54d9307ba93fb7e0b280f31eca259ee340bdcfff40ed74728bf4dff385e24c64

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 09:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29527f820421e8af82521185e5d311be_JaffaCakes118.html
Size

36KB
MD5

29527f820421e8af82521185e5d311be
SHA1

d6f546a8604bca6b0d4e9f532820f01ad2ec3544
SHA256

54d9307ba93fb7e0b280f31eca259ee340bdcfff40ed74728bf4dff385e24c64
SHA512

c50793653149bfa9dc7941a36ed662d443fda7b1834a841a4add7902ce8c9ff239d5b1ae4d264b0f0171b3585f2851e9b95da1ae8ffd6729a1a27d5244c8a1d1
SSDEEP

192:IB4c2xnoTy91pYgC41L/cslmCIlP6yV9tq/n0IlX/LfDnjeYr6Ky/6oFkhtZ//sN:IB4c29F9HXNwslRTKnvDslbU

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1252	msedge.exe
1252	msedge.exe
2628	msedge.exe
2628	msedge.exe
232	identity_helper.exe
232	identity_helper.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 1832	2628	msedge.exe	81
PID 2628 wrote to memory of 1832	2628	msedge.exe	81
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1060	2628	msedge.exe	82
PID 2628 wrote to memory of 1252	2628	msedge.exe	83
PID 2628 wrote to memory of 1252	2628	msedge.exe	83
PID 2628 wrote to memory of 2460	2628	msedge.exe	84
PID 2628 wrote to memory of 2460	2628	msedge.exe	84
PID 2628 wrote to memory of 2460	2628	msedge.exe	84
PID 2628 wrote to memory of 2460	2628	msedge.exe	84
PID 2628 wrote to memory of 2460	2628	msedge.exe	84
PID 2628 wrote to memory of 2460	2628	msedge.exe	84
PID 2628 wrote to memory of 2460	2628	msedge.exe	84
PID 2628 wrote to memory of 2460	2628	msedge.exe	84
PID 2628 wrote to memory of 2460	2628	msedge.exe	84
PID 2628 wrote to memory of 2460	2628	msedge.exe	84
PID 2628 wrote to memory of 2460	2628	msedge.exe	84
PID 2628 wrote to memory of 2460	2628	msedge.exe	84
PID 2628 wrote to memory of 2460	2628	msedge.exe	84
PID 2628 wrote to memory of 2460	2628	msedge.exe	84
PID 2628 wrote to memory of 2460	2628	msedge.exe	84
PID 2628 wrote to memory of 2460	2628	msedge.exe	84
PID 2628 wrote to memory of 2460	2628	msedge.exe	84
PID 2628 wrote to memory of 2460	2628	msedge.exe	84
PID 2628 wrote to memory of 2460	2628	msedge.exe	84
PID 2628 wrote to memory of 2460	2628	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\29527f820421e8af82521185e5d311be_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xa4,0x108,0x7ffa811c46f8,0x7ffa811c4708,0x7ffa811c4718
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,17149977242253887206,8419824310941042655,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,17149977242253887206,8419824310941042655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,17149977242253887206,8419824310941042655,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17149977242253887206,8419824310941042655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17149977242253887206,8419824310941042655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17149977242253887206,8419824310941042655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,17149977242253887206,8419824310941042655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,17149977242253887206,8419824310941042655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17149977242253887206,8419824310941042655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17149977242253887206,8419824310941042655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17149977242253887206,8419824310941042655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17149977242253887206,8419824310941042655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,17149977242253887206,8419824310941042655,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4612 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
881B

MD5
f6e511cfbd0413625e7e31a548bb5c69

SHA1
5957b09200a056b4f64f00a4e366e777189d2bcf

SHA256
63dad146463512ea220a09b6e9d3d94b9afcc1602c89b08e2e7ac1c0b1c36163

SHA512
443e6960883bb11cd336005e34dd15f85d8d458214d25be231d74559ebb68ccfeb99e736f799559531a4aaf1aaeca6baab976ff9efcfdff5a213410820e38446

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
825ea91d70956290ab3fdec7b7a6d1ba

SHA1
690ed3dc45b4349b0bf6734ca46f1234a4b596f7

SHA256
b4458ed8ba48d9e5ebed378a1f2059ec3690a3cc0ff67052b245a80a5718f0ce

SHA512
ebaa9e52c08a41385f85b04fceeb7fa92b0a853ee75caa93352ee40e9cb5b2d945cc34f4617d841dc31133675274536418f1f6780ecb362f62534cc6dd1d61e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
53d19391edb2712c44f80cafc9dd5235

SHA1
183318ce46b4318108fc3d028b19c08cf612b976

SHA256
23934dd45d4ccd68b9fcfdd69156590c97485dc6a5c15e74a710a58961cbf27f

SHA512
93748b721beed225847dd8beed6b4da53e58c8d0b5b66a2aa88d8dc4bf8936314fef43593c8ffc53e7e7564221a8efccd4c4199c65e37f0da282b4868e61708f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
1fd8e1448ff3a4b7b494ed2cc86c843f

SHA1
ac60d0c981636f01db456956e6d853ac51311695

SHA256
4b354508d868c9d4d0764ba2e2f345ce9cfe2d8f0a3b96d74e6c2067a4246a03

SHA512
d8f166667d1713c1c236cb407937085fbcbd3dbdc22a9c4c5243a59cd349d5489294a7e1b299c13323439aa531275695bb6af61ef37a4746831d28303a514b14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fe26.TMP

Filesize
203B

MD5
6118aecaa6db1eb650ed767749a76909

SHA1
5018d39009692ec8f8493818a7476266843531fa

SHA256
a04c9d17f42520e5e19c504ed7f0eb7adeb3d4c8b611915e216eca99f45db54c

SHA512
955a450f943d5c47829d1c52ee800f76052db1fca592201a81a9a0032776c6255e3c2be32f95a58aac60579271061ce6d3fb19cda99cb9037b70cac4abbefbfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dd6c11aaad63acfd33785aa02d9177cc

SHA1
f74ebcd1a56c9a2906c917bd9f10918d63ef7b3e

SHA256
d7cbd230ae10429ce0246d4254adf894d6bb5943beeb5321e45a45be92fed7ff

SHA512
32d6f3cc03bcba84b0c11fc860df4ba35237fbcd4904abdee2e0f5cb45436a3b3218893bb9cef2a913bcd6d38780db14a394b50b6d9ef740968e003a1fed8dab

Download Submit