7338b9297875a9b09efb272b8321803164e0f823da8bc992e35e048ca87a4b10

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 15:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42130459de61acfef0933b70b989a9d6_JaffaCakes118.html
Size

58KB
MD5

42130459de61acfef0933b70b989a9d6
SHA1

7b417592518623beb531a351b448e5d5d2584f00
SHA256

7338b9297875a9b09efb272b8321803164e0f823da8bc992e35e048ca87a4b10
SHA512

64951335f1ffa3d9fae0544c6a3dc92cc4ce13e47be278b9773569dd2f8f468d6d269ced2dac8e6b5220103199cd698fbc03a685c83e31f6d2683febddf4803b
SSDEEP

1536:re5PnY46h1y+Z9Fx/lhxDNv1FrSS4UR/uIzctlW:b5xhwkeC

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
624	msedge.exe
624	msedge.exe
4232	identity_helper.exe
4232	identity_helper.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 2964	624	msedge.exe	82
PID 624 wrote to memory of 2964	624	msedge.exe	82
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 4028	624	msedge.exe	83
PID 624 wrote to memory of 2756	624	msedge.exe	84
PID 624 wrote to memory of 2756	624	msedge.exe	84
PID 624 wrote to memory of 4324	624	msedge.exe	85
PID 624 wrote to memory of 4324	624	msedge.exe	85
PID 624 wrote to memory of 4324	624	msedge.exe	85
PID 624 wrote to memory of 4324	624	msedge.exe	85
PID 624 wrote to memory of 4324	624	msedge.exe	85
PID 624 wrote to memory of 4324	624	msedge.exe	85
PID 624 wrote to memory of 4324	624	msedge.exe	85
PID 624 wrote to memory of 4324	624	msedge.exe	85
PID 624 wrote to memory of 4324	624	msedge.exe	85
PID 624 wrote to memory of 4324	624	msedge.exe	85
PID 624 wrote to memory of 4324	624	msedge.exe	85
PID 624 wrote to memory of 4324	624	msedge.exe	85
PID 624 wrote to memory of 4324	624	msedge.exe	85
PID 624 wrote to memory of 4324	624	msedge.exe	85
PID 624 wrote to memory of 4324	624	msedge.exe	85
PID 624 wrote to memory of 4324	624	msedge.exe	85
PID 624 wrote to memory of 4324	624	msedge.exe	85
PID 624 wrote to memory of 4324	624	msedge.exe	85
PID 624 wrote to memory of 4324	624	msedge.exe	85
PID 624 wrote to memory of 4324	624	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\42130459de61acfef0933b70b989a9d6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xe0,0x10c,0x7ffa84ef46f8,0x7ffa84ef4708,0x7ffa84ef4718
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,16412170314597787237,6785410095158256748,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,16412170314597787237,6785410095158256748,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,16412170314597787237,6785410095158256748,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16412170314597787237,6785410095158256748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16412170314597787237,6785410095158256748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,16412170314597787237,6785410095158256748,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,16412170314597787237,6785410095158256748,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16412170314597787237,6785410095158256748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16412170314597787237,6785410095158256748,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16412170314597787237,6785410095158256748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16412170314597787237,6785410095158256748,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,16412170314597787237,6785410095158256748,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4908 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
398B

MD5
62a21ee898aadc16430bc4204f91ca24

SHA1
1241df9973db79efecfc4e83bd31232c0725bdb9

SHA256
aec97add9f1a0c7bbec1030abfc1128a3a05dea2854c9d0248f9fa5bdf8d496d

SHA512
18aad8fa46fd0e63109c99339f8e45530b85b65c112e7f9c78113c728aae43460e5f76999e9c049999c6c1af37b6c0d589eb28bf1cdf91b3923aeca7b9c2a729

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b3dd274f984acc3c9615fa8d3eb73532

SHA1
dfddbf955b64313c47d6879f8d2b1cdeb8a67371

SHA256
a27d2a8c31f163c70bf787e9d4e2b195caca0678c4535e4fa1597b061cd371be

SHA512
d523f0d45dadf77bf3b2e7d75b29c3631a945b645692da75c2beea03c4394cfe797622994cc3b72101fddfa679eab816686718e92ce0df7678dadc09d8409ccf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
14400eb0818f8c933cde9d83026f7106

SHA1
b16f9d54f68849d07375fe1ada7d1508b245d4d4

SHA256
c16af0130ac29716570b95a6935f5387fe2110a54cecf46b4c27c5bb76b25666

SHA512
ef9debfc179875a09ca6079c7eee81ab9fcb7db07e99ec03f5a1eecc88e13d3a82300c9e937a9480e2fe572ae56f614427da3e796ab82984d29ea0e3b0a45ff7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
c0db6b51a0929ca57b0dbe8fdf2a1e71

SHA1
a17dac02bfb088b2db61cd975922ccd423b06be1

SHA256
e4c99f824d46127d90e9ddcfa9ef2c15146562bdfdd12ce7c4657e39d6ca1095

SHA512
9db1d2e58be239e453335b60181a76390f49ce12e034ea1a8774dcddd7a8a73f28289f00b3ea639c71adb756ecd35a0f3ecad0a68e93fb1ad3c4f07b43da07c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b297.TMP

Filesize
372B

MD5
ccc710cd8340748b27d1a5255f443a1f

SHA1
c8975a7575d6d549aea3d5ab4343cc9732d016ba

SHA256
6182608a6a19ef5b8ecdcf7ef5f4c8328ef895d56768c20daa4fcb9f51154269

SHA512
3e4d627e21ca862ff73ef36fffa504d1db80bb8ecb733be613c3029f2f965a41336c3c2cb2e32690d74bd59fedf8a4fe1f08d720162977e894587ba2ba086896

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c4c716c2-7d07-4b36-acdc-eb7711c6086e.tmp

Filesize
11KB

MD5
9cba9d33e02c1bdec26fcf1b0a9cc5f9

SHA1
bf48823e052aa4651c0baca41a060da70851d22c

SHA256
9f72c0d755a0b096e827222c8b62de4b85551e4f4166ac94e36c6b50e0d6510c

SHA512
6329feed21edaeb967735c617979228ddd46409292212fa7821ddc0490910266d312a0a4d7a1b1b996a9501996ec475dbfd9e864c2af185c04ef57c2485760f4

Download Submit