eb26e83a344d0e73bd0e47bc1c46d621a5e0c97f1c6c07778d15d0ea959d81f9

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 14:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2a68481eb65fff0e34549a45fa5981ee_JaffaCakes118.html
Size

160KB
MD5

2a68481eb65fff0e34549a45fa5981ee
SHA1

537a4f3c7edba8d8ee57024f9ce81e5691fc61d4
SHA256

eb26e83a344d0e73bd0e47bc1c46d621a5e0c97f1c6c07778d15d0ea959d81f9
SHA512

557bd8f002968f7192f011a8da01e2d2173bb419962ebe9d12e6b8fddf5b936025e04e907841afbdf4ad0dce26a5275b955357ea0ae9d52e7af74ba26b715adc
SSDEEP

1536:SiqJ0vG77LRkr6MaP2nK0b0Ftx0S0cz0Y0a4Ai0qeyLi+rffMxqNisaQx4V5roEi:SiOireyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
2784	msedge.exe
2784	msedge.exe
1264	identity_helper.exe
1264	identity_helper.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 1212	2784	msedge.exe	82
PID 2784 wrote to memory of 1212	2784	msedge.exe	82
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 2684	2784	msedge.exe	84
PID 2784 wrote to memory of 4996	2784	msedge.exe	85
PID 2784 wrote to memory of 4996	2784	msedge.exe	85
PID 2784 wrote to memory of 3196	2784	msedge.exe	86
PID 2784 wrote to memory of 3196	2784	msedge.exe	86
PID 2784 wrote to memory of 3196	2784	msedge.exe	86
PID 2784 wrote to memory of 3196	2784	msedge.exe	86
PID 2784 wrote to memory of 3196	2784	msedge.exe	86
PID 2784 wrote to memory of 3196	2784	msedge.exe	86
PID 2784 wrote to memory of 3196	2784	msedge.exe	86
PID 2784 wrote to memory of 3196	2784	msedge.exe	86
PID 2784 wrote to memory of 3196	2784	msedge.exe	86
PID 2784 wrote to memory of 3196	2784	msedge.exe	86
PID 2784 wrote to memory of 3196	2784	msedge.exe	86
PID 2784 wrote to memory of 3196	2784	msedge.exe	86
PID 2784 wrote to memory of 3196	2784	msedge.exe	86
PID 2784 wrote to memory of 3196	2784	msedge.exe	86
PID 2784 wrote to memory of 3196	2784	msedge.exe	86
PID 2784 wrote to memory of 3196	2784	msedge.exe	86
PID 2784 wrote to memory of 3196	2784	msedge.exe	86
PID 2784 wrote to memory of 3196	2784	msedge.exe	86
PID 2784 wrote to memory of 3196	2784	msedge.exe	86
PID 2784 wrote to memory of 3196	2784	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2a68481eb65fff0e34549a45fa5981ee_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffd625046f8,0x7ffd62504708,0x7ffd62504718
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,17061546303871044795,6929488144383802266,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,17061546303871044795,6929488144383802266,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,17061546303871044795,6929488144383802266,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,17061546303871044795,6929488144383802266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,17061546303871044795,6929488144383802266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,17061546303871044795,6929488144383802266,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,17061546303871044795,6929488144383802266,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,17061546303871044795,6929488144383802266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,17061546303871044795,6929488144383802266,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,17061546303871044795,6929488144383802266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,17061546303871044795,6929488144383802266,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,17061546303871044795,6929488144383802266,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5436 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
086792f49385064e74b8a4034b44e815

SHA1
0373388a56939301a81459aea43b98a3307c9faf

SHA256
391044b379d4e4c2daf4ad386f8248b8ac5ddad7f24c35510fcf6d84cb7748d0

SHA512
794f0800e34b6a8ed5423b24e7a030d656fa3a34efd9be3d5574ca12457236f6d7681b2d043a64958a77c847e977c3f00e90eae8ea4d2aaf1ed5d26a8f08b744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d81120441ec886d4dff4ec0c12b115e0

SHA1
1cd2349da0ca59cc69589d70cc42a52325ce5b31

SHA256
07a17684272d8a9622cec22be02494392b105bb7567f457bd005f4a46afc9e3a

SHA512
d7d04c9bc50c7a6cc5eae7c7b2da09a3269f47a09c65de3642072692c6addf45af3934ff84b3ed1c38874356679ed9326f3ff18c08b2df2f0d7ae65bd4c49c95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3123314d3f9eb4d5fd6eddbb77f14ef6

SHA1
1e0e7f7fbb669da2dc42deeed2b31d53e1a281e0

SHA256
02886c0d828aec74e8d1857dcb29afa888a30b4c876457d95ba2ebee2a8b6bcf

SHA512
9e89f52ddc3985ae5cfeb4b66a5ae72745317e102279b45db9f1314926bcec74100f9c37eb972d17528ae6e5fab064ba0bf6713997e9c369440258d9aa7dc18f

Download Submit