f7690f184f2b1fcfbc313f3eecf5300255a1adfbeb40ec61a5705dbc11d55e9c

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 05:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2da87f3c53053bf32bb974e8714c7390_JaffaCakes118.html
Size

36KB
MD5

2da87f3c53053bf32bb974e8714c7390
SHA1

e622ba3693d710377fbef2152342f6f1347d5e01
SHA256

f7690f184f2b1fcfbc313f3eecf5300255a1adfbeb40ec61a5705dbc11d55e9c
SHA512

ed4054b61fd6252bed1ea3798b6da6f507030bd157841b0a6b9c1efd06650906ade996f561a5ef2fe5afb02c0b54fb170daecb053a21191709e9416d455514ce
SSDEEP

768:zwx/MDTHBZ88hARgZPXfE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TdZOT6f9U56lLRF:Q/nbJxNVAufSW/e8fK

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3508	msedge.exe
3508	msedge.exe
2192	msedge.exe
2192	msedge.exe
4584	identity_helper.exe
4584	identity_helper.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 3156	2192	msedge.exe	83
PID 2192 wrote to memory of 3156	2192	msedge.exe	83
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 1280	2192	msedge.exe	84
PID 2192 wrote to memory of 3508	2192	msedge.exe	85
PID 2192 wrote to memory of 3508	2192	msedge.exe	85
PID 2192 wrote to memory of 4336	2192	msedge.exe	86
PID 2192 wrote to memory of 4336	2192	msedge.exe	86
PID 2192 wrote to memory of 4336	2192	msedge.exe	86
PID 2192 wrote to memory of 4336	2192	msedge.exe	86
PID 2192 wrote to memory of 4336	2192	msedge.exe	86
PID 2192 wrote to memory of 4336	2192	msedge.exe	86
PID 2192 wrote to memory of 4336	2192	msedge.exe	86
PID 2192 wrote to memory of 4336	2192	msedge.exe	86
PID 2192 wrote to memory of 4336	2192	msedge.exe	86
PID 2192 wrote to memory of 4336	2192	msedge.exe	86
PID 2192 wrote to memory of 4336	2192	msedge.exe	86
PID 2192 wrote to memory of 4336	2192	msedge.exe	86
PID 2192 wrote to memory of 4336	2192	msedge.exe	86
PID 2192 wrote to memory of 4336	2192	msedge.exe	86
PID 2192 wrote to memory of 4336	2192	msedge.exe	86
PID 2192 wrote to memory of 4336	2192	msedge.exe	86
PID 2192 wrote to memory of 4336	2192	msedge.exe	86
PID 2192 wrote to memory of 4336	2192	msedge.exe	86
PID 2192 wrote to memory of 4336	2192	msedge.exe	86
PID 2192 wrote to memory of 4336	2192	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2da87f3c53053bf32bb974e8714c7390_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffadc0a46f8,0x7ffadc0a4708,0x7ffadc0a4718
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,18307782650205710628,10135221612762327892,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,18307782650205710628,10135221612762327892,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,18307782650205710628,10135221612762327892,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,18307782650205710628,10135221612762327892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,18307782650205710628,10135221612762327892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,18307782650205710628,10135221612762327892,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,18307782650205710628,10135221612762327892,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,18307782650205710628,10135221612762327892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,18307782650205710628,10135221612762327892,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,18307782650205710628,10135221612762327892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,18307782650205710628,10135221612762327892,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,18307782650205710628,10135221612762327892,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5056 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
614B

MD5
e7034374542371947c8800ef70da8bbf

SHA1
23e652c07b9e6eaca708ba0aa62c20489fd66354

SHA256
c85212a8514108a8d542b1035dbc444bd9bca2fc8bc810cf44d46c84cc2ddca7

SHA512
9c6ae444759944df9fca7e6c67415c79c2077fa512efb651491593313998b4b2a221ae393327975a6e2f74e34b4509e6bc7daec87a9e9b6a8061397bf7f55c66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
620703bd92c4207914ffb8e67e06fe3d

SHA1
cb6a117aa3f19f1a65dafa7c691b5bbb36f1e2c3

SHA256
51283673f17eda7682b07ae4bfe3f15d08f0d74ef3f7b9c3a17466e7928853cd

SHA512
fe003f1f9820b02bae9c98a023f8231ffe0b72eecc662c1df40bda193194409adc6a763bae66aa52fd4a0480220e77748c26d6ee220d217b86dd8df024bf91fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3fb6197ce36a376cc82f1a1f5fb84720

SHA1
9520ad3eb048c1a1d87d2c11b13d8a57102925fa

SHA256
d910b2276e65cc4fe6e153386fbde4a50d7f2863d794abecdd2fb7a831a760ad

SHA512
348c8b4e8a164b9ba6fdc4f6b0a47dc3c0208451042459f230ef38476e34cd8b259b3b93cf250e4cf3363b211ab8d2b977ff3d906bdc112c24cab6151be6d3a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
53221f173007ca83a3106df78f78f135

SHA1
73245f0981c44947d4788c3e050c3a308d2cc9f4

SHA256
8a76649dee7afc8555ff22b69e81d978aae70b037dccb4ed78287f1089d520ab

SHA512
1721e99c3159470b1cd5d005d2700c53f37cef0f97331cd522a31a9a71b4db706fc1e968508f2b86e524226182d72c9b66f5b50d0a9d90a690fb46dc18f200e6

Download Submit