe	82
PID 4180 wrote to memory of 4184	4180	msedge.exe	82
PID 4180 wrote to memory of 4184	4180	msedge.exe	82
PID 4180 wrote to memory of 4184	4180	msedge.exe	82
PID 4180 wrote to memory of 4184	4180	msedge.exe	82
PID 4180 wrote to memory of 4184	4180	msedge.exe	82
PID 4180 wrote to memory of 4184	4180	msedge.exe	82
PID 4180 wrote to memory of 4184	4180	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\264a8458adeeed66e93105d8e315a0d7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf8a146f8,0x7ffbf8a14708,0x7ffbf8a14718
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,14446679638869026023,16405492227594390736,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,14446679638869026023,16405492227594390736,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,14446679638869026023,16405492227594390736,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14446679638869026023,16405492227594390736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14446679638869026023,16405492227594390736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14446679638869026023,16405492227594390736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,14446679638869026023,16405492227594390736,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,14446679638869026023,16405492227594390736,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14446679638869026023,16405492227594390736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14446679638869026023,16405492227594390736,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14446679638869026023,16405492227594390736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14446679638869026023,16405492227594390736,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,14446679638869026023,16405492227594390736,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5128 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
1466752c67d563cfe51a0921d3ce1397

SHA1
4c026ec738763c6fa49dfdbdfaf67f8142943b72

SHA256
f57cad5703b298c8c6c4cfb1f785228ae0af52d1194ac2a7eb15a71df4b555ef

SHA512
8a487f0e0ac073778187ff9a22a8fb565321d8d50efeb6ed30cd43315bca15770bd8b096f1bc76aef5726d5bc3d80e28a99fee841186b1ae108c0d79f5a96f3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
324B

MD5
ff17505b02d988cd94ac6b26bf718018

SHA1
69f3ba890950867b858fb4c1bface08058ddc38d

SHA256
d0718af13cae3e6a7b66a86da4da75938d0d6b84bf5f9039f812d588ab9a02d4

SHA512
c6570711fc94751163c9a7b8f9932d51b7e472e86707ad8a651f76814408b01e00a0f4710d680f9b168c510bfb527dc3106a254e0747f3254afadbfc73737984

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1545a7fef8e644993c162e94adea3f48

SHA1
48010c5d1f78e045f130e19d669371fd849c5c25

SHA256
79f3799a5222ee3c38cc4056ee684c797fd6ca0490838ecc7046fe6c0a472d04

SHA512
c989d45d92fe391972a362e632f5edd47cfc83c9b504a168e46cb90277dedeff2cf69c030754d0d93b186cca2bbc6af5d541b98f9758501add38f808423c7e3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f7ed88582701e8cd9530b2bfc4aeb0c4

SHA1
62ead1fd154a6d23238af7e88f0e8dfb80da1c0f

SHA256
0b161cb25865a6ad65ec172ebbb74b00f9fc6b89e0e996f8fa8f9d8a0204d5af

SHA512
1a8582cda6e5d83363096a0b784d86542e6722b0920c78b6d13cab5b2c2b9653a5cb8cd6e25d2b60b5bd6b17be3c7d723b585fad6750c96d304ee5f46f655627

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d6b189d261fe9e09894cb6902b77be41

SHA1
dd58c04de487c718d2e93b2f6b4c3090d6d41a45

SHA256
da5ed201a84c156ed72db02075f0c97c01f3acee14c5f3c5824cbe7bdd5d1523

SHA512
786d1592598aee90b9ed18d13940c20dde7bd0e555525482c0b24025d2aa24999fe94788d8c75f98492e6ffa385c84d49edc741ece52e8088af926e0359850e8

Download Submit