3869406616ab187f53388a3dd9488d4d9409345ad3ccd19efce92930a706e240

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 16:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6400a5fda4323a4e732f082a216c8e62_JaffaCakes118.html
Size

119KB
MD5

6400a5fda4323a4e732f082a216c8e62
SHA1

2c95c3f5e150056a43b8916359685d88157a859d
SHA256

3869406616ab187f53388a3dd9488d4d9409345ad3ccd19efce92930a706e240
SHA512

7fa4e6fb36606daafa1998629c7070eb573fc70e28cbc22974b15b27b5e966fa7e7df93d996bbac3aeb6949e8f36e0176f905f8678395b855c3a85fede53e3a2
SSDEEP

1536:S21yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsn:S21yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1624	msedge.exe
1624	msedge.exe
5008	msedge.exe
5008	msedge.exe
1784	identity_helper.exe
1784	identity_helper.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

5008 msedge.exe
5008 msedge.exe
5008 msedge.exe
5008 msedge.exe
5008 msedge.exe
5008 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 5008 wrote to memory of 1924	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 1924	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4472	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 1624	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 1624	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4768	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4768	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4768	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4768	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4768	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4768	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4768	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4768	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4768	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4768	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4768	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4768	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4768	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4768	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4768	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4768	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4768	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4768	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4768	5008	msedge.exe	msedge.exe
PID 5008 wrote to memory of 4768	5008	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6400a5fda4323a4e732f082a216c8e62_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff935e46f8,0x7fff935e4708,0x7fff935e4718
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,3020950354316806143,8887365577330501352,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1948,3020950354316806143,8887365577330501352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1948,3020950354316806143,8887365577330501352,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,3020950354316806143,8887365577330501352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,3020950354316806143,8887365577330501352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1948,3020950354316806143,8887365577330501352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1948,3020950354316806143,8887365577330501352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,3020950354316806143,8887365577330501352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,3020950354316806143,8887365577330501352,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,3020950354316806143,8887365577330501352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,3020950354316806143,8887365577330501352,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,3020950354316806143,8887365577330501352,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5428 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f92b480157fcea4e2b89a5bee0e71c03

SHA1
c2e42a9417d3ebd22baf8dfb189f11b535c18560

SHA256
7409f56374e531f7c687623236235e73841982e4f354dee324bf066d0fc8c6bd

SHA512
53e79d431ff18989193508df7d771b15c905424c5b208e51786165e685fb89c815bba9212a3d945a4d9e780248ee1496bb80510da78d6b056e645d4d8441699b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9acf87d6962cd77efec4c29cb1be5595

SHA1
84c8c3e2d8bb5fe8bcfe17f75b36a7ec7c68b4ff

SHA256
ec996d7656c92244cb063d5ed96e9a1c25282ec1454b8a2a03e300dafd1afd97

SHA512
61f80bace27834835e4bc62bcc5f76876dcf4950629b07bb76421d0fdffd0479d529e9ea9b68d0bedb45e4afbba261c5a8b5a1fcacbe5d07736438c62126bd31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
78709dc7fa3c3db17d18faa6894090cd

SHA1
f7ea813eef7df39ac85dc37faf29768e679f71d6

SHA256
a3b46a22e2715e65c943078d96530777bd00e9c25fd04f8896bc13ebff991614

SHA512
ef109414467a1ce9a4d12e6c659996a4c47cba42d7f98deb7a51fd5ed2af229ab6403cef049833fc2ac81aa825e69e6be1e0bb01877a51b43b794d87c00dbfb2

Download Submit
\??\pipe\LOCAL\crashpad_5008_NIOYLPGTGSPHUXDO

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit