48027e1578b85393bad5eda44c0065a9a5b9eca2f64574a4b3d18129cd306a17

Analysis

max time kernel
145s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 01:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f0b2fdc6046cac037fd138253a69f44_JaffaCakes118.html
Size

23KB
MD5

7f0b2fdc6046cac037fd138253a69f44
SHA1

faf503106ef81b014899ae7d0585ade08a16db5b
SHA256

48027e1578b85393bad5eda44c0065a9a5b9eca2f64574a4b3d18129cd306a17
SHA512

f633bcf8946919192c863343ea720ddd51ced97a993aabd27d201b094a36c7e907eba5007127197b937a6aa8f7d15df3e70a84b490fb346e527063da7cea01ec
SSDEEP

192:uWL0b5n2unQjxn5Q/hnQieUNn2Q5nQOkEntPTnQTbnRnQWCnQtOwMB0qnYnQ7tnH:HQ/AQ7/GVg77

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
3212	msedge.exe
3212	msedge.exe
932	identity_helper.exe
932	identity_helper.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 1220	3212	msedge.exe	83
PID 3212 wrote to memory of 1220	3212	msedge.exe	83
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 4852	3212	msedge.exe	84
PID 3212 wrote to memory of 2004	3212	msedge.exe	85
PID 3212 wrote to memory of 2004	3212	msedge.exe	85
PID 3212 wrote to memory of 1256	3212	msedge.exe	86
PID 3212 wrote to memory of 1256	3212	msedge.exe	86
PID 3212 wrote to memory of 1256	3212	msedge.exe	86
PID 3212 wrote to memory of 1256	3212	msedge.exe	86
PID 3212 wrote to memory of 1256	3212	msedge.exe	86
PID 3212 wrote to memory of 1256	3212	msedge.exe	86
PID 3212 wrote to memory of 1256	3212	msedge.exe	86
PID 3212 wrote to memory of 1256	3212	msedge.exe	86
PID 3212 wrote to memory of 1256	3212	msedge.exe	86
PID 3212 wrote to memory of 1256	3212	msedge.exe	86
PID 3212 wrote to memory of 1256	3212	msedge.exe	86
PID 3212 wrote to memory of 1256	3212	msedge.exe	86
PID 3212 wrote to memory of 1256	3212	msedge.exe	86
PID 3212 wrote to memory of 1256	3212	msedge.exe	86
PID 3212 wrote to memory of 1256	3212	msedge.exe	86
PID 3212 wrote to memory of 1256	3212	msedge.exe	86
PID 3212 wrote to memory of 1256	3212	msedge.exe	86
PID 3212 wrote to memory of 1256	3212	msedge.exe	86
PID 3212 wrote to memory of 1256	3212	msedge.exe	86
PID 3212 wrote to memory of 1256	3212	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7f0b2fdc6046cac037fd138253a69f44_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa82fd46f8,0x7ffa82fd4708,0x7ffa82fd4718
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,6814544714730316733,5412055719556967499,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,6814544714730316733,5412055719556967499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,6814544714730316733,5412055719556967499,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6814544714730316733,5412055719556967499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6814544714730316733,5412055719556967499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,6814544714730316733,5412055719556967499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,6814544714730316733,5412055719556967499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6814544714730316733,5412055719556967499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6814544714730316733,5412055719556967499,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2580 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6814544714730316733,5412055719556967499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6814544714730316733,5412055719556967499,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,6814544714730316733,5412055719556967499,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5040 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a069bbabca4898e92e428fd96f3fbb36

SHA1
efb8c212be9299c67bdd1711042d6fcf2279d664

SHA256
a08b002b1b429c9b4389237ff64224a0031ef26256baaabf227a5ed6d0aeb555

SHA512
58a603b41af8ffbccfe5e867aea399c16cff24ccb477e846905f525abfded0f123b5731d86827a7eae97e995127fe5b4c6e4676d3666a95af80a43b4f332a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3e14b9760a5ab21f435537e942d7c25b

SHA1
912f3b319dc4ef8ef497cae01a34caf3efcba0c6

SHA256
2056a6bf09f0e07f9b4a84a9b6a9b9351cdcc786233aaa9d012191d6602d3c44

SHA512
e2bd8e3f5b67e44f31b894e5d87698e717b919ceda87352bc8d86614300033e03fa5d3a8f61183377217935a22b422e350b4aa95bebff3985c9e40dc80f8c139

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1f4567884a8b060f71d2fb9d765305ca

SHA1
7515b1bab53d9933e2e5afbfcaed79306bf1c596

SHA256
a2630b482190125d765929423388162d9a3cadb56fedc841eeed9303ae3dbba0

SHA512
b043e37fba1ba9b74f313082d3f692677da1b362b11c29a57e8a6d26bc6b2e065244299aa1bfc0051c0d79633be35742f132eba89b5dcc566d5bbaac91380b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b4bc02a1c5053c0666897364f2fb5324

SHA1
89b47c0eb81dea4df37ffa2bebc25dc7c3087605

SHA256
a0727fb0eb52ed48c8f86c857bb3f42c2fd1cedacf3baa08cad9d4e578c7f588

SHA512
766613097d03a3cdff2a999aaf0b50fb46640ae7e68a9f805633b2532e2d4eec665e613b2aef31f5910734c8a3a47d99384e15799005d0c45dd2204f2342db3d

Download Submit