861e1bb15f23a93bd6c1801e2d81ed56a11ae49393e8bad5fdf6d142b9aecadd

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 18:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

306952a0be6fb92d606630a22d3eeac0_JaffaCakes118.html
Size

4KB
MD5

306952a0be6fb92d606630a22d3eeac0
SHA1

bbff0196dce022beca0e60f4ccc16f448dfa5090
SHA256

861e1bb15f23a93bd6c1801e2d81ed56a11ae49393e8bad5fdf6d142b9aecadd
SHA512

0971dc5838f14f7f992db5c525473680a7b628e6e5fae666175653b4928febdf83a27a78064914155ba232539359a8d89c3cc3626988ab35dc4ece66647c18cf
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oTT0SPkp:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDx

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1116	msedge.exe
1116	msedge.exe
532	msedge.exe
532	msedge.exe
2996	identity_helper.exe
2996	identity_helper.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 3552	532	msedge.exe	83
PID 532 wrote to memory of 3552	532	msedge.exe	83
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 3084	532	msedge.exe	84
PID 532 wrote to memory of 1116	532	msedge.exe	85
PID 532 wrote to memory of 1116	532	msedge.exe	85
PID 532 wrote to memory of 2672	532	msedge.exe	86
PID 532 wrote to memory of 2672	532	msedge.exe	86
PID 532 wrote to memory of 2672	532	msedge.exe	86
PID 532 wrote to memory of 2672	532	msedge.exe	86
PID 532 wrote to memory of 2672	532	msedge.exe	86
PID 532 wrote to memory of 2672	532	msedge.exe	86
PID 532 wrote to memory of 2672	532	msedge.exe	86
PID 532 wrote to memory of 2672	532	msedge.exe	86
PID 532 wrote to memory of 2672	532	msedge.exe	86
PID 532 wrote to memory of 2672	532	msedge.exe	86
PID 532 wrote to memory of 2672	532	msedge.exe	86
PID 532 wrote to memory of 2672	532	msedge.exe	86
PID 532 wrote to memory of 2672	532	msedge.exe	86
PID 532 wrote to memory of 2672	532	msedge.exe	86
PID 532 wrote to memory of 2672	532	msedge.exe	86
PID 532 wrote to memory of 2672	532	msedge.exe	86
PID 532 wrote to memory of 2672	532	msedge.exe	86
PID 532 wrote to memory of 2672	532	msedge.exe	86
PID 532 wrote to memory of 2672	532	msedge.exe	86
PID 532 wrote to memory of 2672	532	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\306952a0be6fb92d606630a22d3eeac0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce95446f8,0x7ffce9544708,0x7ffce9544718
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,17535575285634993685,594601179847498423,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,17535575285634993685,594601179847498423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,17535575285634993685,594601179847498423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17535575285634993685,594601179847498423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17535575285634993685,594601179847498423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,17535575285634993685,594601179847498423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,17535575285634993685,594601179847498423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17535575285634993685,594601179847498423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17535575285634993685,594601179847498423,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17535575285634993685,594601179847498423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17535575285634993685,594601179847498423,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,17535575285634993685,594601179847498423,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
292B

MD5
7e0935224dcc4b6f41633e792f3a7bc4

SHA1
e1d0816b7a3658e00a41e8bde65682fadf0476a9

SHA256
ced5a79b91b0971de39f6413e664d14ff371806f53408c91d7a41b6a613a37c2

SHA512
2efb6c582f96dec7ff6d675b5f17037abaaa00edb44eb0a51a3c98bba3a74649e1a931ac3c5ec39f9f10e2c83d5f04ec6d238e30004dbc8316a7ad69d98bc6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
76cf5852043d4c41db2af7474ee54524

SHA1
29c64a848e25bd6bb8b44d7fabcf0b840a935b6d

SHA256
b305b37fda067f2450d4f1d7b49debc42f046bf76de96b50bea0e5e65ea058b6

SHA512
be4eec2a47cf0357d88b4610ff9048960d738600cb5163f660faff16be6d9ebf95642ae415230569d147a990f4bd7b5f6b5aa9ff46564fd7b53b829e5d79a2c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fa98a65b99a2cd8e1c2fec34062f09c8

SHA1
ca634c8b0363e1096f7e4f95f8131ab95963d502

SHA256
0034858b4e7b3ec0e6e79dce8f62c8243203334af79d2ec54eadf0a466a2ab1a

SHA512
273d313bdfc95c57996a4f77a5545961f1c4cb39ee78c46ec713193f26eb6fb339904e71ece3ef9339469ca6995c20000b0b4fbfc0313969f786cb84729fc502

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a9555b9eb09356e476161389bde2fef9

SHA1
3e14ca148f12fc293a3d17017600eb0ad51aa0f5

SHA256
af1436b42a57c1c80be60d142f63693d2491cf5442a6226d04fd4100a1a6c6ef

SHA512
dd9dfd7cc5cf50d9cd3cfcfa0827352b17d8b25f12ae4dd5209257cbd91462c2336c799eccf50290e850a7e770b2ba13b653c057523540833e4922920546fd9d

Download Submit