da35d69d9e62a2f5ab15584a8fa91ad06828865b524400b2873addae70955c9e

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 04:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7bafa761e3de219088f39abdf9d37f23_JaffaCakes118.html
Size

113KB
MD5

7bafa761e3de219088f39abdf9d37f23
SHA1

7265435b54328be0ab89522d64cb327d6e0f75b8
SHA256

da35d69d9e62a2f5ab15584a8fa91ad06828865b524400b2873addae70955c9e
SHA512

f8aa9f09be7930a4a037a3d63905b7a2928f435e295141d517cb67b5e79e7f2eafd05bd6dc63b553cd060b139dbb472033d8e488be3217fdb197daba309502e4
SSDEEP

3072:GFFgNAH6xdMTCLy5ViDGBBiMpZksVSkD4cjckpJ0IRZQ/tow:1ce

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2664	msedge.exe
2664	msedge.exe
3872	msedge.exe
3872	msedge.exe
1168	identity_helper.exe
1168	identity_helper.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 940	3872	msedge.exe	83
PID 3872 wrote to memory of 940	3872	msedge.exe	83
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 4132	3872	msedge.exe	84
PID 3872 wrote to memory of 2664	3872	msedge.exe	85
PID 3872 wrote to memory of 2664	3872	msedge.exe	85
PID 3872 wrote to memory of 2560	3872	msedge.exe	86
PID 3872 wrote to memory of 2560	3872	msedge.exe	86
PID 3872 wrote to memory of 2560	3872	msedge.exe	86
PID 3872 wrote to memory of 2560	3872	msedge.exe	86
PID 3872 wrote to memory of 2560	3872	msedge.exe	86
PID 3872 wrote to memory of 2560	3872	msedge.exe	86
PID 3872 wrote to memory of 2560	3872	msedge.exe	86
PID 3872 wrote to memory of 2560	3872	msedge.exe	86
PID 3872 wrote to memory of 2560	3872	msedge.exe	86
PID 3872 wrote to memory of 2560	3872	msedge.exe	86
PID 3872 wrote to memory of 2560	3872	msedge.exe	86
PID 3872 wrote to memory of 2560	3872	msedge.exe	86
PID 3872 wrote to memory of 2560	3872	msedge.exe	86
PID 3872 wrote to memory of 2560	3872	msedge.exe	86
PID 3872 wrote to memory of 2560	3872	msedge.exe	86
PID 3872 wrote to memory of 2560	3872	msedge.exe	86
PID 3872 wrote to memory of 2560	3872	msedge.exe	86
PID 3872 wrote to memory of 2560	3872	msedge.exe	86
PID 3872 wrote to memory of 2560	3872	msedge.exe	86
PID 3872 wrote to memory of 2560	3872	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7bafa761e3de219088f39abdf9d37f23_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfb5346f8,0x7ffdfb534708,0x7ffdfb534718
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,6626912505543529252,9592194401181793358,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,6626912505543529252,9592194401181793358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,6626912505543529252,9592194401181793358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6626912505543529252,9592194401181793358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3088 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6626912505543529252,9592194401181793358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,6626912505543529252,9592194401181793358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,6626912505543529252,9592194401181793358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6626912505543529252,9592194401181793358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6626912505543529252,9592194401181793358,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6626912505543529252,9592194401181793358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6626912505543529252,9592194401181793358,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,6626912505543529252,9592194401181793358,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f5bf9795be52cf50725957a7e78e20da

SHA1
8fe6165eaa32116b587d4fc416ceb744d02b406a

SHA256
ba518d1882e066d2aff431e030df945166c7dbf6cf1fa648474edf00ea2b0195

SHA512
8fa319eae39393e206e2f0b99d6d8e4724adaa91ca2668e2c47d6ccf491660b23ee7107de6183653a4b73fad0658908f9b70506e2f261ff442f0734d9788cb12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
55ca410ac4d7b8e5c85b94134dbf5ebc

SHA1
1e981b2c1548744462580c7216752114f4ce0fd3

SHA256
5238816d8d8f7ac9f22240e1e58c1698c506819a0ef72cae2004d0978b250bf8

SHA512
02a33eb0f0d69d0af1da7df5b290e14351f0535a4a4c8175b90b936c41ac31e3f3ca0b2309be690c8daece5004d8ec93addf37ad4cdba5e11c9736ffcd8faa16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ca8d7244f12de486845eb716d44cb272

SHA1
f77685f4f47cb07f349b3024e96640976d2abfba

SHA256
68ed9e9f78022de4847ba12f6dda291a8736045e35c21e61936dff898695089d

SHA512
92aaaf7631ac03295ef3e352d21f2da79c392e973a5c2bf0d462b42ed2d16b9e8af9cbddbc39d597f2771d066dd957d826389b75d28fe655d34876e7ff9ce913

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8439a90679429a2e3f233bfc92d3a9b2

SHA1
1e1315724c34dcbe3411c6f036e5b73b1dc6b0ab

SHA256
af23436f8f451143217de174c51c8cd7f205c73cd06f135c712521e7f5630db3

SHA512
a0e4790aadab627cbbff420be86a66d79f85bc1f94e68429e20bd83086010f0182ddd709d37b960057c00a6bf7af75c520bb92deaa12f3a542639821f1985e09

Download Submit