8ba5a51275dd79c0a8945f22c1c2667b478281ad8b7de7676851ca361bc92274

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 08:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8022d4dbd6c7278ce33385d552a95cca_JaffaCakes118.html
Size

207KB
MD5

8022d4dbd6c7278ce33385d552a95cca
SHA1

886292157f64bc5518d051e4ba7cc41adca4a750
SHA256

8ba5a51275dd79c0a8945f22c1c2667b478281ad8b7de7676851ca361bc92274
SHA512

3caa1ca6a5833802b2cd197e8af4b1e34271fc92bcf3ffb593e954844a8356e1db1b958460f67ca9f89ef433894af72bf4cc492c7d0ace0b9be6b6d041ae3c0a
SSDEEP

6144:J530DH6NEQwjcHXxQRVufJc/09z1kZV52:JuDHQmjcxQRVufJc/b2

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4688	msedge.exe
4688	msedge.exe
4604	msedge.exe
4604	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 1356	4604	msedge.exe	82
PID 4604 wrote to memory of 1356	4604	msedge.exe	82
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 3452	4604	msedge.exe	83
PID 4604 wrote to memory of 4688	4604	msedge.exe	84
PID 4604 wrote to memory of 4688	4604	msedge.exe	84
PID 4604 wrote to memory of 1624	4604	msedge.exe	85
PID 4604 wrote to memory of 1624	4604	msedge.exe	85
PID 4604 wrote to memory of 1624	4604	msedge.exe	85
PID 4604 wrote to memory of 1624	4604	msedge.exe	85
PID 4604 wrote to memory of 1624	4604	msedge.exe	85
PID 4604 wrote to memory of 1624	4604	msedge.exe	85
PID 4604 wrote to memory of 1624	4604	msedge.exe	85
PID 4604 wrote to memory of 1624	4604	msedge.exe	85
PID 4604 wrote to memory of 1624	4604	msedge.exe	85
PID 4604 wrote to memory of 1624	4604	msedge.exe	85
PID 4604 wrote to memory of 1624	4604	msedge.exe	85
PID 4604 wrote to memory of 1624	4604	msedge.exe	85
PID 4604 wrote to memory of 1624	4604	msedge.exe	85
PID 4604 wrote to memory of 1624	4604	msedge.exe	85
PID 4604 wrote to memory of 1624	4604	msedge.exe	85
PID 4604 wrote to memory of 1624	4604	msedge.exe	85
PID 4604 wrote to memory of 1624	4604	msedge.exe	85
PID 4604 wrote to memory of 1624	4604	msedge.exe	85
PID 4604 wrote to memory of 1624	4604	msedge.exe	85
PID 4604 wrote to memory of 1624	4604	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8022d4dbd6c7278ce33385d552a95cca_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe344246f8,0x7ffe34424708,0x7ffe34424718
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16983474063764563788,5214963160347107656,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,16983474063764563788,5214963160347107656,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,16983474063764563788,5214963160347107656,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16983474063764563788,5214963160347107656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16983474063764563788,5214963160347107656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16983474063764563788,5214963160347107656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16983474063764563788,5214963160347107656,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4060 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7c6154d439f9c36fe759bd6833092d50

SHA1
fdcf79ab297c37acbc3f5790a9b7d4cdc14b052f

SHA256
157590e697c2b387beec8af8a07fed0f092ed0094c660c5b54600ec4e50374f1

SHA512
6b26fb1ce35157ad3e7987b495d73e6a94891ff21681876e7e71b50582d88bf4fbe68809cd2e3a10f8704217fa6b74b1f04b82b35ea6ea4c6bc0a666c490d408

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1b8c2812d69836a1b95c194b943e5652

SHA1
052d34c109075b2a0783bc20bbbf6a74687da48c

SHA256
285a4d0added0ca4d3c04163365cb72ae9e3c716605e99f519a321a9dc2aa0f8

SHA512
431f26b2a6682facd168d829ef71eec58a97848a3d9fdb08429c39d2cd7f4560906e6271f6205a4f5f7632b2a1288e3017e7962a14b491cf08488e31e5a64eaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
af5655727cb916901c3d9ae6b3395435

SHA1
08fe1ed4381f4173746b9eb07fc4f2103b219907

SHA256
06bf7120274d8db7ccbe8f50f5c4a53c89cad7ec0565fd07afa9db1fc35daf09

SHA512
b016e07245a88e7a6c9489ba65fa973b14a06c77776927ff541a30ebc84bd3182b05bf771fe03a5380152f36d1bbdccd83027b44e01484ef990e1c86e76c1f1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
41353af34eb1bad7ad93605ccaafec6c

SHA1
3a75090e024b478f1f46fd3d8172d573d1f6e7f4

SHA256
0dddacb481bbad7935c510ee574edd748a5fcdeffd4783e6588645d652b2fce0

SHA512
16e25027adc55fd0ed8b51339a44f3b921efd09b846f97ce20bd2ccc9a1b4b8ee71899f6dca64a10d2a8f6d8070dfe99de7c25db398766f3a723b86620a507f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
172daec5d642f3cb9d822ad4b40ce0aa

SHA1
6a7648a25205a79de386c4a2a4185c45659ff7fd

SHA256
626181460336b69aa8a26a0ad744d475c7f2788e4cdd1b30d6c2c6a397326a25

SHA512
b81e05371799da9da631fb369c6ff3f78d14401e88a39afe0a4ef1aad18ac5f12ffcbb30d27b2df02926a47ec12b969f283720025249f68549ee24294591c1e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a037.TMP

Filesize
707B

MD5
4501d223f5d1d1ca0e62143b09a92257

SHA1
d5760728fb14c86f33e600acf6ae9a8cde3072ba

SHA256
21358107f23fbaf409b7911e8c8d75be111bb5bdef52e318177e10e850a6c867

SHA512
5e2fb07004416e625f32d4fe5aaf73cb4032a60f25bd75f157f8b65620410db3ff43175213c6557aefd8366e976bdbdaddf7f16cc032c45aac35509c7e69ea41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
88f529b361de347cecd8822c0fbdf570

SHA1
75de9dac1a61945b21f6e06bf3bc5fbf4790c898

SHA256
74863b6e32d0feb48fe557b1a720414fb4620916be49cde04ebda212f6733f50

SHA512
2530bf14a6fd022f2cd028e4063213a8b464efbc672793b7cec13519c6ef08d7f29e09cdbd74d552c0406051e85735acddbd315e9a0e7bf82c0ac6b63320bdd9

Download Submit