390c2d24f4fc450312458c242903de06cd2224ac1ccbde1713ef45b697c12f73

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2fc7ef71405a2e78b5161a015fb137e5_JaffaCakes118.html
Size

2KB
MD5

2fc7ef71405a2e78b5161a015fb137e5
SHA1

42ba74f61af3f7b25a44cffa4dc5e3baed485a3b
SHA256

390c2d24f4fc450312458c242903de06cd2224ac1ccbde1713ef45b697c12f73
SHA512

74d804548c15d35b2e79e82dddbdd848fb7415746da31204d97d800fd00a7342d00acb116fa768f4521ec6c4e45fa1de634776e7b578cc3a6506a203b771c8e0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
2168	msedge.exe
2168	msedge.exe
2620	identity_helper.exe
2620	identity_helper.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 960	2168	msedge.exe	82
PID 2168 wrote to memory of 960	2168	msedge.exe	82
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1132	2168	msedge.exe	83
PID 2168 wrote to memory of 1076	2168	msedge.exe	84
PID 2168 wrote to memory of 1076	2168	msedge.exe	84
PID 2168 wrote to memory of 5004	2168	msedge.exe	85
PID 2168 wrote to memory of 5004	2168	msedge.exe	85
PID 2168 wrote to memory of 5004	2168	msedge.exe	85
PID 2168 wrote to memory of 5004	2168	msedge.exe	85
PID 2168 wrote to memory of 5004	2168	msedge.exe	85
PID 2168 wrote to memory of 5004	2168	msedge.exe	85
PID 2168 wrote to memory of 5004	2168	msedge.exe	85
PID 2168 wrote to memory of 5004	2168	msedge.exe	85
PID 2168 wrote to memory of 5004	2168	msedge.exe	85
PID 2168 wrote to memory of 5004	2168	msedge.exe	85
PID 2168 wrote to memory of 5004	2168	msedge.exe	85
PID 2168 wrote to memory of 5004	2168	msedge.exe	85
PID 2168 wrote to memory of 5004	2168	msedge.exe	85
PID 2168 wrote to memory of 5004	2168	msedge.exe	85
PID 2168 wrote to memory of 5004	2168	msedge.exe	85
PID 2168 wrote to memory of 5004	2168	msedge.exe	85
PID 2168 wrote to memory of 5004	2168	msedge.exe	85
PID 2168 wrote to memory of 5004	2168	msedge.exe	85
PID 2168 wrote to memory of 5004	2168	msedge.exe	85
PID 2168 wrote to memory of 5004	2168	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2fc7ef71405a2e78b5161a015fb137e5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97d9546f8,0x7ff97d954708,0x7ff97d954718
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7366693890833289597,2588582737735121842,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,7366693890833289597,2588582737735121842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2512 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,7366693890833289597,2588582737735121842,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7366693890833289597,2588582737735121842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7366693890833289597,2588582737735121842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7366693890833289597,2588582737735121842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7366693890833289597,2588582737735121842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7366693890833289597,2588582737735121842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7366693890833289597,2588582737735121842,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7366693890833289597,2588582737735121842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7366693890833289597,2588582737735121842,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7366693890833289597,2588582737735121842,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2400 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
573B

MD5
fccfbf27cfb0ba12441baa029db2fc4d

SHA1
40131038182f62b3d4ec3e08d76db0f7eed39198

SHA256
7a3a291c9dfd7649954f8f177d48d15c5c94b25451f8d514989ca13a88957a31

SHA512
0f54eb2a9f9cf53f6e2222560526b115dd099233827496615ee6d242cd991eee3caf59aadf589f772e0da0d797c30bdf239acd03eece2b87fb20739d89def643

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
368bdfb3aa51a938b9ca0b86ef84aeb2

SHA1
b6b21150e6a98172959ec6b31f284b536a56f2b7

SHA256
eb0e1fed804e8293bd5063143c4e3d0c45c08a49bb20418bffced57853ded41f

SHA512
ec4cfe99486434ed9decdb93839d245a3b5481098cd354ea3f3d1911d2c2f3c1d6d206d6776f7a1a4e93bfbc5411dcc809567a1b35b752910a2472bbd2118192

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0886b295d29907d8f520e9a4f91e1157

SHA1
892d272c3312006783f4e193c7f9da332e3645d3

SHA256
596f29ddd8a2133446d22124b103a026db9a2790219656a1356cd9425ff780f2

SHA512
ac58755daf292e48c7813d64a4f7ca6f4cdf807b86c579a4eb6c486114a18aee50c37d36704adaa816eac381e5a9027ef0c13fee74c600720d9f31e57ddb3cf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
93f21237031fd3115cad61e74eafd7b2

SHA1
ea49e625a54edde4199ed74d947d4b82bdd8815d

SHA256
29ac8f1e3f249b09b9131f127ee082a3421bcc15fa1bd3ddfc4320980aad9499

SHA512
b4656d0706f07560d898612b2743276aa39fb019f7d6a374b2f7c494a0a6bc06aab7b87a00884312234fd7b53f96fd6174acc4140ecc862d5a0b1e1f7201b945

Download Submit