5378b5c3d5a80fb9d018056254d9dcfdfcf6fc68bbe27148b8e9fd941b6d06c3

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

80b530a3303635dda35b635c6e39b6c8_JaffaCakes118.html
Size

125KB
MD5

80b530a3303635dda35b635c6e39b6c8
SHA1

0dc5cb16e61a0d9deb613a42769831247c25b043
SHA256

5378b5c3d5a80fb9d018056254d9dcfdfcf6fc68bbe27148b8e9fd941b6d06c3
SHA512

e280e67eed71016161fb7fd634b5f428e179a87fed45dbf4d974c167b1bc4f9863b2f30f2f41b42acbd4a89780175f5ab69c8f1f1498ad0251e03194562d45c6
SSDEEP

1536:+OAtHeh5E77wwTTwwppnnKKxxnnggFFkkttbbRRUU55ll66qqoo99pphhNNYc0ra:atHeATmq5gIf0MlcsEirtwo

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1472	msedge.exe
1472	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2776	identity_helper.exe
2776	identity_helper.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2324	2968	msedge.exe	82
PID 2968 wrote to memory of 2324	2968	msedge.exe	82
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1128	2968	msedge.exe	83
PID 2968 wrote to memory of 1472	2968	msedge.exe	84
PID 2968 wrote to memory of 1472	2968	msedge.exe	84
PID 2968 wrote to memory of 4472	2968	msedge.exe	85
PID 2968 wrote to memory of 4472	2968	msedge.exe	85
PID 2968 wrote to memory of 4472	2968	msedge.exe	85
PID 2968 wrote to memory of 4472	2968	msedge.exe	85
PID 2968 wrote to memory of 4472	2968	msedge.exe	85
PID 2968 wrote to memory of 4472	2968	msedge.exe	85
PID 2968 wrote to memory of 4472	2968	msedge.exe	85
PID 2968 wrote to memory of 4472	2968	msedge.exe	85
PID 2968 wrote to memory of 4472	2968	msedge.exe	85
PID 2968 wrote to memory of 4472	2968	msedge.exe	85
PID 2968 wrote to memory of 4472	2968	msedge.exe	85
PID 2968 wrote to memory of 4472	2968	msedge.exe	85
PID 2968 wrote to memory of 4472	2968	msedge.exe	85
PID 2968 wrote to memory of 4472	2968	msedge.exe	85
PID 2968 wrote to memory of 4472	2968	msedge.exe	85
PID 2968 wrote to memory of 4472	2968	msedge.exe	85
PID 2968 wrote to memory of 4472	2968	msedge.exe	85
PID 2968 wrote to memory of 4472	2968	msedge.exe	85
PID 2968 wrote to memory of 4472	2968	msedge.exe	85
PID 2968 wrote to memory of 4472	2968	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\80b530a3303635dda35b635c6e39b6c8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9aba546f8,0x7ff9aba54708,0x7ff9aba54718
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,10287677242420561295,1099434902429105750,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,10287677242420561295,1099434902429105750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,10287677242420561295,1099434902429105750,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10287677242420561295,1099434902429105750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10287677242420561295,1099434902429105750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,10287677242420561295,1099434902429105750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,10287677242420561295,1099434902429105750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10287677242420561295,1099434902429105750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2812 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10287677242420561295,1099434902429105750,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10287677242420561295,1099434902429105750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10287677242420561295,1099434902429105750,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,10287677242420561295,1099434902429105750,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
592B

MD5
76f84ac3dc084dacc783ab9597661cc8

SHA1
2d5f9f166e7e5d032009a8094bbf0a67b1df9b0a

SHA256
82bd02368ad9c98acd8b5c09b9d3e34b8979a5032a84e0580ee35ddd12b08204

SHA512
5d7089bceb347867bd185e4eb0872bd6fd782a1a3f1f3a552f577d6cdf83e8e72d00c588aea49a025bfe25fe1d59e2a1be5e421f49930a9544dc587810fa177d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
51dd90d0e155552ef962c803ba45489e

SHA1
1d93ad003bbd6decfb2b485ffd6040e46de1e912

SHA256
a8513d0de14432d0f0f300e58aaea03bbfe64dbdac4dc392ac50ccdbc791562e

SHA512
a20a359f7580a5569701247153b30ba2ba59f7783383411f7a0d42f5aec44bc1535e5cc88a5a85d7d9fd2019dc1b44b596835cd63100c31730bb3e40c05a8ab7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6762e2aa5452c1fa8662690f50a51396

SHA1
5fc04b6b250c8b2700236de4cb10e32acadab468

SHA256
8b10a798552e92e27e52016bbdfe5dbb36bd9d6426c3c9aa2790621817d9cd84

SHA512
0ea6af37c7ff640b528bc8e7e16cda524a0c65371dfffc1fac27deabf20258c5d1fff66e091e973a2639e30e9a8a8aa6c98f4ac02132cb4e1226dc42447ba5b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d5959ad5a34f3fb47f474154118ed967

SHA1
a2218e04051db7c253f29ae6eeb9cd8811685d66

SHA256
b4dda90c49eacacafbdf797268eee1b91422a95c3c2d57fe7d1d65b49762a17e

SHA512
079977baff0504ee94b4628645018e217c67eb7fb8479b50098fbb283f0556b8ce01b3f8a94f44d29db42f0c5eb4de7735885e1b3a52fe256e00888ec4388558

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7cc2c959c9d9a400d179e03d9dc4b5b4

SHA1
1a497c2a7c307bb43ff09608bbc16529d6cad456

SHA256
e6b4a99cc1f1ccbf246a25d72d46b7836d0365435abcfdf2c8628fe9a9671732

SHA512
50d279332ec9973b2d05c5d8cc599bbb93c56e1b900268c305e8b35c2cbc49d1426ddd5a33ce2074a1033eeab6e3b16f0ec0d8bd8e04b74cb8a498ef9f56799e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c870105129c4b3b7d12bbf984c4fcba7

SHA1
9a71a56e032108f540eaa893fe8057dfa33664a3

SHA256
d67f6ee76c3fa5f2a2dc85a25a3cc4b6c20aac2193dff5d4cf451e10c23a3eb7

SHA512
9a822a663fb1fbaa3313ba2a4de7687cbf88b909ea2a2fd9eaaf8b56671baeafd58e7f1d9981a3471a380b2db96f846af8a4aab732d182a617e2ef05294a113f

Download Submit