09834a5c6496c1f6ec5d4bd54d60302c4ed182da8d829907dd7df6b4a682edbd

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 09:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e7240befb937fa1d155a576bd3cf707_JaffaCakes118.html
Size

92KB
MD5

2e7240befb937fa1d155a576bd3cf707
SHA1

d6594d10edbf19e7f7e9579dba21618b0630bf7a
SHA256

09834a5c6496c1f6ec5d4bd54d60302c4ed182da8d829907dd7df6b4a682edbd
SHA512

2415fdd0b75ffef358e325c04de2dbb1654606876c3e123099b13bf0a6e17d489e73d73396f89d66c7ca9cb0974145cbcb4420dbd0269fa8b7ffe664807f7ecb
SSDEEP

1536:S6GHoj065xfLeJSrSjIxxcg5ogV5g4xXntpgiLHVbwqQKr9aDE5RzJNWADH9Ypmg:3O8xfLeJSrSSvJCq4E5R9NWAH9QmR3fm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1337824034-2731376981-3755436523-1000\{A5E83904-FA3E-4F98-87F0-4C448C34F391}	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
888	msedge.exe
888	msedge.exe
2200	msedge.exe
2200	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
888	msedge.exe
888	msedge.exe
888	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 888 wrote to memory of 216	888	msedge.exe	83
PID 888 wrote to memory of 216	888	msedge.exe	83
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 3436	888	msedge.exe	84
PID 888 wrote to memory of 1528	888	msedge.exe	85
PID 888 wrote to memory of 1528	888	msedge.exe	85
PID 888 wrote to memory of 4064	888	msedge.exe	86
PID 888 wrote to memory of 4064	888	msedge.exe	86
PID 888 wrote to memory of 4064	888	msedge.exe	86
PID 888 wrote to memory of 4064	888	msedge.exe	86
PID 888 wrote to memory of 4064	888	msedge.exe	86
PID 888 wrote to memory of 4064	888	msedge.exe	86
PID 888 wrote to memory of 4064	888	msedge.exe	86
PID 888 wrote to memory of 4064	888	msedge.exe	86
PID 888 wrote to memory of 4064	888	msedge.exe	86
PID 888 wrote to memory of 4064	888	msedge.exe	86
PID 888 wrote to memory of 4064	888	msedge.exe	86
PID 888 wrote to memory of 4064	888	msedge.exe	86
PID 888 wrote to memory of 4064	888	msedge.exe	86
PID 888 wrote to memory of 4064	888	msedge.exe	86
PID 888 wrote to memory of 4064	888	msedge.exe	86
PID 888 wrote to memory of 4064	888	msedge.exe	86
PID 888 wrote to memory of 4064	888	msedge.exe	86
PID 888 wrote to memory of 4064	888	msedge.exe	86
PID 888 wrote to memory of 4064	888	msedge.exe	86
PID 888 wrote to memory of 4064	888	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2e7240befb937fa1d155a576bd3cf707_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5c0e46f8,0x7ffa5c0e4708,0x7ffa5c0e4718
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,1176041416500984984,10360454362812903753,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,1176041416500984984,10360454362812903753,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,1176041416500984984,10360454362812903753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,1176041416500984984,10360454362812903753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,1176041416500984984,10360454362812903753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,1176041416500984984,10360454362812903753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2012,1176041416500984984,10360454362812903753,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2012,1176041416500984984,10360454362812903753,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,1176041416500984984,10360454362812903753,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
32ea8e665f30e132bff9d454517e48e9

SHA1
a7601e7ad5d0a83235c13855f924f02b680b72cd

SHA256
6f17ddb7518d65943902f94f29c57447881744fa75d44b3a60a7a82b5f915d8d

SHA512
5b14cc099bc8afeb68fcb8874ed2ebeab6e3fdc6807796bc0192f23db2fbaadf0ce8dced0722dea50dcad62b5916d0c9d9d28c29886b17171a6970e2846cef8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
940B

MD5
b4f52bc55f0f766e6c43f9117459a94a

SHA1
2d8289964224e89abf5d3c13d8498d11e172f239

SHA256
a3eb99b543de06950878175bc1a62ad7a435d1101af2040cd3a8fb4b3b39476c

SHA512
872537ba3a64f249ef62abed1f14a343f8d91319743697c86492e87543fe1b907020f58115235a8c30e473a38263438eeb6f63228895c384ece2db360192f159

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3420fe4933565bab065022dd687d0f78

SHA1
7a402d2d22cbfbe067fbfaea6c540279371fa258

SHA256
51eb015c175922a8f6f34c569529a31ef3d1431e065c8dc08ea4af11410db4f8

SHA512
d4835d336378029b9f60bece6866fce4512eeb0d332e14ecd575dcbed5cfe0cf7ad07b0cd0609c23d47a51fb28af5c90a06d866dc3c9de05e9dfa2829e1f6086

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d84a35a5b79239e64aedf2abf8a33db5

SHA1
89b578385908cf8d3ed975aff1ff5f9b62427b0d

SHA256
bba70b95246cb88b7cd616fe397029dd6e6a2c9c5e58abd3445bca10204ea251

SHA512
677c719c44bfbcc30a14deaa03f7eef176ba8005ae7a2776055ad5d65ec96461db9cb601f3c314b02c89264e8f545e8b22cdd90b7db09f3bd172b84102e29603

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0fdb8f2b93a5de09cd1dabf070feee88

SHA1
07279be95ea548027b9e90c0ce4402a3ce1a5388

SHA256
6b1af17921e67d7fff595049ae4b68fd0b004bba0022a5a41d53a93db464fc34

SHA512
99e9e83f9d5dfd1f9c932c5f533193389eb8603af1976efcbba19ad2e592fc3282fde1859a7882ec337b2ce95c3caa5275b156fe32216387fdc41b30f03b7ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e216cbe180f569d45dcc68a9fadac0a2

SHA1
e5303bb94039cba834bb52c34d57c23156b26c06

SHA256
16bee873f077d3ebae5601ad31a42c916b1d838ea4b19137314f81a7710d7d17

SHA512
41f3de1e432b07618aab233716c70565e2f61961bf165885d98b8011c6f5b0ed0d372e43667094c4e60e955d4db96089a09657654c527ea3ef50ca164bb53c8e

Download Submit