545d09180f00a11d44f88f91888db86f8497a02cb82b6c89d18c40c572978e75

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 15:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3add9e778e55c5cf11d51322f14d74c0_JaffaCakes118.html
Size

84KB
MD5

3add9e778e55c5cf11d51322f14d74c0
SHA1

3803a62a9cc36bcf3bc013bc33ca4b59cd5e3790
SHA256

545d09180f00a11d44f88f91888db86f8497a02cb82b6c89d18c40c572978e75
SHA512

c8e37b444f321381bcb66d8029bf92631e9c36e8220c464d481cabb4cde94f7a384168f9bd6e6dd196937a32d9ad95f44f7cb2b49c4f2d12f76a10d2fb637f70
SSDEEP

1536:E3LHH2d6iiIepO0NbWvqLT2ny4TcFEO7Wh2R9Rd6:6HWD0NR9Rd6

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3008	msedge.exe
3008	msedge.exe
3712	msedge.exe
3712	msedge.exe
408	identity_helper.exe
408	identity_helper.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 5064	3712	msedge.exe	82
PID 3712 wrote to memory of 5064	3712	msedge.exe	82
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 412	3712	msedge.exe	84
PID 3712 wrote to memory of 3008	3712	msedge.exe	85
PID 3712 wrote to memory of 3008	3712	msedge.exe	85
PID 3712 wrote to memory of 1404	3712	msedge.exe	86
PID 3712 wrote to memory of 1404	3712	msedge.exe	86
PID 3712 wrote to memory of 1404	3712	msedge.exe	86
PID 3712 wrote to memory of 1404	3712	msedge.exe	86
PID 3712 wrote to memory of 1404	3712	msedge.exe	86
PID 3712 wrote to memory of 1404	3712	msedge.exe	86
PID 3712 wrote to memory of 1404	3712	msedge.exe	86
PID 3712 wrote to memory of 1404	3712	msedge.exe	86
PID 3712 wrote to memory of 1404	3712	msedge.exe	86
PID 3712 wrote to memory of 1404	3712	msedge.exe	86
PID 3712 wrote to memory of 1404	3712	msedge.exe	86
PID 3712 wrote to memory of 1404	3712	msedge.exe	86
PID 3712 wrote to memory of 1404	3712	msedge.exe	86
PID 3712 wrote to memory of 1404	3712	msedge.exe	86
PID 3712 wrote to memory of 1404	3712	msedge.exe	86
PID 3712 wrote to memory of 1404	3712	msedge.exe	86
PID 3712 wrote to memory of 1404	3712	msedge.exe	86
PID 3712 wrote to memory of 1404	3712	msedge.exe	86
PID 3712 wrote to memory of 1404	3712	msedge.exe	86
PID 3712 wrote to memory of 1404	3712	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3add9e778e55c5cf11d51322f14d74c0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9272c46f8,0x7ff9272c4708,0x7ff9272c4718
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,5507148787837612955,13981421814711793767,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,5507148787837612955,13981421814711793767,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,5507148787837612955,13981421814711793767,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,5507148787837612955,13981421814711793767,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,5507148787837612955,13981421814711793767,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,5507148787837612955,13981421814711793767,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,5507148787837612955,13981421814711793767,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,5507148787837612955,13981421814711793767,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,5507148787837612955,13981421814711793767,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,5507148787837612955,13981421814711793767,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,5507148787837612955,13981421814711793767,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,5507148787837612955,13981421814711793767,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2944 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
16065ca7b1149bd9348240dfecc22e88

SHA1
ee62226eda52c8767505b56a7d3a15b604a47a03

SHA256
5ea0315bcbaca4da4a3da0ecbd0edc1a96b2997f619b0a235455edcfaf27a238

SHA512
91c0a10af963335379290972ca3367c3ade98d7f898f61c22057e7fe79d5dff8ca381f70c224d9c8b4ecfe21a0c4c8308094dcb157d245910f17fee4558a6d52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1a7f2409b5315923f3d2d9443f76b169

SHA1
5249c05fe60decb35150b715c24366b0fbc80bdb

SHA256
38c39ee6382dad9147860d223f2644a0a0c989f592bf913ed2b16caca48258a5

SHA512
50c7385f3267b840d1089901835cadf27789d1d10ed99c2d6355058ee88975a0ce1dcdd606d8ec4c652d10bd2b1884b8493c8e2a76c91307742c9f1f755f97c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
de60d8427ca2108791a2bf5501427592

SHA1
8ee844f49ff372b4008a91dbfcaa1d1f3ae36b77

SHA256
233c0618b68a14c7e09150edc3bedde9e6ed9ebc201ef60101e63a79f46a488d

SHA512
2851470c86a2de94fec54e8ea310f14fec9bcefd392d64443d26e95c7f1a2d3e6e08b6f3e476785701f8b2004788a1f5746fbeefcc490fb08ed220643d289ca1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f9156b9a4294b49cb2b1b199fd9c7e54

SHA1
9a64b22b5f8cd6f44f03f60a60697baf57aa8ed2

SHA256
4e3c6a24a4a880f90d7699334d0c3490be178cc7e7b9ce40f9381275248f3931

SHA512
ccd0852d535681328905981d1bdc02a050d6270722ef0ff1ca28eaf238c0f6da99900eb0719ba45b655358600a24b35314fcc4b42cf18fb3141b15f025a760dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
181fdaf462fc58dba9b85ca1d9fd85ec

SHA1
72f7afa4e537f0cc227242345620d5f6e39fff90

SHA256
c4520b5407aef829231d42b744d9ccbfa27821ffa408adaebed93d1636b4c574

SHA512
1d7d1e6222abfa957bbe7b61a967cbbb1a7f6f57f6a885ee0725c5978849e2b8bc36ed4add0e35017352654060ec60e2b48f4b79b34bd4c5706e5ae1760e5283

Download Submit