d71a6cd9bf6fbad42e6b568b673bee9ded676ce56ffba8335dff6be918205434

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 13:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3fb67314cde742a5a04f3893f78be2f1_JaffaCakes118.html
Size

4KB
MD5

3fb67314cde742a5a04f3893f78be2f1
SHA1

be246a2db727f8afc3618d767c06add8f58ca94e
SHA256

d71a6cd9bf6fbad42e6b568b673bee9ded676ce56ffba8335dff6be918205434
SHA512

1f428dfdb8aa56bcbb0a90f8ab4e53c4a7f88f458cc25b88338d727d0ff8f1a3f13c3b79804c99570bd5721b6dd59dce51d5d24703a2216b3ddca2e53c85d53c
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o8JsVbd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDO

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3624	msedge.exe
3624	msedge.exe
1100	msedge.exe
1100	msedge.exe
4044	identity_helper.exe
4044	identity_helper.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 3088	1100	msedge.exe	82
PID 1100 wrote to memory of 3088	1100	msedge.exe	82
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 1512	1100	msedge.exe	83
PID 1100 wrote to memory of 3624	1100	msedge.exe	84
PID 1100 wrote to memory of 3624	1100	msedge.exe	84
PID 1100 wrote to memory of 948	1100	msedge.exe	85
PID 1100 wrote to memory of 948	1100	msedge.exe	85
PID 1100 wrote to memory of 948	1100	msedge.exe	85
PID 1100 wrote to memory of 948	1100	msedge.exe	85
PID 1100 wrote to memory of 948	1100	msedge.exe	85
PID 1100 wrote to memory of 948	1100	msedge.exe	85
PID 1100 wrote to memory of 948	1100	msedge.exe	85
PID 1100 wrote to memory of 948	1100	msedge.exe	85
PID 1100 wrote to memory of 948	1100	msedge.exe	85
PID 1100 wrote to memory of 948	1100	msedge.exe	85
PID 1100 wrote to memory of 948	1100	msedge.exe	85
PID 1100 wrote to memory of 948	1100	msedge.exe	85
PID 1100 wrote to memory of 948	1100	msedge.exe	85
PID 1100 wrote to memory of 948	1100	msedge.exe	85
PID 1100 wrote to memory of 948	1100	msedge.exe	85
PID 1100 wrote to memory of 948	1100	msedge.exe	85
PID 1100 wrote to memory of 948	1100	msedge.exe	85
PID 1100 wrote to memory of 948	1100	msedge.exe	85
PID 1100 wrote to memory of 948	1100	msedge.exe	85
PID 1100 wrote to memory of 948	1100	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3fb67314cde742a5a04f3893f78be2f1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd179146f8,0x7ffd17914708,0x7ffd17914718
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,5448619907010344226,1605654826836233796,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,5448619907010344226,1605654826836233796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,5448619907010344226,1605654826836233796,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5448619907010344226,1605654826836233796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5448619907010344226,1605654826836233796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,5448619907010344226,1605654826836233796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,5448619907010344226,1605654826836233796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5448619907010344226,1605654826836233796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5448619907010344226,1605654826836233796,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5448619907010344226,1605654826836233796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5448619907010344226,1605654826836233796,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,5448619907010344226,1605654826836233796,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
292B

MD5
d0783e78006f7ecff47b51ef126699e4

SHA1
cc552d1201bbbc29fa96b11659d8e423375b9911

SHA256
d938ca9e52a56e3883bc83b5094f4896fbf6cf4cf495d663347d874404800845

SHA512
f5bb2fa3c94018c2134fa0e06bbf2bd986d352172032ecfaf5409ee17d4fa82ec656e0ebf932565deb81c9bbad710c27b9c575ed653e3024476143b88bf9398a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bebd89d5e49e7610b8e65671a4acf274

SHA1
056199251e69b89413a81f8116594f8282505376

SHA256
4bf540c180084142f3759d29154f66fba65eb98aa3274ccef945ca1814cf48ed

SHA512
bf2dc23d61d20af904a23e82994e41bc7416136a3e21906d9813cc7b399b321919cf8114b88c9cfe6968cefa60c84922a57df2d9639cc7a995e042f3efd2422f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
483f66ea6cd125d359ec709a3107374f

SHA1
9de9f42870190afb16d01bf67b7f16d81f310010

SHA256
adfa624becd8e527920900bda7abab1cbacc9248fb9cd5b803434835c6475a51

SHA512
9bed3942eca84f513494fa4553081ad7e1691bab2044f99c0eb4ce54097520afdd85ce198fadd91593017b03c9f7280cd6b11d5271e8ad96d5479a57e6b1963b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
98422e504727a4ace9f7d3fc2e39ff49

SHA1
d1cd5afb45233981ae2612dcdd007eb68766177f

SHA256
ee87e17c77c94b1e73202ea0d37281f1921420880b89737c755eec38c96d920e

SHA512
1c89dbbca3fd51024cb45506006fe1a64b7080bc17344905a8bc59f4cd8636fb4eee7148366079d7a6781a5869b25c9ea513e393639757e921710245ce1448d1

Download Submit