4afac28d4f0d972feb6799b693c38e858c134d39c66efaeaf5e3847240bceca1

Analysis

max time kernel
144s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 13:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

677b15002c422c69f9f3db1e4ee149e7_JaffaCakes118.html
Size

120KB
MD5

677b15002c422c69f9f3db1e4ee149e7
SHA1

4a02c895d31f2f4a598654b975d82ca09d33bf4e
SHA256

4afac28d4f0d972feb6799b693c38e858c134d39c66efaeaf5e3847240bceca1
SHA512

82093373e1eff1547a267455d653ea0e934f99be0f64a3d84085a884db8e66205d2e5ba109bead656e18c7434d7cad17fca87f56a9a724c5e8b96800925b8aec
SSDEEP

1536:S64U13qc5cnXbtL5U5LyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXu:SXiyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
2748	msedge.exe
2748	msedge.exe
1472	identity_helper.exe
1472	identity_helper.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 928	2748	msedge.exe	82
PID 2748 wrote to memory of 928	2748	msedge.exe	82
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 60	2748	msedge.exe	83
PID 2748 wrote to memory of 4116	2748	msedge.exe	84
PID 2748 wrote to memory of 4116	2748	msedge.exe	84
PID 2748 wrote to memory of 3760	2748	msedge.exe	85
PID 2748 wrote to memory of 3760	2748	msedge.exe	85
PID 2748 wrote to memory of 3760	2748	msedge.exe	85
PID 2748 wrote to memory of 3760	2748	msedge.exe	85
PID 2748 wrote to memory of 3760	2748	msedge.exe	85
PID 2748 wrote to memory of 3760	2748	msedge.exe	85
PID 2748 wrote to memory of 3760	2748	msedge.exe	85
PID 2748 wrote to memory of 3760	2748	msedge.exe	85
PID 2748 wrote to memory of 3760	2748	msedge.exe	85
PID 2748 wrote to memory of 3760	2748	msedge.exe	85
PID 2748 wrote to memory of 3760	2748	msedge.exe	85
PID 2748 wrote to memory of 3760	2748	msedge.exe	85
PID 2748 wrote to memory of 3760	2748	msedge.exe	85
PID 2748 wrote to memory of 3760	2748	msedge.exe	85
PID 2748 wrote to memory of 3760	2748	msedge.exe	85
PID 2748 wrote to memory of 3760	2748	msedge.exe	85
PID 2748 wrote to memory of 3760	2748	msedge.exe	85
PID 2748 wrote to memory of 3760	2748	msedge.exe	85
PID 2748 wrote to memory of 3760	2748	msedge.exe	85
PID 2748 wrote to memory of 3760	2748	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\677b15002c422c69f9f3db1e4ee149e7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff99546f8,0x7ffff9954708,0x7ffff9954718
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,10794921526083196060,6120273886347645877,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,10794921526083196060,6120273886347645877,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,10794921526083196060,6120273886347645877,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10794921526083196060,6120273886347645877,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10794921526083196060,6120273886347645877,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,10794921526083196060,6120273886347645877,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3728 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,10794921526083196060,6120273886347645877,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10794921526083196060,6120273886347645877,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10794921526083196060,6120273886347645877,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10794921526083196060,6120273886347645877,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10794921526083196060,6120273886347645877,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,10794921526083196060,6120273886347645877,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5420 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
8b3440f58ad2ea9a43d6c56965f40dd1

SHA1
f0ea0e2908d30beb6ef6923597f5213a7c4e0c8b

SHA256
1df2c6e107d6bce8d45c41733ea5baeef29d36e1f4490bf345c5534d779e58e5

SHA512
4bee09c1aebe5384370f48d55043761f040ac82e2c02055400fd291c6ad77917a06d6fd5fc44c1a7d1b770f91ad4da8ad05151fde9dbb288efe2474282a7b770

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
afbe1000bb3d4c36c8c71cc4406b62eb

SHA1
e290d367e5da10d3c2610dcfef79aae5c91e955c

SHA256
65451b91d7d69e62f3e71d8487d9faaf69e40688a70dbec124751a18d90cd9dc

SHA512
f0ebf020e0a2aea296e9568a490e07ce975c0392cd06ad01f719eaf81534bb35be09828cea8719599bd91f0b2f9d172873d2fc1f6bd81880f317f065dad61df4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
513ff0d6996c98635d125033a22edd38

SHA1
a7dc94dde22206dff988d789018e1dbe9319ef9d

SHA256
efc4c21d1647ab4b525030f241aae0a2d22724ee6047edfe406683abc4bfe752

SHA512
eae76ad91ae19627dd9185c228329bac22c5c8688fd927880cc0e305bc582288ffbef34a156068261a563ebb0e8c2a65fad29c054b8fe25db4ef4c70c49b4910

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
713bd73ac457a8f433f21aeddf1829e1

SHA1
be51718d2b0357ed764c557c813d0d9c65981179

SHA256
06d772d7f4c1f33366457ba225082fc084faf708277e5bd89fc19c34d32ebece

SHA512
cd47433b071cb96b049643d31798b1bb4d4cd0332a995c1ecac56b524baf2e23c40e8367502c653c71a10053a385827a51e3b0032d33b25b9a3ae076d9d45399

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7f62bad7dea196811e33789d803dbd71

SHA1
06edda24d763fbd62846a02daac47418a24d859b

SHA256
9c738a102c9d466a9a1a4d7c1a4ec125687cf42b295c1ac4faf351ead39c258c

SHA512
2397735511d0677f1bf57c5841742d105fcd6f38af57ca1482674c3850a70c27a475ec31d13b5b5edc66cd93135374b41f13262cea535e770c9c22bddeca416b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b00f33f7cc8a6eff1d3bcc2d1bff3b01

SHA1
25cdd638728ba7adccca84338932d3aa4ec1abc2

SHA256
92532a469d301ce0599cf3a48aea45ed7bfbce31852aa5502e3ff84f3a71bfde

SHA512
9bf659f8905910a5913d77c196d38abc3a74469b902cddd7925585e6f0817137771dbb923c7ee6fc4297b96db8a490358d033c0575d30a211bb56e8b971d21a9

Download Submit