475600ee58a4c2cbf5edb8e59dbaeee511224696cf0c4cd2dbf312f056d93e66

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 18:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

817e6c09f1124206be4a7bff118895eb_JaffaCakes118.html
Size

4KB
MD5

817e6c09f1124206be4a7bff118895eb
SHA1

53cf2aeb56e143c77ffb5c40d92bba8834f50b15
SHA256

475600ee58a4c2cbf5edb8e59dbaeee511224696cf0c4cd2dbf312f056d93e66
SHA512

0f1ec648e72f433d3a7fcb1acfb27dfb39af3e673d19cf08053598c2d780fa59a5eb8c4d72e141d23886f67f315d60ffdf44cc64d0e6183ccb7a84b86209e709
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oTX3yd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDH

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
3620	msedge.exe
3620	msedge.exe
3740	identity_helper.exe
3740	identity_helper.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 3956	3620	msedge.exe	84
PID 3620 wrote to memory of 3956	3620	msedge.exe	84
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 1056	3620	msedge.exe	85
PID 3620 wrote to memory of 5092	3620	msedge.exe	86
PID 3620 wrote to memory of 5092	3620	msedge.exe	86
PID 3620 wrote to memory of 3180	3620	msedge.exe	87
PID 3620 wrote to memory of 3180	3620	msedge.exe	87
PID 3620 wrote to memory of 3180	3620	msedge.exe	87
PID 3620 wrote to memory of 3180	3620	msedge.exe	87
PID 3620 wrote to memory of 3180	3620	msedge.exe	87
PID 3620 wrote to memory of 3180	3620	msedge.exe	87
PID 3620 wrote to memory of 3180	3620	msedge.exe	87
PID 3620 wrote to memory of 3180	3620	msedge.exe	87
PID 3620 wrote to memory of 3180	3620	msedge.exe	87
PID 3620 wrote to memory of 3180	3620	msedge.exe	87
PID 3620 wrote to memory of 3180	3620	msedge.exe	87
PID 3620 wrote to memory of 3180	3620	msedge.exe	87
PID 3620 wrote to memory of 3180	3620	msedge.exe	87
PID 3620 wrote to memory of 3180	3620	msedge.exe	87
PID 3620 wrote to memory of 3180	3620	msedge.exe	87
PID 3620 wrote to memory of 3180	3620	msedge.exe	87
PID 3620 wrote to memory of 3180	3620	msedge.exe	87
PID 3620 wrote to memory of 3180	3620	msedge.exe	87
PID 3620 wrote to memory of 3180	3620	msedge.exe	87
PID 3620 wrote to memory of 3180	3620	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\817e6c09f1124206be4a7bff118895eb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc114846f8,0x7ffc11484708,0x7ffc11484718
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,2920743476654510742,2996888629169251430,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,2920743476654510742,2996888629169251430,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,2920743476654510742,2996888629169251430,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2920743476654510742,2996888629169251430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2920743476654510742,2996888629169251430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,2920743476654510742,2996888629169251430,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,2920743476654510742,2996888629169251430,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2920743476654510742,2996888629169251430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2920743476654510742,2996888629169251430,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2920743476654510742,2996888629169251430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2920743476654510742,2996888629169251430,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2784 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,2920743476654510742,2996888629169251430,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1856 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
292B

MD5
eb866263295f4f7421e441e40f3b200b

SHA1
610be93837310649e801996aa636e13fb742fa84

SHA256
fd52635bbbaa799d8c7da81914353f671f2ffaaa84f1a6fa5d316b87fb4713bf

SHA512
b8b11b9d9d5c3088f40d5ea17db49f726a77af9d7e44310353ce5e275ded44eb171fb5c7090a8894e0e9f5afad51c9262a7fcc705ec4daa4db2cb85c3f9fe8b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d136040873b43abfed9e836b8578ec90

SHA1
8bc53313dd32cc718990096949c6b5f6306948d8

SHA256
426875b4bd7e2291d39dbe110d67da14c1c5d16a0431f7d91cff9dc8edc57bc1

SHA512
beebdc7eaaadfcb9a6c8e8be97ca1781c2374c729797178d5bee27cd1f9e8b537c0a52458bd7e2ef70c3b59538613f12413395e26f4ac5488e4aa59e0554e2be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c4d3ffc3e04dbb493c277eb454846ff8

SHA1
94ee2443dba11e7201b5d3baa1c457c5c7ff55a5

SHA256
c0d17a9ace596ccd5213a0a0df76531abc9c603b1f8be7328982b320723011df

SHA512
a2faebe5c0fdbc6da637605433ee6c23bfca0da17099e3bea18b33da39ce38e2272906d88777d8d0ce231a6605b89e22464f197587b308856bf07696742e2581

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cea38b44df4ace755287f33b55fdca52

SHA1
6a9a38bd248bad32c4e528e86eb50169b24ba9d6

SHA256
f35ad6a52a87f010079b594db3384f919a4d66ae6975725030f841b5b26bddc3

SHA512
78ae1cd257c7fcafcbf44793662ef4f432738e65d35c43cedb33ceebe2b8e27ca5b67c65852f63b60a079f76942e195837fb73bb8ac0e061790725809d06050e

Download Submit