8ab81d69b1de43ea739831cfd0539fcd3a3ce0ac40f0d50ed86cd57501c93c6c

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

365857a464d8cb722865162efa0cec14_JaffaCakes118.html
Size

26KB
MD5

365857a464d8cb722865162efa0cec14
SHA1

baeba0b567942742231e8616615f2a73a9149458
SHA256

8ab81d69b1de43ea739831cfd0539fcd3a3ce0ac40f0d50ed86cd57501c93c6c
SHA512

4661196cba789d2787d5e66e187a52c6210c0441e5c5f652f832bae5b8b126d8d57ed4d1e55be70f3d8134cde0f90f45a0da9eacdf27dac2b9299184176fabfa
SSDEEP

768:BXXUdyKQbKpMTgc8amda2Nn9gexHfm3mqfYEQ:BDK+Kdc8amdaBkHuHfYEQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
3424	msedge.exe
3424	msedge.exe
2200	identity_helper.exe
2200	identity_helper.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 4392	3424	msedge.exe	83
PID 3424 wrote to memory of 4392	3424	msedge.exe	83
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 3468	3424	msedge.exe	84
PID 3424 wrote to memory of 4372	3424	msedge.exe	85
PID 3424 wrote to memory of 4372	3424	msedge.exe	85
PID 3424 wrote to memory of 4864	3424	msedge.exe	86
PID 3424 wrote to memory of 4864	3424	msedge.exe	86
PID 3424 wrote to memory of 4864	3424	msedge.exe	86
PID 3424 wrote to memory of 4864	3424	msedge.exe	86
PID 3424 wrote to memory of 4864	3424	msedge.exe	86
PID 3424 wrote to memory of 4864	3424	msedge.exe	86
PID 3424 wrote to memory of 4864	3424	msedge.exe	86
PID 3424 wrote to memory of 4864	3424	msedge.exe	86
PID 3424 wrote to memory of 4864	3424	msedge.exe	86
PID 3424 wrote to memory of 4864	3424	msedge.exe	86
PID 3424 wrote to memory of 4864	3424	msedge.exe	86
PID 3424 wrote to memory of 4864	3424	msedge.exe	86
PID 3424 wrote to memory of 4864	3424	msedge.exe	86
PID 3424 wrote to memory of 4864	3424	msedge.exe	86
PID 3424 wrote to memory of 4864	3424	msedge.exe	86
PID 3424 wrote to memory of 4864	3424	msedge.exe	86
PID 3424 wrote to memory of 4864	3424	msedge.exe	86
PID 3424 wrote to memory of 4864	3424	msedge.exe	86
PID 3424 wrote to memory of 4864	3424	msedge.exe	86
PID 3424 wrote to memory of 4864	3424	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\365857a464d8cb722865162efa0cec14_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f44046f8,0x7ff8f4404708,0x7ff8f4404718
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,18085822343517397213,13946998966791722722,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,18085822343517397213,13946998966791722722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,18085822343517397213,13946998966791722722,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18085822343517397213,13946998966791722722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18085822343517397213,13946998966791722722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,18085822343517397213,13946998966791722722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,18085822343517397213,13946998966791722722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18085822343517397213,13946998966791722722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18085822343517397213,13946998966791722722,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18085822343517397213,13946998966791722722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18085822343517397213,13946998966791722722,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,18085822343517397213,13946998966791722722,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2948 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
273B

MD5
52cc333e49bb93e1e63ff25b8af8f100

SHA1
18187bbda627ed8f45833b53493fefe2176bb72c

SHA256
f4770883b8c57ad0def14ccd2f4c6d534c1c4cd48f6816e5305b0f6d1622b8dd

SHA512
4afcad874fc2d5efca9e5dda312da23c016529b063c7c1f10bf1105fbf56e3b2d44bb7235b67f8a0604886ad25294685d288a0a127e176fa25ba14d1d039634b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fd166ad2e7cc660b337004a36af61a47

SHA1
74f0269944a7ddf5339c02065f8e78e1f3721ef3

SHA256
6805476683619b889b04a76010477fbeb2213e515fcea84e7213f62b12fc5da9

SHA512
2e0aa746dc136c463b08404b58dbf188f06e5cc83c35de484027f11956b080821859ef02c38bdb0e5e1ac12744e549ec9f8523205328ccdae3baa2ca9f0da2b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
304c48915e68e15e2818779b76551b01

SHA1
4d0c65603befda073890b5d5e58c35396026a5e9

SHA256
3edb0a78a51cb80205643d32785b4f208c2e4da0f02546cdc392113a0586f8ac

SHA512
b2971535504e6349c7d710118bfbfac883b8fd9d7a65969506111edc3ed14ed2598eeea097746abdc7a36261496c6259a3d4eb81b310558e58d3e67244594cd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b90330d00e738929ba36feca1070b69b

SHA1
4de35ba2b71a39c755598e2e80743840435a2fd5

SHA256
927a1d28565b53ad584f64955096ea9f0a6b607d5eccaee256d3df1d122a4519

SHA512
6f3df40db6bf82d4c2978897ac172bca1a2a30dd37d0931f2839c12cc6a26e3ae5142f0ea30a115ef2a42affa05aebd69fe91dbffbe5d27e355f9b98fcd11c40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d6ec08e387a703aa787ce5c223d0d2b6

SHA1
fb737959b794dedf9f6a355e9ba2546a0e65562e

SHA256
02d6218d24969bcc91ff5f8348594fbfd764c57344897823f647dddd1173558a

SHA512
589d71b71d11c47d0174d75ced7ed52307285d77cf6ac7a3c4052b0c50184d14258c2fe4de8173edfe065608a9d85b2773dc6a2885617cfe69a229be06509f9d

Download Submit