1ceff4501e635397846ef1a55a19c13bf67f73f3fb7220af24918430e429cfec

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2965b0219a3d4f5d282ff807051b86b4_JaffaCakes118.html
Size

4KB
MD5

2965b0219a3d4f5d282ff807051b86b4
SHA1

4767a7a34bbba4170e71236c35b6e86695cfbcdf
SHA256

1ceff4501e635397846ef1a55a19c13bf67f73f3fb7220af24918430e429cfec
SHA512

25b310fa770125f899f0f35935eecc7d522b01e523530b48be495ffb7493a13589a3329566d0d4dfdc92500593f4d55f8a480653dd5e1f7c98736a765fb3f6d7
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o2R0kDYM:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDZ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe
2388	msedge.exe
2388	msedge.exe
3836	identity_helper.exe
3836	identity_helper.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 4320	2388	msedge.exe	81
PID 2388 wrote to memory of 4320	2388	msedge.exe	81
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4068	2388	msedge.exe	83
PID 2388 wrote to memory of 4084	2388	msedge.exe	84
PID 2388 wrote to memory of 4084	2388	msedge.exe	84
PID 2388 wrote to memory of 4400	2388	msedge.exe	85
PID 2388 wrote to memory of 4400	2388	msedge.exe	85
PID 2388 wrote to memory of 4400	2388	msedge.exe	85
PID 2388 wrote to memory of 4400	2388	msedge.exe	85
PID 2388 wrote to memory of 4400	2388	msedge.exe	85
PID 2388 wrote to memory of 4400	2388	msedge.exe	85
PID 2388 wrote to memory of 4400	2388	msedge.exe	85
PID 2388 wrote to memory of 4400	2388	msedge.exe	85
PID 2388 wrote to memory of 4400	2388	msedge.exe	85
PID 2388 wrote to memory of 4400	2388	msedge.exe	85
PID 2388 wrote to memory of 4400	2388	msedge.exe	85
PID 2388 wrote to memory of 4400	2388	msedge.exe	85
PID 2388 wrote to memory of 4400	2388	msedge.exe	85
PID 2388 wrote to memory of 4400	2388	msedge.exe	85
PID 2388 wrote to memory of 4400	2388	msedge.exe	85
PID 2388 wrote to memory of 4400	2388	msedge.exe	85
PID 2388 wrote to memory of 4400	2388	msedge.exe	85
PID 2388 wrote to memory of 4400	2388	msedge.exe	85
PID 2388 wrote to memory of 4400	2388	msedge.exe	85
PID 2388 wrote to memory of 4400	2388	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2965b0219a3d4f5d282ff807051b86b4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff810c446f8,0x7ff810c44708,0x7ff810c44718
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,12156100069071963999,6097922573746316009,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,12156100069071963999,6097922573746316009,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,12156100069071963999,6097922573746316009,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,12156100069071963999,6097922573746316009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,12156100069071963999,6097922573746316009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,12156100069071963999,6097922573746316009,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,12156100069071963999,6097922573746316009,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,12156100069071963999,6097922573746316009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,12156100069071963999,6097922573746316009,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,12156100069071963999,6097922573746316009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,12156100069071963999,6097922573746316009,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,12156100069071963999,6097922573746316009,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
292B

MD5
eceec87e22bb7532aa5d6db132e4c35f

SHA1
dc06553223617e8feed14651b399930dfe74b7f6

SHA256
e436bd7fc58262494dea7fe1b7d41e25066f89662fdb44e217fc6ff095c2bae7

SHA512
9ba5548954e30742e58b5d5a4328d337e23ac65e0b7b1ab911f6dbb58395c0ed85d33b4fb681b41811a717773c24d5b15a4a3845cb36b66c004bf8160f80a259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3305587de629209b7a1da881d2d060c0

SHA1
40b2fb1582196bf98f9782c5dcf2140397cd704e

SHA256
04a48408ce6e4476667922001d7cb766c8dd6854a4c3e10082652ceb2042bf10

SHA512
9eeebac00ae66655defd20eacd574b5785de6572d8cb7dc5764581072437d092f282e6397b6fdf12d997592151df179a649ba9c6624dc6be4941c3e46479b57d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0b3eddd9257d10990fb76395065d012d

SHA1
e882931a04c9028c09a5fdc9a7477963e959ce4d

SHA256
dcbe458d90492357855a17a4f6d694f2c668b6bd55dd6ca7ca834c667dfc8382

SHA512
30b263343cea4ced91aec1d09fc53b888305034ee236a98aba08be1599759f2cd9dc9d93801674f85edc3f39ca5b761c5de2917fbb3e2d86d627bed5d48b32c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7e555aa173814586d9c8c29e281266f4

SHA1
14475d27f1e7db8a59f03b94376842e7e0ef0a87

SHA256
750377351f7a52967f19959efff142fc9bba4db84cbf795bb9fb6d0756798a75

SHA512
400193d24e130546a6072148ddbf79449dbe532c33b898d66a48f7f6d8240116a9a8d9834e2f5117214206c274ce000f42ef24207217ea92351fe9dc8d16c526

Download Submit