8629e7569fec7edb043b3cf7a0ddc899bafb087b3785936a17f9525c6c840d74

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 05:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d9e942b01b69e7b64ee8c165af859bc_JaffaCakes118.html
Size

208KB
MD5

2d9e942b01b69e7b64ee8c165af859bc
SHA1

c2fac51ad917964635d097b9d1a3af92adbfd761
SHA256

8629e7569fec7edb043b3cf7a0ddc899bafb087b3785936a17f9525c6c840d74
SHA512

fb22a954a9c18af43ca5e3cd691100aecade12a50b65f2e0a9b3cb4818ca0a43eef43ceba0f31c6bbb3d7086a8e2da75b7c670c0156cad55f9a1dc164edde525
SSDEEP

3072:Xzq72pcrX6n1sOXr1F5bdppBxYkwijTATWBC4K:7NC4K

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3176	msedge.exe
3176	msedge.exe
2436	msedge.exe
2436	msedge.exe
4768	identity_helper.exe
4768	identity_helper.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 1636	2436	msedge.exe	82
PID 2436 wrote to memory of 1636	2436	msedge.exe	82
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 4228	2436	msedge.exe	83
PID 2436 wrote to memory of 3176	2436	msedge.exe	84
PID 2436 wrote to memory of 3176	2436	msedge.exe	84
PID 2436 wrote to memory of 2180	2436	msedge.exe	85
PID 2436 wrote to memory of 2180	2436	msedge.exe	85
PID 2436 wrote to memory of 2180	2436	msedge.exe	85
PID 2436 wrote to memory of 2180	2436	msedge.exe	85
PID 2436 wrote to memory of 2180	2436	msedge.exe	85
PID 2436 wrote to memory of 2180	2436	msedge.exe	85
PID 2436 wrote to memory of 2180	2436	msedge.exe	85
PID 2436 wrote to memory of 2180	2436	msedge.exe	85
PID 2436 wrote to memory of 2180	2436	msedge.exe	85
PID 2436 wrote to memory of 2180	2436	msedge.exe	85
PID 2436 wrote to memory of 2180	2436	msedge.exe	85
PID 2436 wrote to memory of 2180	2436	msedge.exe	85
PID 2436 wrote to memory of 2180	2436	msedge.exe	85
PID 2436 wrote to memory of 2180	2436	msedge.exe	85
PID 2436 wrote to memory of 2180	2436	msedge.exe	85
PID 2436 wrote to memory of 2180	2436	msedge.exe	85
PID 2436 wrote to memory of 2180	2436	msedge.exe	85
PID 2436 wrote to memory of 2180	2436	msedge.exe	85
PID 2436 wrote to memory of 2180	2436	msedge.exe	85
PID 2436 wrote to memory of 2180	2436	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2d9e942b01b69e7b64ee8c165af859bc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbbb1b46f8,0x7ffbbb1b4708,0x7ffbbb1b4718
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,3655890016597891413,8766060744554195129,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,3655890016597891413,8766060744554195129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,3655890016597891413,8766060744554195129,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3655890016597891413,8766060744554195129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3655890016597891413,8766060744554195129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,3655890016597891413,8766060744554195129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,3655890016597891413,8766060744554195129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3655890016597891413,8766060744554195129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3655890016597891413,8766060744554195129,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3655890016597891413,8766060744554195129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3655890016597891413,8766060744554195129,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,3655890016597891413,8766060744554195129,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
763B

MD5
639a0a5dccae809931b61db24bb99fb6

SHA1
04f8e5c21758d81bab0af6c33065c004939bfc45

SHA256
aed087c50b21ffdd8e1f599a5d02c2aa8003c4ffb5aa256323822adafd763241

SHA512
820345a0a93921b6b1d8e4e28322f476a80fbf3f962966006804e8340203f0a2994c46296984b159efe172e86ad99f64844a9bca51160aac80faf77ee7807329

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b29728043d166b6ee437815ba85221d4

SHA1
49cb2c1278f1b2f01214ec25643995c784b25b3a

SHA256
e22ff5a24be07da01018e9db9b2defd7482d15a0ae53e05137bd612271341837

SHA512
d0e636bee1ddd674b59b4ce465b7627cdb26fc8785b9fbb74c65a3c011d4132ecc297d2f021c3fba7d692fad752a657c08e4744cf47b41e777e36d03aa3019c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
acd5d2a4012fd25c176cd8de3b867a93

SHA1
9804825fdaa8942a0cbe4eaa47c7c27a2b995b72

SHA256
0ad38124df6de4bb3e6ba5b1cfb11bb8be17bbcf6be5b65925c220995169e69e

SHA512
11d940b944d537762252a04a7e557b1eebdffda899c7374318aa6cf1d93e5fe50594cd98bfa4c229fc43bca5c65a98254efe00758bf1e99ee4d90f18b6c2de18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6299d22d3bdbccdfac32372e6aa9f535

SHA1
05925a1e1c76d059cf5ccbcb32655e8c4e196d51

SHA256
108f261886bf219720157f4b8109808e8798800ff2a4a6373146da4896925bb5

SHA512
15e1b7e7591eeb36be770c47f9bbadc7050d09a65f83397f7b9159bcb01911dd755f45406369f88f2c3941ef6aefb0737dbec69affd96771bb6497697676da04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
ca7c924d11fc332ced5230b2f046ffd1

SHA1
ebfba1f2c636b5ca5338e3dc8f818a62c4f57b77

SHA256
a0cab64251d1c60ec8a75380e6e4fcff11efa94bbfe307119d312fc26de59900

SHA512
048507a2db5f32fa975ac4ab26b7f7ad2cdaa741272a9b6ee2543b32559b715b04173079330cc8c78a09462291f03a9181c40803913182a2bdb352a18449b26f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58657b.TMP

Filesize
369B

MD5
c8fb202c71b00b07f08d9042ce59d0c8

SHA1
84e64d1265d88c1ff17dd8c21255e28827493cdd

SHA256
62c2b908967ee1b6adaacac9c3768d772cce7524dd854a0baf5a0578796c4102

SHA512
cde833fe2b86ce7b131fceffa46cafc28aac75f0f78e3f660cd4b787e6cd70bd46a19aa6c952cf6d2745a11a4407560ffb5c50fdeca86539f75b3f820f587e9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a63aaa6d7b00b6ae5e4e1559578e6039

SHA1
1acdfc2ee3b2dca6f3632e222df58fe7bd1a35db

SHA256
d847b9abc35a528cabb8211fd00a9a1798f8e1e14095a37df07daf7e43ada9b0

SHA512
600993a344a8d881861ccccf7cef88f282d6d185296a18ee46a654d30b25231f687168acfad7e3c961731679ac557ce929ff2eda7a1afa9bcefb41db8d5500a2

Download Submit