27224bbbb78311b2834b2382b1ed92879035553f172d2e5605fdfe4a76f1f87d

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 09:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2961cd60371f9d4df7e5176186e16d24_JaffaCakes118.html
Size

33KB
MD5

2961cd60371f9d4df7e5176186e16d24
SHA1

99f0e3de4c08862a6c050c82685f8ef612199790
SHA256

27224bbbb78311b2834b2382b1ed92879035553f172d2e5605fdfe4a76f1f87d
SHA512

03ec6082d522d4335ba11bcc2556019713de1f7b1fcd37fb7e22df239e763c7bda2806a6d56a45e28fd109e24019e903d79aa9f8aee6cbbcac77c793e717638b
SSDEEP

768:/s2lYtjDI/4xcN5q80qHka0JGwGJTj4BTsHlhFT9yhdNO4:FOONXGJGwGJTj4FsHl/kXN/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3220	msedge.exe
3220	msedge.exe
2264	msedge.exe
2264	msedge.exe
556	identity_helper.exe
556	identity_helper.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 1740	2264	msedge.exe	82
PID 2264 wrote to memory of 1740	2264	msedge.exe	82
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 1020	2264	msedge.exe	84
PID 2264 wrote to memory of 3220	2264	msedge.exe	85
PID 2264 wrote to memory of 3220	2264	msedge.exe	85
PID 2264 wrote to memory of 4380	2264	msedge.exe	86
PID 2264 wrote to memory of 4380	2264	msedge.exe	86
PID 2264 wrote to memory of 4380	2264	msedge.exe	86
PID 2264 wrote to memory of 4380	2264	msedge.exe	86
PID 2264 wrote to memory of 4380	2264	msedge.exe	86
PID 2264 wrote to memory of 4380	2264	msedge.exe	86
PID 2264 wrote to memory of 4380	2264	msedge.exe	86
PID 2264 wrote to memory of 4380	2264	msedge.exe	86
PID 2264 wrote to memory of 4380	2264	msedge.exe	86
PID 2264 wrote to memory of 4380	2264	msedge.exe	86
PID 2264 wrote to memory of 4380	2264	msedge.exe	86
PID 2264 wrote to memory of 4380	2264	msedge.exe	86
PID 2264 wrote to memory of 4380	2264	msedge.exe	86
PID 2264 wrote to memory of 4380	2264	msedge.exe	86
PID 2264 wrote to memory of 4380	2264	msedge.exe	86
PID 2264 wrote to memory of 4380	2264	msedge.exe	86
PID 2264 wrote to memory of 4380	2264	msedge.exe	86
PID 2264 wrote to memory of 4380	2264	msedge.exe	86
PID 2264 wrote to memory of 4380	2264	msedge.exe	86
PID 2264 wrote to memory of 4380	2264	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2961cd60371f9d4df7e5176186e16d24_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9272c46f8,0x7ff9272c4708,0x7ff9272c4718
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,12452109647365312398,6969464379526142153,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,12452109647365312398,6969464379526142153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,12452109647365312398,6969464379526142153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12452109647365312398,6969464379526142153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12452109647365312398,6969464379526142153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12452109647365312398,6969464379526142153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12452109647365312398,6969464379526142153,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,12452109647365312398,6969464379526142153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,12452109647365312398,6969464379526142153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12452109647365312398,6969464379526142153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12452109647365312398,6969464379526142153,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,12452109647365312398,6969464379526142153,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
32KB

MD5
f48baec69cc4dc0852d118259eff2d56

SHA1
e64c6e4423421da5b35700154810cb67160bc32b

SHA256
463d99ca5448f815a05b2d946ddae9eed3e21c335c0f4cfe7a16944e3512f76c

SHA512
06fdccb5d9536ab7c68355dbf49ac02ebccad5a4ea01cb62200fd67728a6d05c276403e588a5bdceacf5e671913fc65b63e8b92456ca5493dae5b5a70e4a8b37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
189B

MD5
443319881835b14fda88caab9945e84c

SHA1
adb420bd20774e8eabc4d3d53ecfccb20ae7cb54

SHA256
fd79d0831e92ccbffc20eed3a0d07b39a121b4f3be4f720d2981fdd2e7b5b8da

SHA512
39c2c7fd638c04ce244473831d3dc8175e8e9ecb9a0df38370300233202d7d7fa9166912b8d97b34efd7b90eab6da376191e1c5c9ce253e96c9686b886ab29fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c0826907bcbec97b893f083c9f630d14

SHA1
078bf30be285b4c7c7ee2a48957478f91fb6e7c8

SHA256
396a9b28ae948fcdd9d92d20971861d32bef45cf74f41815f6dee89252489c66

SHA512
99c4fd79ed110889fbc419a169c9656fa346ded5b06e2421204f2196ccb0f0279f1ea886fed89730ecd41456f116cbed8237f3ecc18f46ec8a0c60ebf238d688

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2c644d4e3e97425ef0bcfebd8b586474

SHA1
dfe179c05c18271a1f00db4c40c6d32f68141154

SHA256
7cb47adab83514ca70eb48700dda9a083f5bd4df33f01fe4651bd19714ae53b2

SHA512
8bac569aea8773aacb8cb1d4eec27cb11d2f5c26ee2c63047d2f9bbb7e85c021a1d288a3c0200395382031334f97600932246144c0a972f22ac983aabb922306

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1bfe5a896f01501374c4002f482f9e04

SHA1
4bd8fe60d1b89205fcc5846051d907f473516167

SHA256
7cb64ab02f07b3137af3781a4c59c6801192071ea8005c442a84b490f547e865

SHA512
0c347fc4a46584d9be6acb6f8ec4f32179b3794421d341c8f878d32fcd891ad98852c417f364e308ffb9a5858b69bb3fc5a1df799fed5520753bca9b15333b1e

Download Submit