f50a2eff442395b7f4898155fa74c7c2ea7bcddfdbf47331ed9c644e9b89eda6

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3818086e0cafe6ab35334bd97d314eaa_JaffaCakes118.html
Size

94KB
MD5

3818086e0cafe6ab35334bd97d314eaa
SHA1

165cc7c8c04390490932b03b277de46b740b768c
SHA256

f50a2eff442395b7f4898155fa74c7c2ea7bcddfdbf47331ed9c644e9b89eda6
SHA512

47f64e2b29bb64af1a65b0f9af44e9cba2171889ee1b9fc76ccc252b82b907306a9eb7127e2357e6ec56cabc707c64738158cd5e2e52df74d031465011cc90cb
SSDEEP

1536:WMLiN/aSFL1B7LeTOto64fNrshKfX/b+yWZrnlgBdkrY8mgHC+qpEyW:WAiMAaBdkrY8mgHC+qpEyW

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2132	msedge.exe
2132	msedge.exe
4356	msedge.exe
4356	msedge.exe
3372	identity_helper.exe
3372	identity_helper.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 1816	4356	msedge.exe	83
PID 4356 wrote to memory of 1816	4356	msedge.exe	83
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 740	4356	msedge.exe	84
PID 4356 wrote to memory of 2132	4356	msedge.exe	85
PID 4356 wrote to memory of 2132	4356	msedge.exe	85
PID 4356 wrote to memory of 3500	4356	msedge.exe	86
PID 4356 wrote to memory of 3500	4356	msedge.exe	86
PID 4356 wrote to memory of 3500	4356	msedge.exe	86
PID 4356 wrote to memory of 3500	4356	msedge.exe	86
PID 4356 wrote to memory of 3500	4356	msedge.exe	86
PID 4356 wrote to memory of 3500	4356	msedge.exe	86
PID 4356 wrote to memory of 3500	4356	msedge.exe	86
PID 4356 wrote to memory of 3500	4356	msedge.exe	86
PID 4356 wrote to memory of 3500	4356	msedge.exe	86
PID 4356 wrote to memory of 3500	4356	msedge.exe	86
PID 4356 wrote to memory of 3500	4356	msedge.exe	86
PID 4356 wrote to memory of 3500	4356	msedge.exe	86
PID 4356 wrote to memory of 3500	4356	msedge.exe	86
PID 4356 wrote to memory of 3500	4356	msedge.exe	86
PID 4356 wrote to memory of 3500	4356	msedge.exe	86
PID 4356 wrote to memory of 3500	4356	msedge.exe	86
PID 4356 wrote to memory of 3500	4356	msedge.exe	86
PID 4356 wrote to memory of 3500	4356	msedge.exe	86
PID 4356 wrote to memory of 3500	4356	msedge.exe	86
PID 4356 wrote to memory of 3500	4356	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3818086e0cafe6ab35334bd97d314eaa_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5c0e46f8,0x7ffa5c0e4708,0x7ffa5c0e4718
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,13780971012114619668,1983011506652326683,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,13780971012114619668,1983011506652326683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,13780971012114619668,1983011506652326683,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13780971012114619668,1983011506652326683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13780971012114619668,1983011506652326683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13780971012114619668,1983011506652326683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13780971012114619668,1983011506652326683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,13780971012114619668,1983011506652326683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,13780971012114619668,1983011506652326683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13780971012114619668,1983011506652326683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13780971012114619668,1983011506652326683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,13780971012114619668,1983011506652326683,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
178B

MD5
efb3e41ddcb00d4e436d59962fe73c4d

SHA1
4b9f2cbd664cf2136cd6966774f9ee04b4efa46a

SHA256
edc776d59064e412098066a07cba55cbabb1e7d18534e1292d34003961ad3bb6

SHA512
85a53139125a0e589b222ebee00d1c593eb24c8059b9f3f86196f8ef346cf7fc988493bb6f5cebf7aec2d0debc5017eff291b04e8aa37180d1ec5a6e2bb362ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
53b0b3854d62967690a0e9ba3d7ee9e5

SHA1
0d0ff81cfdc415f9bb6c65cef61f5c67f9f7bf12

SHA256
e3b7ef2cb033a57c9ce8054ce74fe72836991e65a732efdc5a69e7273882199a

SHA512
7d291c7dbd01892f799a2f19f04eb36e8f77fa386febc23ee4c40ab6830563d197ac0b3eb8d692f075eab00621eec269a48e36b35aab1d262ff9cc96f47834be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7b54b4c8c79c1d095d6a58d4b006ea18

SHA1
0fe2dfac9e3e02941ef8288ddcfeaeb7973c5815

SHA256
6848c2d22efba529f498c199cb8b41d09ede70dd5cbcfcd63b68330b68273d15

SHA512
fd437c182f41605924797f143a6d9c0bff2661647fe85cbc2546cfe3c5018550a5f3d08ba07b6a1c079b0d764fb6978cd58405c21ab0e519dd00c3218c82a6c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e732a3646b0c71a75d279a0ecb4045a4

SHA1
3cf881ae611e617848dc524cd7117045c69c424b

SHA256
240d2a4489c8b9d3b95c31f70c1357efc3424e559c61d2b7da97f236def5cc58

SHA512
4357faab637bd29a63bbf15bf48af30f9ef9b489695551249bca8b3670248af9e3a146b5e067ab60efdca098d7d4aaa67726d13fa35903e131a69050054ccacf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
47bdc99e5d1fb4d24b070010ad5281f9

SHA1
0ada52807131e52a5a6abf8e21b75b23629e97e4

SHA256
56259560d9ee894c73034470a83854c207093d3c5994caeeb4fee2237a1530bf

SHA512
5ae7c9bed0aaf5872eeb9e885ea51bf832a67b274cd48d362ed547514cc22a7f061b9e1366091ff9da34506b3793c896144cb4dd8eae8b1dd9a4469636f0d127

Download Submit