9a7319b450949c18f558d2090aaa566f359c998d07ec0d3f46b575f676c8ae31

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35cd0fcd257e14765d481e8c243c9d2f_JaffaCakes118.html
Size

34KB
MD5

35cd0fcd257e14765d481e8c243c9d2f
SHA1

bf53c9dc2d0b7d124e1a3405250091a1dbcfa99f
SHA256

9a7319b450949c18f558d2090aaa566f359c998d07ec0d3f46b575f676c8ae31
SHA512

45c92d1199132daf33c25f92aae312dc547db715f7c7e3ea7e2fc5d52b972e737eff514e80f91e5fb84432ebe63830d75530951e09b2fb8f5f6f6be621206d4d
SSDEEP

768:/tZOp1jDI/FWcHG56/PANwa/hkmSwG6Tj4BTsHM05TyDihPYOO:jOoHGGshkmSwG6Tj4FsHMglNYF

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
2116	msedge.exe
2116	msedge.exe
2592	identity_helper.exe
2592	identity_helper.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 3436	2116	msedge.exe	81
PID 2116 wrote to memory of 3436	2116	msedge.exe	81
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 1092	2116	msedge.exe	82
PID 2116 wrote to memory of 4732	2116	msedge.exe	83
PID 2116 wrote to memory of 4732	2116	msedge.exe	83
PID 2116 wrote to memory of 1388	2116	msedge.exe	84
PID 2116 wrote to memory of 1388	2116	msedge.exe	84
PID 2116 wrote to memory of 1388	2116	msedge.exe	84
PID 2116 wrote to memory of 1388	2116	msedge.exe	84
PID 2116 wrote to memory of 1388	2116	msedge.exe	84
PID 2116 wrote to memory of 1388	2116	msedge.exe	84
PID 2116 wrote to memory of 1388	2116	msedge.exe	84
PID 2116 wrote to memory of 1388	2116	msedge.exe	84
PID 2116 wrote to memory of 1388	2116	msedge.exe	84
PID 2116 wrote to memory of 1388	2116	msedge.exe	84
PID 2116 wrote to memory of 1388	2116	msedge.exe	84
PID 2116 wrote to memory of 1388	2116	msedge.exe	84
PID 2116 wrote to memory of 1388	2116	msedge.exe	84
PID 2116 wrote to memory of 1388	2116	msedge.exe	84
PID 2116 wrote to memory of 1388	2116	msedge.exe	84
PID 2116 wrote to memory of 1388	2116	msedge.exe	84
PID 2116 wrote to memory of 1388	2116	msedge.exe	84
PID 2116 wrote to memory of 1388	2116	msedge.exe	84
PID 2116 wrote to memory of 1388	2116	msedge.exe	84
PID 2116 wrote to memory of 1388	2116	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\35cd0fcd257e14765d481e8c243c9d2f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcaaf146f8,0x7ffcaaf14708,0x7ffcaaf14718
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,10358499875941983080,14902344205294444178,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,10358499875941983080,14902344205294444178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,10358499875941983080,14902344205294444178,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10358499875941983080,14902344205294444178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10358499875941983080,14902344205294444178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,10358499875941983080,14902344205294444178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,10358499875941983080,14902344205294444178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10358499875941983080,14902344205294444178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10358499875941983080,14902344205294444178,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10358499875941983080,14902344205294444178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10358499875941983080,14902344205294444178,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,10358499875941983080,14902344205294444178,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5844 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
189B

MD5
443319881835b14fda88caab9945e84c

SHA1
adb420bd20774e8eabc4d3d53ecfccb20ae7cb54

SHA256
fd79d0831e92ccbffc20eed3a0d07b39a121b4f3be4f720d2981fdd2e7b5b8da

SHA512
39c2c7fd638c04ce244473831d3dc8175e8e9ecb9a0df38370300233202d7d7fa9166912b8d97b34efd7b90eab6da376191e1c5c9ce253e96c9686b886ab29fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
35817a0fb0e137d499f9fde6f3ed27e3

SHA1
f0df3d99bbd8c951f6e0360dd9bf48d89774714e

SHA256
97d301fc3d01ff495f1190c9727b04d35a6f807539e8eb9fdb3bac7f327fc731

SHA512
6ca6cf7ccfd4b55535d3f98741177d51170eb783072138a8ebd8a06103e07c6b08f49fcf0858d2a98ff2157a9c385edb37b048149ce539eece4862aff78bee5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9668b98b87070b6ff2b6dd1294606077

SHA1
81e8a0b931cbeebad3752c3143fad4218e69f329

SHA256
e48cd8156628a7b9350c5e404dc738254024b392fa73f1aeee1221f2f13afb55

SHA512
3aa3e4f3a2756fd1e3070feb4fa65658919e9611b4355de43f7343c28ddd850dae4ca068f37a739e97f96695ff1d054a7a035b0ded4a9bb7dec3db33ccf59d6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
732102719fcbf539f701baf1064e86e7

SHA1
490f1917bdc34470f6b097c1f7bd73ab84e94f93

SHA256
b655f3ff4e25c2ca0c0042bf2d26e3f80720d06b49a1fa13d7bdc55e43fbfac2

SHA512
84b155c4e730083efc7b55020da1a67dfe0f3d3ed8647a9718f3aa73bd31c3b3b3b0fb73c7c97d4a6a13b4f57b18c521880bafd64de7eff90cb97b0bd30595e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1c54e9b550fee58aba6af8db79f9a7db

SHA1
576d5fe048fb2e0fb039f9a4a46270a1ddf87645

SHA256
f2f3a1b3887b06722d30238edc01bd2a9555565e7ac2e5ab7b518dcb273c1991

SHA512
cee6e2c9fe035375fc0458498ab96ce5e66df701cf4595c64c08a3585d69488a01edbb3713beb3598a90bc26193093cfeda9014e4eefc19cbdaae84056384ae8

Download Submit