8837531aac0f51207239c06271cdcfbb01e912b9505316e41e5b58621e71b955

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 11:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

672609409a98f12c3d00214923d2bcf7_JaffaCakes118.html
Size

31KB
MD5

672609409a98f12c3d00214923d2bcf7
SHA1

0e02349ebb6b863579b4f6e3900ea40047331ce5
SHA256

8837531aac0f51207239c06271cdcfbb01e912b9505316e41e5b58621e71b955
SHA512

25e358dbf4dd22c441dc7ef5428c139c4808b13fcb67f99ea3194203820d257f673b215d44691c06b300b6120544762eea1f5ed8574dd8f0af8d94d91ab3bcfa
SSDEEP

768:hLKBTsnkH+PJjPl+eu1C5h4hcJ302zi2aDubNz8HUF+bCjJwNEgdDzSJIA6DjNQC:AdsnkH+PJjPl+eu1C5h4hcJ30Ii2h8Hv

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
3916	msedge.exe
3916	msedge.exe
1756	identity_helper.exe
1756	identity_helper.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 2128	3916	msedge.exe	83
PID 3916 wrote to memory of 2128	3916	msedge.exe	83
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2508	3916	msedge.exe	84
PID 3916 wrote to memory of 2516	3916	msedge.exe	85
PID 3916 wrote to memory of 2516	3916	msedge.exe	85
PID 3916 wrote to memory of 1528	3916	msedge.exe	86
PID 3916 wrote to memory of 1528	3916	msedge.exe	86
PID 3916 wrote to memory of 1528	3916	msedge.exe	86
PID 3916 wrote to memory of 1528	3916	msedge.exe	86
PID 3916 wrote to memory of 1528	3916	msedge.exe	86
PID 3916 wrote to memory of 1528	3916	msedge.exe	86
PID 3916 wrote to memory of 1528	3916	msedge.exe	86
PID 3916 wrote to memory of 1528	3916	msedge.exe	86
PID 3916 wrote to memory of 1528	3916	msedge.exe	86
PID 3916 wrote to memory of 1528	3916	msedge.exe	86
PID 3916 wrote to memory of 1528	3916	msedge.exe	86
PID 3916 wrote to memory of 1528	3916	msedge.exe	86
PID 3916 wrote to memory of 1528	3916	msedge.exe	86
PID 3916 wrote to memory of 1528	3916	msedge.exe	86
PID 3916 wrote to memory of 1528	3916	msedge.exe	86
PID 3916 wrote to memory of 1528	3916	msedge.exe	86
PID 3916 wrote to memory of 1528	3916	msedge.exe	86
PID 3916 wrote to memory of 1528	3916	msedge.exe	86
PID 3916 wrote to memory of 1528	3916	msedge.exe	86
PID 3916 wrote to memory of 1528	3916	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\672609409a98f12c3d00214923d2bcf7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef86946f8,0x7ffef8694708,0x7ffef8694718
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,5453359094694176538,12824417093666821638,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,5453359094694176538,12824417093666821638,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,5453359094694176538,12824417093666821638,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5453359094694176538,12824417093666821638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5453359094694176538,12824417093666821638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,5453359094694176538,12824417093666821638,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,5453359094694176538,12824417093666821638,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5453359094694176538,12824417093666821638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5453359094694176538,12824417093666821638,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5453359094694176538,12824417093666821638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5453359094694176538,12824417093666821638,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,5453359094694176538,12824417093666821638,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4016 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
409B

MD5
6c5fa71cd8e8ffb2c67aaf58e33ac9dc

SHA1
29d58a8e991a8bb982203e3ac3e443be6886f0f2

SHA256
4f7c5b35cb947b8e24f3bb59b4c5ccec5c823c804c57767466bdb73acae2b5f8

SHA512
6cdbb2e8c6dca35aa4fc0dc38136c943e2e74b7e25b3e73ebbc72c7ea72d83fcb2bf35755db7197bbbb1764d367cfc2e7a8a54ded5416f6cc21902b481242d76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9e0a2b25af2c50f0292e46cd0c00bf47

SHA1
55f16dd89b4a6ba0c6e8a9b5a4601b8a8f06f4db

SHA256
55b051e05fba7e3190259e582940d6d571d470263baf7b9cb38f3230de332008

SHA512
72602b1426691e4ca403bc64b5757b87eaf931dcd974cf592edb9c08ab93398d3d2fda9b5e21f381db403688997a99e88a50ccea8e9937668e3a1ede54e50063

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
28148ef889cd9a43c6048d993fab7cc4

SHA1
7731b00c9c2f8a851e6a648d38cbc6b6c277714a

SHA256
324bf3af2454d26f883755a3d3e695550a41aa926142298079078f6e19b1e69b

SHA512
cc85e55eb08b72d84d8d2c534a1d561be1810654def54a0eec52c200e7e811c13e1c28de242b0c44a6019712cb299a2839d1389bac54784ca2b3a41b41cf3656

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2127a5addaa0629d5f74128bc9e75648

SHA1
a5cdc38eee3bbe5f06bd96a2ab7de670b0d27f60

SHA256
a2f0c3f0e6f188cf3bbf03f6d432c976a6379dfdcba58ccda58397e3dd1d5a79

SHA512
a50320ad7a21133416e7934d93688cc81f9ca9caa57460877b86c0a5c6f9087978fd81a13941334ca0785258ecdfd087cb533ae9636ccc7693e4de1f8ecf59b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
40583783644383498efe697040d293a4

SHA1
d77e1df4e2767a3d1657968d85367a9ee00414b2

SHA256
565dd4221c3bec74a218d422e9aeac6fa17003985b95df66a631aacc1a50a6f1

SHA512
eea316be067ea13c3764168fc474014bb5837bf8d1199d15977ceb67805986e07ce6887105777fcba66a855a551133cbe7526723bfdccb0d705e888a93f4ba4a

Download Submit