3d8cad48be80a45e4581fb354326306093da4a4a4698db837a77e4f9273d0efa

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 12:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80b781e2b59482812d2f12fc414afa10_JaffaCakes118.html
Size

13KB
MD5

80b781e2b59482812d2f12fc414afa10
SHA1

7669cdca46c62163bb81bd2a61b79f528e32f17e
SHA256

3d8cad48be80a45e4581fb354326306093da4a4a4698db837a77e4f9273d0efa
SHA512

cd9c2f0094c1564c0b30b4d8dccfeb317b1907ce5b4de66d41fce5f23c246421d1643ea19f6877357fc3a2ecfda430a3044681ab14b5a2253c3d2623f10f7e07
SSDEEP

192:SAy2o/U0i9og/MisQrtypjCLFspTaiG7r:Dy2UU0E0hQJ3scv7r

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3068	msedge.exe
3068	msedge.exe
1692	msedge.exe
1692	msedge.exe
1220	identity_helper.exe
1220	identity_helper.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1732	1692	msedge.exe	83
PID 1692 wrote to memory of 1732	1692	msedge.exe	83
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 4808	1692	msedge.exe	84
PID 1692 wrote to memory of 3068	1692	msedge.exe	85
PID 1692 wrote to memory of 3068	1692	msedge.exe	85
PID 1692 wrote to memory of 760	1692	msedge.exe	86
PID 1692 wrote to memory of 760	1692	msedge.exe	86
PID 1692 wrote to memory of 760	1692	msedge.exe	86
PID 1692 wrote to memory of 760	1692	msedge.exe	86
PID 1692 wrote to memory of 760	1692	msedge.exe	86
PID 1692 wrote to memory of 760	1692	msedge.exe	86
PID 1692 wrote to memory of 760	1692	msedge.exe	86
PID 1692 wrote to memory of 760	1692	msedge.exe	86
PID 1692 wrote to memory of 760	1692	msedge.exe	86
PID 1692 wrote to memory of 760	1692	msedge.exe	86
PID 1692 wrote to memory of 760	1692	msedge.exe	86
PID 1692 wrote to memory of 760	1692	msedge.exe	86
PID 1692 wrote to memory of 760	1692	msedge.exe	86
PID 1692 wrote to memory of 760	1692	msedge.exe	86
PID 1692 wrote to memory of 760	1692	msedge.exe	86
PID 1692 wrote to memory of 760	1692	msedge.exe	86
PID 1692 wrote to memory of 760	1692	msedge.exe	86
PID 1692 wrote to memory of 760	1692	msedge.exe	86
PID 1692 wrote to memory of 760	1692	msedge.exe	86
PID 1692 wrote to memory of 760	1692	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\80b781e2b59482812d2f12fc414afa10_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3ad546f8,0x7ffa3ad54708,0x7ffa3ad54718
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,10935825352367291864,17890664280437317782,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,10935825352367291864,17890664280437317782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,10935825352367291864,17890664280437317782,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10935825352367291864,17890664280437317782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10935825352367291864,17890664280437317782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,10935825352367291864,17890664280437317782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,10935825352367291864,17890664280437317782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10935825352367291864,17890664280437317782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10935825352367291864,17890664280437317782,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10935825352367291864,17890664280437317782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10935825352367291864,17890664280437317782,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,10935825352367291864,17890664280437317782,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4180 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
250B

MD5
77c1e0a000829368514c407038496655

SHA1
1b0474c9071910c9ecb49f9db9c8c418bb6f58a4

SHA256
b5b8fd3795f424573b40d3d3a2ef1d419089fec383fb0a8b1cf0912069ceb387

SHA512
b785bd47ba852ad2a550c31fae0845310202efe9415be0dd6c1e862bc09f13015c0fa7e9180d43c40ece99e52ef5c2cc4dbfaa22c83baade4759278f1c19404c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bfd60c71905788d81d8a1e5843a258a6

SHA1
805c36e762c840b2d5dd71149a63e08927d3a2a1

SHA256
d86e38db81a0fce61b9860adc329f44a635ad2b8021eea14355a99d03a18c76f

SHA512
b0171b2940467b80142bb910c876d58d0f23d3b8eb5031de1814eea56ebb0badff5b3df0b62d6d107d9bdfc8cfd42dbbf3f2e45fc4d1b5ba8924287b0c8f79a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6408de25940ce849c0c2218e207426cc

SHA1
b9965bdd8a29c43197d3857b2d70b86573a8fd3f

SHA256
f77325240d8964def7fcfc3e15e6165c72ea9053f8172c3428bc9e03112cc38c

SHA512
d8e37ca18bda2bdea63701df8485f2f26e91f2a6abb484c12c5a8cbfe8dc0f225de04d711c2abdf6d78363aca5c22cf3cd3faff5e45c9e776619e831fe803f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c1c646b0a0b9c608756597f6a7630f8c

SHA1
1e3a7bd4c87f1587c61d28905a5d31347df98701

SHA256
ba8e132b33ce5bf6fe006ddddf12fe5c4c0d1984bc2cb710a71ba435fbd6830d

SHA512
9ab33a61b69405c3f21756e4a605a9a7683f6f296d02de563beba7253a87ed6f07ce8b106d8a139be40b7a2a21e8384b919f4a4cdaa05c0051069120bb90666f

Download Submit