ffa5662320946eaad85fcc7649d348a56cb99f3f7d4710df1d067febdb635038

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 19:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81b1b9242619a0140b622e6f5ee0f468_JaffaCakes118.html
Size

107KB
MD5

81b1b9242619a0140b622e6f5ee0f468
SHA1

d0f5da45be2370e48ccedec64c2a21a73fa46b14
SHA256

ffa5662320946eaad85fcc7649d348a56cb99f3f7d4710df1d067febdb635038
SHA512

dbfb004b717c4382c08f36297e8d7d9554f181d0a038726ca273301105d1aecdb075f8c99602cc0d2865950a50c50ce60cbece89803b5c68450f1d15d9bb7056
SSDEEP

768:DY/jjYd4/S1XXhXGpt8XHwzWlmBV7gZVI+tQPSI4YZzBHRvWOMOS:DY/3Y+6mkQQmXMZVI+VIUOMOS

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe
2796	msedge.exe
2796	msedge.exe
4624	identity_helper.exe
4624	identity_helper.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 4628	2796	msedge.exe	82
PID 2796 wrote to memory of 4628	2796	msedge.exe	82
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 3920	2796	msedge.exe	84
PID 2796 wrote to memory of 3920	2796	msedge.exe	84
PID 2796 wrote to memory of 2064	2796	msedge.exe	85
PID 2796 wrote to memory of 2064	2796	msedge.exe	85
PID 2796 wrote to memory of 2064	2796	msedge.exe	85
PID 2796 wrote to memory of 2064	2796	msedge.exe	85
PID 2796 wrote to memory of 2064	2796	msedge.exe	85
PID 2796 wrote to memory of 2064	2796	msedge.exe	85
PID 2796 wrote to memory of 2064	2796	msedge.exe	85
PID 2796 wrote to memory of 2064	2796	msedge.exe	85
PID 2796 wrote to memory of 2064	2796	msedge.exe	85
PID 2796 wrote to memory of 2064	2796	msedge.exe	85
PID 2796 wrote to memory of 2064	2796	msedge.exe	85
PID 2796 wrote to memory of 2064	2796	msedge.exe	85
PID 2796 wrote to memory of 2064	2796	msedge.exe	85
PID 2796 wrote to memory of 2064	2796	msedge.exe	85
PID 2796 wrote to memory of 2064	2796	msedge.exe	85
PID 2796 wrote to memory of 2064	2796	msedge.exe	85
PID 2796 wrote to memory of 2064	2796	msedge.exe	85
PID 2796 wrote to memory of 2064	2796	msedge.exe	85
PID 2796 wrote to memory of 2064	2796	msedge.exe	85
PID 2796 wrote to memory of 2064	2796	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\81b1b9242619a0140b622e6f5ee0f468_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9903a46f8,0x7ff9903a4708,0x7ff9903a4718
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4665568796631366075,1552284185268750500,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,4665568796631366075,1552284185268750500,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,4665568796631366075,1552284185268750500,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4665568796631366075,1552284185268750500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4665568796631366075,1552284185268750500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,4665568796631366075,1552284185268750500,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,4665568796631366075,1552284185268750500,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4665568796631366075,1552284185268750500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4665568796631366075,1552284185268750500,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4665568796631366075,1552284185268750500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4665568796631366075,1552284185268750500,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4665568796631366075,1552284185268750500,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1832 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
684B

MD5
e285f27da618ab32f5db7583c97c1f5e

SHA1
c08f4a36ce3c5158fe25cbfc7a3347f5ed26b3a9

SHA256
be9b0fa85d01767cf31a95103d769dd5aed1c72815f9d59b01892d2b087f9df8

SHA512
bd0a633f88dd5d087da1965ef93bf8f0ebd7876bd879b459eda5962b83c46aeff9d54bfdb01121f2a3714def23231c9c2036caa7cd9b3ba0c5abeb0064dc196f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ffc26f92047b9588ad5a730b701d6f73

SHA1
9f02e03d9ef67025385984c1db0af8174fe0d20b

SHA256
8a9af092c821aee30f60edb332949ea67ca165af39d4cd12716de6e308ba8a74

SHA512
acd37f802a5390e3b97c4b18b293b451698974cd4d63b040996f1f812eb33985dbb367916f6289fe57bf644ce869775c5b4c38a95c90e54061c06cc18e644540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a20810c00f63bc9d3ea03ca3abeec43a

SHA1
69bef0a479fc8bb57289dc7d4e1278e5568fb3d2

SHA256
1d0452215ec6f219a0ae01c0e06038cc0a0a1da77910c1a6b94a0b8c8972b7e3

SHA512
dd43dc9797ae046d8d14a01b06072981b4bb2fb1b4755a7a166a5fb831f1753c11cdc1b5876059d16b3965a4e50148227bee21a09103fcbb35317c66eb4c989c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
744de4258af149f72acd9aab5d6234a7

SHA1
185ee7445f253e0a309915ac393b9c92f11aaabc

SHA256
14d3c109896c3796ce2abafa85d6f43a98e01a65a45cdaeb93c91f69d2279f42

SHA512
bb111dd31ab54413b86c2f9c31f3238f4fa550f555b3ecf8a8be5cb4612f8c681c6fcc6f0b99fa57295d4055a6b2156ce0e9989e79660253e08239436579beb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
2236860317013bce0f47c0d240b8fc60

SHA1
b0a142dc537470e494d30c39eb04b98bb8e4c5eb

SHA256
f42c7151fcf0272d03ea1a02b5f2d142885f9c51a57a09bf80499f7e102c1ff4

SHA512
ed0e007e48fbd9f2428f6d7b114e36bb12954a0d4de7279a79cc78bc110e3e10243b69584bb7f24913b22ef7737fd8fc49306f491e2756b63647dbf4ed9e25a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ca74.TMP

Filesize
203B

MD5
6cd422574390fb71ff32b307bdf92dd4

SHA1
c53dd781c22f2e39578df84e0a7ec73f8abc2388

SHA256
ff5610d6b40614869814e6c7a9463f602ba9030d68019ca9ccd75c240d433e8b

SHA512
a60a120ced35f41ecd8d15dc92974c6730b8f382aec955e143c05e959a7b600dba4b6f9e2cd5c636ff61585e8a9c23aad779931be326ec7bc6506d81056a9607

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1c0fc950f7bf31d916152a6c4172891a

SHA1
75c87a74b8746fc98c438613d2986845150cca41

SHA256
dc4217ce3161481b8c562a4f75c38598b722c6514974119ee8991cef54f338a6

SHA512
c088d8127735ec4bfbdf15bfc34ec73e1e88a440f0384281a42ef345f922f4a935ca8613626e04f21938a33b3d181796d28a9b2a3b78cbd9b49f755bb293612d

Download Submit