47722a36c43d54e1e6b021002a78f7eaf4f62b441fa29dcc5b86a6edf74fc604

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 23:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c27893b8153745406ecef2cdb2749b8_JaffaCakes118.html
Size

34KB
MD5

2c27893b8153745406ecef2cdb2749b8
SHA1

9066db763681025f501e898ba6bc2d01b148e18e
SHA256

47722a36c43d54e1e6b021002a78f7eaf4f62b441fa29dcc5b86a6edf74fc604
SHA512

2f743eb5591b028d19984c44046d3b0a4d0dc415a1e7bbc66adc620176ca5dbdf5c196d56b47934593bb56a525341da6e0926d07af197d86f2b4070fdd906829
SSDEEP

768:BlZ6uhDD6yQQVQPjW5/ixOmyq3i4sOwMQNSAIV2riISEVPgOrM68:BS+DD6yQQVcWuwNNdY2GoI68

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
908	msedge.exe
908	msedge.exe
2028	msedge.exe
2028	msedge.exe
3152	identity_helper.exe
3152	identity_helper.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1220	2028	msedge.exe	81
PID 2028 wrote to memory of 1220	2028	msedge.exe	81
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 2128	2028	msedge.exe	83
PID 2028 wrote to memory of 908	2028	msedge.exe	84
PID 2028 wrote to memory of 908	2028	msedge.exe	84
PID 2028 wrote to memory of 4320	2028	msedge.exe	85
PID 2028 wrote to memory of 4320	2028	msedge.exe	85
PID 2028 wrote to memory of 4320	2028	msedge.exe	85
PID 2028 wrote to memory of 4320	2028	msedge.exe	85
PID 2028 wrote to memory of 4320	2028	msedge.exe	85
PID 2028 wrote to memory of 4320	2028	msedge.exe	85
PID 2028 wrote to memory of 4320	2028	msedge.exe	85
PID 2028 wrote to memory of 4320	2028	msedge.exe	85
PID 2028 wrote to memory of 4320	2028	msedge.exe	85
PID 2028 wrote to memory of 4320	2028	msedge.exe	85
PID 2028 wrote to memory of 4320	2028	msedge.exe	85
PID 2028 wrote to memory of 4320	2028	msedge.exe	85
PID 2028 wrote to memory of 4320	2028	msedge.exe	85
PID 2028 wrote to memory of 4320	2028	msedge.exe	85
PID 2028 wrote to memory of 4320	2028	msedge.exe	85
PID 2028 wrote to memory of 4320	2028	msedge.exe	85
PID 2028 wrote to memory of 4320	2028	msedge.exe	85
PID 2028 wrote to memory of 4320	2028	msedge.exe	85
PID 2028 wrote to memory of 4320	2028	msedge.exe	85
PID 2028 wrote to memory of 4320	2028	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2c27893b8153745406ecef2cdb2749b8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c04046f8,0x7ff8c0404708,0x7ff8c0404718
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,6835576948862311964,1686533543461924354,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,6835576948862311964,1686533543461924354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,6835576948862311964,1686533543461924354,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6835576948862311964,1686533543461924354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6835576948862311964,1686533543461924354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,6835576948862311964,1686533543461924354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,6835576948862311964,1686533543461924354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6835576948862311964,1686533543461924354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6835576948862311964,1686533543461924354,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6835576948862311964,1686533543461924354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6835576948862311964,1686533543461924354,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,6835576948862311964,1686533543461924354,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4556 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
547B

MD5
53a5f55dc14d4f7a27930b215f90a779

SHA1
fcf657cd2667b01ff24581cd82d6a3b371cefa0b

SHA256
7f8c7e57979904c78191846ecc3c1fc5626e55ef8271b9b2fea0a3355ad9e082

SHA512
5b8c2f368fe598e6e059024f82244de163c33523390b9c8f7fd3e4b2362715e574adc7370fdcec8f448f0f85262c8ad1ead3571b087967c508578230c4192a27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8d9596cb40105d2c5311333c041a9222

SHA1
9df11d36fa3f680c674388dacb934afe2627f21e

SHA256
b64b4807accbd8de7034b4190ad70cd131e8ca8491c8ed5747e9cf98d5a749d2

SHA512
1f182d15ed4cc5194045ef12075aaf1b911737d81371c613b94b191e21ddc58ccad15eeeda8c3251ca8c04467453b646f0d35cefdcf411bb5348fec8d1274d8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7b4ab395ccb4d2312cca3c3737248685

SHA1
73f3b6c7135d4b148795c66758599bb16aea276e

SHA256
4ebb759f8b0251d4b0de281b446f32c13c90903f73a8cc614ae50b65c19484ee

SHA512
b359dc471f10da3c337647ab4ce740d0a7fa885dab90d00a5048d64ad22769bc5d8b6afd6fcfc2e6a8e56c7cd01415626bb66dc218475abf2eac22526b1fdafe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6a286f502244f255d05fbe01a48f1f24

SHA1
4e6b9af183d94ce6d9a66eddb70a298c2eacbf0a

SHA256
2576857250828f348da90468be2fd169e08cf4c5733cc55e84d765137fb688a3

SHA512
904ef3228a873095875975c6811dda657e2ff2e01bfd3e3bdfacf2c4bc43ce232d0f7fd0f5e3cd376a0175890e0845205e814ae3f874125879bb5fa6118b992c

Download Submit