bd10a58ea00c288fa7b59c4f3d2eabec57405453c9a8bd282d46413ab72d231e

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 09:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39833204118a569c4864a70ee4c5cc63_JaffaCakes118.html
Size

364KB
MD5

39833204118a569c4864a70ee4c5cc63
SHA1

794505e583b60af64f3f65f9ead5fc2a805b74ed
SHA256

bd10a58ea00c288fa7b59c4f3d2eabec57405453c9a8bd282d46413ab72d231e
SHA512

e474ed50d3fd31c2078eeb4871afd0a71c5d5987935b0551b0da8b939d165872c2826f6820b65ecd9145d16bdedb420e571eb827525381d1cb6b3d687f9124ff
SSDEEP

6144:3HTGrIFXnGasXXLXEIN8CUSdzm0rSW9tEiVRv27BgA6ECRbn//0ztxg/5k2qrHtH:XTGrIF3HsHLXEIN8CUSdzm0rSW9tEiVE

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
4848	msedge.exe
4848	msedge.exe
396	identity_helper.exe
396	identity_helper.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 1888	4848	msedge.exe	82
PID 4848 wrote to memory of 1888	4848	msedge.exe	82
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 3848	4848	msedge.exe	83
PID 4848 wrote to memory of 1128	4848	msedge.exe	84
PID 4848 wrote to memory of 1128	4848	msedge.exe	84
PID 4848 wrote to memory of 3700	4848	msedge.exe	85
PID 4848 wrote to memory of 3700	4848	msedge.exe	85
PID 4848 wrote to memory of 3700	4848	msedge.exe	85
PID 4848 wrote to memory of 3700	4848	msedge.exe	85
PID 4848 wrote to memory of 3700	4848	msedge.exe	85
PID 4848 wrote to memory of 3700	4848	msedge.exe	85
PID 4848 wrote to memory of 3700	4848	msedge.exe	85
PID 4848 wrote to memory of 3700	4848	msedge.exe	85
PID 4848 wrote to memory of 3700	4848	msedge.exe	85
PID 4848 wrote to memory of 3700	4848	msedge.exe	85
PID 4848 wrote to memory of 3700	4848	msedge.exe	85
PID 4848 wrote to memory of 3700	4848	msedge.exe	85
PID 4848 wrote to memory of 3700	4848	msedge.exe	85
PID 4848 wrote to memory of 3700	4848	msedge.exe	85
PID 4848 wrote to memory of 3700	4848	msedge.exe	85
PID 4848 wrote to memory of 3700	4848	msedge.exe	85
PID 4848 wrote to memory of 3700	4848	msedge.exe	85
PID 4848 wrote to memory of 3700	4848	msedge.exe	85
PID 4848 wrote to memory of 3700	4848	msedge.exe	85
PID 4848 wrote to memory of 3700	4848	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\39833204118a569c4864a70ee4c5cc63_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff95ffe46f8,0x7ff95ffe4708,0x7ff95ffe4718
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1800,9187135947964587688,5517152318851702864,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1800,9187135947964587688,5517152318851702864,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1800,9187135947964587688,5517152318851702864,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,9187135947964587688,5517152318851702864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,9187135947964587688,5517152318851702864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,9187135947964587688,5517152318851702864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1800,9187135947964587688,5517152318851702864,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4560 /prefetch:8
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1800,9187135947964587688,5517152318851702864,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4560 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,9187135947964587688,5517152318851702864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,9187135947964587688,5517152318851702864,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,9187135947964587688,5517152318851702864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1800,9187135947964587688,5517152318851702864,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1800,9187135947964587688,5517152318851702864,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4744 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
5b416d86dfa67a36c379815ecccce179

SHA1
9f62e4caed81b18ce9beefa3d07d56e0923ac79d

SHA256
01878c83f347bdf6994ff417217f6097d81cd41f85b3cf40dd730cba1ff66dee

SHA512
b5878081679f0bed7773971a7c3e00ca284c16ca18371301e47e961a4762cb40cd31fb8c725a0c268245d011074405f54dbacf988ff71de332874e396af311fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1012B

MD5
4ec083a315392adea72e659c2fe070d4

SHA1
6d07b3c07d9766bdf9ba3d95b115fd44e6fb6c13

SHA256
b01722dbb7e40628375c127c435f44ec903e17165bc2036ad6c7f08d7d940728

SHA512
b2ebcb52643eda9daa969729fe1636224ff6b8bba5d166dbf0d996a1863d3ad3d342a727c403a0db6e48ff142e4a2cf0acc224c17ab37a5d1e76aa70b734fb84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
206c361bf66fd05a9e21e4d9c6daac17

SHA1
e05624645ed4a645bd673c93b2367f267bbcc213

SHA256
2dcd10ac3ea3cfac3efd0a25777f812b3277a0e3b44629138a8e49c9e2aa7ff7

SHA512
cfd4a19c48725814fa195b0b752651884c7cabb8714bc0a984c227732b1961ecaf6d87baadc2f401b5d0f46818af7e9816bf16df474be8a6807c5c94b7b5b391

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3c7185485d85d37864db8bb28f44fc8a

SHA1
426dfbf8bcddafbb4cef7365ea5772be0cbba90e

SHA256
ac9dfb146f5930ab380cda887d9e805a931a54ef272bc1f7010ef6ec0709ff9c

SHA512
5fd20cae3e62b2a5d04d16a04da318ccb7b1694644bf8edebb54bbdef338a78632b9b2293cd2ddd0cfd883b80aa876f2ef4f516305e0e08ab5895e0b75285b02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e0d1d80f834c470d506cd4f717264e44

SHA1
df1ab901280c53bde60179cb8d1790279684f281

SHA256
a50c4a610c81a21d0f2e5cc0543114d7fd2ef2d82842bc59eb8e0461df600bd2

SHA512
aec599784895641e558cfec82ee6fa390c05d4692b1f1c3b738af3c8fae88e8f9aef50d00b0ec5601044bbe06befa65372e667fb67f7d0049c599229b303119c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
abd552ab6f23d22f5108094cfa6447bb

SHA1
8a2559d7093462a1df59d7facadbcc8ccd251477

SHA256
9e3d17431a126247f8f410c5f1818a561f090b5996c36b7009406af147d5964c

SHA512
f335e629732ba70c35abfc70fe6398ce2b9dd41d26d1c2bcb9ffc41c1f0160d1c20ca1a80265b5e9de769aeda91353199619927ac6a29f201957c3e69867af56

Download Submit