ab8909572bc7b2de69b228cd51fb9dc6cabcdb00fe3d740753f7c537c7799555

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 02:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27dfaff484ee016ef9443cba6d5d8f46_JaffaCakes118.html
Size

54KB
MD5

27dfaff484ee016ef9443cba6d5d8f46
SHA1

4bbb2feff708db81a797b62ae2bd93c6a5652cf8
SHA256

ab8909572bc7b2de69b228cd51fb9dc6cabcdb00fe3d740753f7c537c7799555
SHA512

324eb1f9c7ebe2cd9bbb850fede2b9073f991853da7cba35709cd981ca651d8aa231d20060a7d85eb97932972dda34da5559acd7e21c5c9f2de99b200c2fc12d
SSDEEP

768:9r8pHvvCIoo9Yq32KkKgeFK/CO93RZuq9/6ZFMIgVBU:9oHv7oiYqmXKgDNB6ZFf

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2860	msedge.exe
2860	msedge.exe
3092	identity_helper.exe
3092	identity_helper.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 5040	2860	msedge.exe	86
PID 2860 wrote to memory of 5040	2860	msedge.exe	86
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2724	2860	msedge.exe	87
PID 2860 wrote to memory of 2252	2860	msedge.exe	88
PID 2860 wrote to memory of 2252	2860	msedge.exe	88
PID 2860 wrote to memory of 1956	2860	msedge.exe	89
PID 2860 wrote to memory of 1956	2860	msedge.exe	89
PID 2860 wrote to memory of 1956	2860	msedge.exe	89
PID 2860 wrote to memory of 1956	2860	msedge.exe	89
PID 2860 wrote to memory of 1956	2860	msedge.exe	89
PID 2860 wrote to memory of 1956	2860	msedge.exe	89
PID 2860 wrote to memory of 1956	2860	msedge.exe	89
PID 2860 wrote to memory of 1956	2860	msedge.exe	89
PID 2860 wrote to memory of 1956	2860	msedge.exe	89
PID 2860 wrote to memory of 1956	2860	msedge.exe	89
PID 2860 wrote to memory of 1956	2860	msedge.exe	89
PID 2860 wrote to memory of 1956	2860	msedge.exe	89
PID 2860 wrote to memory of 1956	2860	msedge.exe	89
PID 2860 wrote to memory of 1956	2860	msedge.exe	89
PID 2860 wrote to memory of 1956	2860	msedge.exe	89
PID 2860 wrote to memory of 1956	2860	msedge.exe	89
PID 2860 wrote to memory of 1956	2860	msedge.exe	89
PID 2860 wrote to memory of 1956	2860	msedge.exe	89
PID 2860 wrote to memory of 1956	2860	msedge.exe	89
PID 2860 wrote to memory of 1956	2860	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\27dfaff484ee016ef9443cba6d5d8f46_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf44a46f8,0x7ffaf44a4708,0x7ffaf44a4718
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,15539713374437804634,16226662591504573084,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,15539713374437804634,16226662591504573084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,15539713374437804634,16226662591504573084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,15539713374437804634,16226662591504573084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,15539713374437804634,16226662591504573084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,15539713374437804634,16226662591504573084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,15539713374437804634,16226662591504573084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3952 /prefetch:8
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,15539713374437804634,16226662591504573084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,15539713374437804634,16226662591504573084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,15539713374437804634,16226662591504573084,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,15539713374437804634,16226662591504573084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,15539713374437804634,16226662591504573084,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,15539713374437804634,16226662591504573084,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4888 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
178e8dfbe7cda32bdbfbb0a15f12d8a1

SHA1
5c1f00e7c95956d1dda37ede3cf1ca6a94d6b746

SHA256
dbbf0e0a5a8973ab958afc62fe18d19c1ce4c0123823afbd270251834b939fdc

SHA512
d34ac25208c7c28e5aff580ee4ebee6eb266e9a5933464b5e4629bb116ad988f1efb850b3e8fbf9d40875154b67f901048dd76d9c2ff4b3e73c4f6b4d9183086

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
dc04c25f228b4aaa5bca40c94f4173e7

SHA1
2fe41f2a925c8d49fa8f6567ac13c66338940052

SHA256
8570a75fa3d74839e3a26df56df0bd8d8a4a6c7f7471d81e8870eaeab6439260

SHA512
a4c590ec19859eeb56be95d2116b4a71c7e06a8b3809da4aff9552aaf4ed1b58a0469bc47d8931efedc900cb4cb47d35b9c2df23acc721c02f437655ef467fde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6f7568f5c7eda67f4b0e00507d4b12c6

SHA1
71d77f0812963614b5a012e9ad2d82e828d302e4

SHA256
97de4c39e046066d30921e453227c71627e4a08c77376c5095402f45ede3880f

SHA512
869e880f40539fdcfb63b2db759fea6b9dfd19c58f77d093fa1a0a2efc3422a8c24ad1646cdf4114f77bbfe1a3460ffb263cde59af5a9be5540e00256ff23001

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
927c2da17b85388c56c831c305891cdc

SHA1
603491e7a7540cfacd8acceeeb95d84a134da662

SHA256
f895964b414ee6b67f6a98e72e164f3301fa9c38038e7460fa53e4ca6e6a8b09

SHA512
05bd9263fdcf0e8b5e412edabc826a5fd14feabdba0b25f8abbe7b2ee75c18da261b5f20a89ce84a09f074188089b8d3bd3a6acf94a3a45aeb6aedc854c2c00a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1f40e6df5a329ab9e60602ab60aec182

SHA1
8927e3ed1d8912bc6fee200f56dfea8ecfdf04b6

SHA256
d9b9b666830656a0299b39b4a4b4d539830ed373c7e68a7b1f0c3a2f836d8686

SHA512
49e273077fa7ab3a6cdd19d37fc3a78187bc0556505300ce392ef49c2bf6f624e8a944def8280e4a0a7ea240e7dda5d5c43bffc3fce1433fd139f59809b6d915

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dd4b5904dffece05c0d6cac8dc8fd397

SHA1
1a482a1c160d487371ebb9e9d3e1ab395bdbe401

SHA256
53fcadbc2f5043dda57a69eb9bab9e261377469a1ee5e5803e8b9daee3eb2e20

SHA512
599eacc55e197ef1cf824f02fc681722a5b8717a30853f645fee69d79e6e449ba87d7140794b91f991a39d686da7cc8d51701f6d5026c651839b86d05c4ecca9

Download Submit