f3fdad3c22a01f04036975ed516640270f25e1ce5e0378e2ba112d0c1c2c76a7

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ba104648bb0beabcfca59aa9df4f308_JaffaCakes118.html
Size

36KB
MD5

3ba104648bb0beabcfca59aa9df4f308
SHA1

df3909a102607c94f88ae9645ac8180548e52e0e
SHA256

f3fdad3c22a01f04036975ed516640270f25e1ce5e0378e2ba112d0c1c2c76a7
SHA512

e924a1951449b7ef57b4114f89ba7b67a5943653a7c0bd8a9940089e02124089ad0a0dc78dfc9658e6ec39f4f35ca7fe40cb0c0714e79ecf66f0bfd4183b5571
SSDEEP

768:zwx/MDTHBZ88hARWZPXhE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TveEIL6f9UD6lLR:Q/XbJxNVqufSI/z8WK

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1872	msedge.exe
1872	msedge.exe
4512	msedge.exe
4512	msedge.exe
320	identity_helper.exe
320	identity_helper.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4076	4512	msedge.exe	83
PID 4512 wrote to memory of 4076	4512	msedge.exe	83
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 3928	4512	msedge.exe	84
PID 4512 wrote to memory of 1872	4512	msedge.exe	85
PID 4512 wrote to memory of 1872	4512	msedge.exe	85
PID 4512 wrote to memory of 5048	4512	msedge.exe	86
PID 4512 wrote to memory of 5048	4512	msedge.exe	86
PID 4512 wrote to memory of 5048	4512	msedge.exe	86
PID 4512 wrote to memory of 5048	4512	msedge.exe	86
PID 4512 wrote to memory of 5048	4512	msedge.exe	86
PID 4512 wrote to memory of 5048	4512	msedge.exe	86
PID 4512 wrote to memory of 5048	4512	msedge.exe	86
PID 4512 wrote to memory of 5048	4512	msedge.exe	86
PID 4512 wrote to memory of 5048	4512	msedge.exe	86
PID 4512 wrote to memory of 5048	4512	msedge.exe	86
PID 4512 wrote to memory of 5048	4512	msedge.exe	86
PID 4512 wrote to memory of 5048	4512	msedge.exe	86
PID 4512 wrote to memory of 5048	4512	msedge.exe	86
PID 4512 wrote to memory of 5048	4512	msedge.exe	86
PID 4512 wrote to memory of 5048	4512	msedge.exe	86
PID 4512 wrote to memory of 5048	4512	msedge.exe	86
PID 4512 wrote to memory of 5048	4512	msedge.exe	86
PID 4512 wrote to memory of 5048	4512	msedge.exe	86
PID 4512 wrote to memory of 5048	4512	msedge.exe	86
PID 4512 wrote to memory of 5048	4512	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3ba104648bb0beabcfca59aa9df4f308_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9aba546f8,0x7ff9aba54708,0x7ff9aba54718
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,6007886800351793142,17166745725649832508,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,6007886800351793142,17166745725649832508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,6007886800351793142,17166745725649832508,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6007886800351793142,17166745725649832508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6007886800351793142,17166745725649832508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,6007886800351793142,17166745725649832508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,6007886800351793142,17166745725649832508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6007886800351793142,17166745725649832508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6007886800351793142,17166745725649832508,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6007886800351793142,17166745725649832508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6007886800351793142,17166745725649832508,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,6007886800351793142,17166745725649832508,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3164 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
614B

MD5
e358515003f6934bd49520d8bb1a273f

SHA1
533804bd85e4e9e491277937a6dc33aa175ed6a4

SHA256
e4791aa47128b90672dca04b97badd89656400621fcfd8e05b840253e17c5507

SHA512
a4aa7a824a6e03e0645d8c66bc9ba889ed4b9904cb4853116e38534433204b59aeb3f68cdd9fbf4661f3a85bce5413d1905a30a3f8ea84db4d6c6e4f9e7dcba3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
079db5b272142aa9d3c13b91d157d2e1

SHA1
e316eb837f943023e79007534a5c044349e1fbe7

SHA256
efc00027ba11b82dca343d20d7b524c4db51ffd01f90c14d7f17af2b8019a991

SHA512
5eb8df485bedbb3776445e96b34499077ec8c6b78435c989a8ef6871ee6431414c116190a081944e535117387700412e5d34a233a03be9ba2fd057da29809b11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
707d8c1a71b95b7389ae8f492065c634

SHA1
e108ecf80f4f7f98731375203394f6113062ff48

SHA256
8aa2e2d2d13ac9601d5842f26ba2bd7b21c6611de5073cbf98a382bf80ed601f

SHA512
e828a04000bc0ab417f28b7e671e3f81a38160fcb2d5cbfa186b8264ec2fb43844f04e8d816bc98cdfd7b7d920f94cb79649d9c691f646defea240ce96bdaab7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
644d82ac9303c8f8f117d63e132805b5

SHA1
48068a6622bd74377def2048ef87bc8835e62f29

SHA256
ca5ad9ce7b230a3c1e86b3e5558f9d0538b7b0e177eaffba2e76b1c15c2b3c6c

SHA512
54da771c75775fdc8f98953eecd2f37626e5bde159cc880ed20d447d3d5e5b5dbe840a54d445211232f3873fe58c71d4fd4e386d5db9e3bf76301edc819ab7c4

Download Submit