8d77cd59238ec921d30c1aab53fcab9cd870502e6fd3838bd8cd69c8307e01f3

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 00:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27739a560229ef4feb8d0b537cbeb543_JaffaCakes118.html
Size

26KB
MD5

27739a560229ef4feb8d0b537cbeb543
SHA1

f0e3d4709fe7ecbc9c45bb0f8af8fca4b3e7348c
SHA256

8d77cd59238ec921d30c1aab53fcab9cd870502e6fd3838bd8cd69c8307e01f3
SHA512

953934d2df2a31633922236de1803e3395d801641c7c635431af7e0b535abf42f5813f1f730a0d21b96cd3157e3b8afba66a97505a5d9c439e21d20016e3e223
SSDEEP

384:6UoOAuwNUz8ujMBT43WVaZ58jUdx8XFxP9gGBRXgh67z1BgUFqzo2iuAcpH8Y8eu:6tO+WjGJVq58jUmF9g/h67hR6H1Vu

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
3160	msedge.exe
3160	msedge.exe
844	identity_helper.exe
844	identity_helper.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 2896	3160	msedge.exe	80
PID 3160 wrote to memory of 2896	3160	msedge.exe	80
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 3936	3160	msedge.exe	82
PID 3160 wrote to memory of 4816	3160	msedge.exe	83
PID 3160 wrote to memory of 4816	3160	msedge.exe	83
PID 3160 wrote to memory of 1276	3160	msedge.exe	84
PID 3160 wrote to memory of 1276	3160	msedge.exe	84
PID 3160 wrote to memory of 1276	3160	msedge.exe	84
PID 3160 wrote to memory of 1276	3160	msedge.exe	84
PID 3160 wrote to memory of 1276	3160	msedge.exe	84
PID 3160 wrote to memory of 1276	3160	msedge.exe	84
PID 3160 wrote to memory of 1276	3160	msedge.exe	84
PID 3160 wrote to memory of 1276	3160	msedge.exe	84
PID 3160 wrote to memory of 1276	3160	msedge.exe	84
PID 3160 wrote to memory of 1276	3160	msedge.exe	84
PID 3160 wrote to memory of 1276	3160	msedge.exe	84
PID 3160 wrote to memory of 1276	3160	msedge.exe	84
PID 3160 wrote to memory of 1276	3160	msedge.exe	84
PID 3160 wrote to memory of 1276	3160	msedge.exe	84
PID 3160 wrote to memory of 1276	3160	msedge.exe	84
PID 3160 wrote to memory of 1276	3160	msedge.exe	84
PID 3160 wrote to memory of 1276	3160	msedge.exe	84
PID 3160 wrote to memory of 1276	3160	msedge.exe	84
PID 3160 wrote to memory of 1276	3160	msedge.exe	84
PID 3160 wrote to memory of 1276	3160	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\27739a560229ef4feb8d0b537cbeb543_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea74146f8,0x7ffea7414708,0x7ffea7414718
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,3469307609102829568,80346763642269600,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,3469307609102829568,80346763642269600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2488 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,3469307609102829568,80346763642269600,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:8
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3469307609102829568,80346763642269600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3469307609102829568,80346763642269600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,3469307609102829568,80346763642269600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,3469307609102829568,80346763642269600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3469307609102829568,80346763642269600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3469307609102829568,80346763642269600,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3469307609102829568,80346763642269600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3469307609102829568,80346763642269600,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,3469307609102829568,80346763642269600,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4928 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
181B

MD5
30f245817a32398e1aa30c422a6b1664

SHA1
db76f596c151a775be1a93ad3e761f6c8a5354a2

SHA256
0e291c3e167a87963bf5d68923cd46f89948773958da17a1060defd4855d1e3a

SHA512
d895008655081733ee5af40844164bb70863d34c4a38cafedc8d6a5f68b4a16c6968c13e088675c6e857d6600b38025b32d86686064e51b0c31ce6aec60f096f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3e4202078843a6d988c15966a0e3c173

SHA1
7bde77c1315c4d6637846c309921c89e555dcc22

SHA256
fe44efa9425ae1e3fe41ed1544b0d936a65f901c878b75c1d3bbbf524f75ebe4

SHA512
cd8850f8f555e368432278371a591bbad2f0c3f172f73fc5ed324143f7b36bc23b34f88f188ab18a01a9b5fc37a8debac6a6db52b38db2d640ed0c9b9b078531

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
88a102ff5a47caa5ccc2262ca71e88a7

SHA1
d97380b8f38fe13241e2e8e5acd399b710f5aaa7

SHA256
a09969cd078af01f0e4aaf0b15bbd8e04ed877a19184ddcc969898fd0bfa1428

SHA512
85cfb824bc09dfc0741bf5dc623e591f32c2fcbbe0fe8eab48660ca6cf8e86ccc1e4cd83aec1f2d178a44850e77206dc130ac966cc593ac9976eeb3a062d29f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
44ebbc829b2bda21ffc8f358db613a01

SHA1
057460ec20d086ff3284184d156bf438599eca03

SHA256
4e8d0ea4a106d22396110ec45d4bb720cb5c2dafb59789e8899845da0a8cbe38

SHA512
9650552676dc55615304700fc1f8c2912c9a339c15ae688e8c9fecf65b10ccc9e535e38c2a1305e4950ce31ce4993faa6cf0ffa16400ed60f52cc121dab8df99

Download Submit