900bd208a0589e2e8d70113983a78d5f5a6fa1e59bef9377478db357442cb040

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65bc9211d8f0a834f5dc9e69ec957ac0_JaffaCakes118.html
Size

161KB
MD5

65bc9211d8f0a834f5dc9e69ec957ac0
SHA1

a9eff9a90fca9a4b05981599c6732bceeaa97ad3
SHA256

900bd208a0589e2e8d70113983a78d5f5a6fa1e59bef9377478db357442cb040
SHA512

40ffc41d2197b957ef8df2f5067136ddd4b2afe8e0dabe0e921f1bad771175fa09fb8a2246f209372120f871af4c8fb6d702d0c51a5dd8f936d3d1f6d39e3d5c
SSDEEP

3072:S1Ghj5ipqrNhQnOvY4ttWTUIZaxU3WOvpgtPi/NugpoBX3VB:S1SrNhQnOvY4ttWTUIZaxU3WOvpgtPia

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

1016 msedge.exe
1016 msedge.exe
8 msedge.exe
8 msedge.exe
2504 msedge.exe
2504 msedge.exe
2504 msedge.exe
2504 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

msedge.exe

pid process

8 msedge.exe
8 msedge.exe
8 msedge.exe
8 msedge.exe

pid	process
1016	msedge.exe
1016	msedge.exe
8	msedge.exe
8	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 8 wrote to memory of 5040	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 5040	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3340	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 1016	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 1016	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3168	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3168	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3168	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3168	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3168	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3168	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3168	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3168	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3168	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3168	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3168	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3168	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3168	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3168	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3168	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3168	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3168	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3168	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3168	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3168	8	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65bc9211d8f0a834f5dc9e69ec957ac0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffffab46f8,0x7fffffab4708,0x7fffffab4718
2⤵
PID:5040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,18125755226805259790,2690505994396264957,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 /prefetch:2
2⤵
PID:3340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2240,18125755226805259790,2690505994396264957,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2240,18125755226805259790,2690505994396264957,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
2⤵
PID:3168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,18125755226805259790,2690505994396264957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
2⤵
PID:4000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,18125755226805259790,2690505994396264957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
2⤵
PID:2904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,18125755226805259790,2690505994396264957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
2⤵
PID:2432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,18125755226805259790,2690505994396264957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
2⤵
PID:3600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,18125755226805259790,2690505994396264957,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
0ccbc5e4e924dea3ecd6487bbf6b66e5

SHA1
f76478ab804dfaf2899be00e505fe8d78e23de83

SHA256
558d2182b2f572cd9d1c2b0827ee51790fc78d5f51484bc67ac0334013ec19b7

SHA512
b5ad4d6cf85a1ec5179e2e7efc3e82c748b147b376097c0eeacd9658ec01b6f96e239d055fc9a8fbe731491a5a2a8fb0b859bbd66444b471d7c14b3469828a5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
1390afc59d81de8859c59a53fd4b4406

SHA1
8b1f8780f41b111d3e2e4a8711e92c2603cdbdc4

SHA256
9bd6e863dd49b9cb916c9b28b27a15237fb15cc2788e6efc9a0e920b561917ee

SHA512
3cdf282a9d736cfb5b2b5546e3098bbb58bdfc19958cc1cad2f6ba8a0c426335ecf4fe19e0fd25e3282257bfe90235398ae66db27889469fe1f3565a9f0a9308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
436695ea39d6ed75ceb74a549095f359

SHA1
d1d628fc17cbdd1c47e1d13b5b952554a3cd11e9

SHA256
203d50f49dfb9057c5c2122bae8e9c60b6846b7097f27a30c2a1d0bf499c79bb

SHA512
ae2310de190832b9702d7e1bf81161d31741f50519f8671976d684135705e73bebbe89f915ea4be35300eb0db31374430839f2bc570c18a87cf5b755dfecccbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
faf472573772d9fd3564b7e1dba62223

SHA1
e7a68e7daec062993a2b40222254d3cf1688123e

SHA256
61aa96caa12efc2e9c24ee48f238441a5ff0b0b87d825fa23977a1a15fff2980

SHA512
4dfd5981df83d8cb71c590b5d1b5f78463887e7f268e199549ae54afaaea86fee3a14c0f2901efa98116061fae51c3963cc2524659dd5fe40d981fcff5994c9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d299a678b32c39b04177e83451eeaa1f

SHA1
487c8edaa42f52b16b2007e15c0d21f0c2efd753

SHA256
420f6f4518bd63f141c580c1f73ab972f1ce2a659fe57bad9b8a0cbcbee82c67

SHA512
a4cb59bcbd4554242ca39f187f0df21c92c142b55a157fb40234108e03e1e6c0dc2ec89b205a58a5906d7ef9376c3ddb99392f144b78641ad6d41aee33b4ae1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
edab1b7216e1a230f312746f7859c1a3

SHA1
7c7b5cbfb89a7fc810fceac029c751b2064a96d0

SHA256
3b935b3a8a8daa1bfe8563039934fae7e6e8f41c3082e360354251d118c7a156

SHA512
30a3a0c706aa041a3c7e729d61664a11fb0762bd48feec2c6f7eb07d172c5dd4e06a82668d2107d36d58aff2591393397336dcff228fff4664154c52ae8f724d

Download Submit
\??\pipe\LOCAL\crashpad_8_WICXUHWLAWOTATDL

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit