319dc3cd6f013190c5a619881db281610f9527f731b6a2d9b034e742f23e29cd

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 03:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77bac507ba3bd6365521b1af48d9e35d_JaffaCakes118.html
Size

17KB
MD5

77bac507ba3bd6365521b1af48d9e35d
SHA1

211797f569e704c42c71c1756ab6afe8a9f94b39
SHA256

319dc3cd6f013190c5a619881db281610f9527f731b6a2d9b034e742f23e29cd
SHA512

166a7502500899c23555ba56386e21f87f37f86a16ad29d46474372b62bfe5aba6e195307080c7fdc38d6322afa1c8417732309e4d8a236f7b7c90ddfcb1700e
SSDEEP

384:pzQQo3vabobjQMnw+FK3q7+FRuR2XRBR+R0RHupq0R9KxC6RjxDJlwlfQ/QqSguE:pcQo3vabobjQMnw+Y67+FRuR2XRBR+RE

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
888	msedge.exe
888	msedge.exe
3364	msedge.exe
3364	msedge.exe
1672	identity_helper.exe
1672	identity_helper.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 2368	3364	msedge.exe	83
PID 3364 wrote to memory of 2368	3364	msedge.exe	83
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 1712	3364	msedge.exe	84
PID 3364 wrote to memory of 888	3364	msedge.exe	85
PID 3364 wrote to memory of 888	3364	msedge.exe	85
PID 3364 wrote to memory of 1148	3364	msedge.exe	86
PID 3364 wrote to memory of 1148	3364	msedge.exe	86
PID 3364 wrote to memory of 1148	3364	msedge.exe	86
PID 3364 wrote to memory of 1148	3364	msedge.exe	86
PID 3364 wrote to memory of 1148	3364	msedge.exe	86
PID 3364 wrote to memory of 1148	3364	msedge.exe	86
PID 3364 wrote to memory of 1148	3364	msedge.exe	86
PID 3364 wrote to memory of 1148	3364	msedge.exe	86
PID 3364 wrote to memory of 1148	3364	msedge.exe	86
PID 3364 wrote to memory of 1148	3364	msedge.exe	86
PID 3364 wrote to memory of 1148	3364	msedge.exe	86
PID 3364 wrote to memory of 1148	3364	msedge.exe	86
PID 3364 wrote to memory of 1148	3364	msedge.exe	86
PID 3364 wrote to memory of 1148	3364	msedge.exe	86
PID 3364 wrote to memory of 1148	3364	msedge.exe	86
PID 3364 wrote to memory of 1148	3364	msedge.exe	86
PID 3364 wrote to memory of 1148	3364	msedge.exe	86
PID 3364 wrote to memory of 1148	3364	msedge.exe	86
PID 3364 wrote to memory of 1148	3364	msedge.exe	86
PID 3364 wrote to memory of 1148	3364	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\77bac507ba3bd6365521b1af48d9e35d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa94c146f8,0x7ffa94c14708,0x7ffa94c14718
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13475667558924617175,8676289842224604310,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,13475667558924617175,8676289842224604310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,13475667558924617175,8676289842224604310,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13475667558924617175,8676289842224604310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13475667558924617175,8676289842224604310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,13475667558924617175,8676289842224604310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,13475667558924617175,8676289842224604310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13475667558924617175,8676289842224604310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13475667558924617175,8676289842224604310,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13475667558924617175,8676289842224604310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13475667558924617175,8676289842224604310,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13475667558924617175,8676289842224604310,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5936 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
50617c314b51680322b5d870f2d746cb

SHA1
dec9c664fff1d21616b2554ee9ffdbf771f9cc68

SHA256
9d5177e2ee02174e1d63a32d51e1dabd6c23c0eee7959ec7c76cc8b51737e06d

SHA512
94b4d645db778c408b25492d01c272fb85497e1eaa65ba940c684fbb4d326bdcf4674ec0a4dd5382a3d5269a3110f29a5f18d817d891799a4752ef8045d5dd22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4667d622095bd6b7a6362bfc348d8232

SHA1
12b1669de863792b9a494abac8c0afb3e048cb98

SHA256
58de3574d96d9a3ce60dc973c2c50239fa6a83e4652790c986f1b8d2e611296b

SHA512
289d8b886f649e8bfb70915be9e55ccd06ded1cf907c1745625cc7e85bbd7a598ef755eae19c777411786195a744494da5aa7b0d1549f85fcfb280cf21a31364

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
adc5c1248b2e330cda632791bb327874

SHA1
cff06a953a40b81521a5e89ff7ea093687c6e8c5

SHA256
8829ab44f89fb6b924c65a9bc2913fd60e5340ad841500f07b6867bc2ce59a51

SHA512
862d0d878ad3e83aaad68fb341de7aa7d949ff6bdeef862f5f675763b830edd705bb8278b0cc3398ddb11d919fc49dcda246dff0c76d5e655834242bd535d86b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b2e0ef5ec6569064acdb663e87986eea

SHA1
75b43cb91c5c4c56b212e2944ab571236d296f67

SHA256
1e180c2ab70aba9adea40607bb7f7c0a201ace097064a32ff03f33b171176f1b

SHA512
dca9d37504766c51bd2c508d3cb04bc37d13c4f53a6e6bd4bc6d6828fb6af5c8b3654905b607c5397d181c091bab2890fa9f27d6d0fa433fc4969a9b2b5fce02

Download Submit