7f1ea08ef6c38955e165c408284f9269e803071203b38f274b40e6398200ecba

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 01:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82b080ef45de2bec6940b298724b5a29_JaffaCakes118.html
Size

26KB
MD5

82b080ef45de2bec6940b298724b5a29
SHA1

bbb78b295536bc3a5709d179500edb7c436f1813
SHA256

7f1ea08ef6c38955e165c408284f9269e803071203b38f274b40e6398200ecba
SHA512

a0d46956d689d69f86539bd393a06af7acbbe55d43a9a49d04da84d8841147f6937635bf36a737c1e739064fae84649cf8e41823a57bb7a94f31619b71d0c97e
SSDEEP

768:Q1+pKVAqnd+qi9q7B2GcH1D3Qlc2SvQzz:Q1UKVhnd+LABFcH1D3Qlh

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
1644	identity_helper.exe
1644	identity_helper.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2584	2308	msedge.exe	84
PID 2308 wrote to memory of 2584	2308	msedge.exe	84
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 3960	2308	msedge.exe	85
PID 2308 wrote to memory of 4604	2308	msedge.exe	86
PID 2308 wrote to memory of 4604	2308	msedge.exe	86
PID 2308 wrote to memory of 4596	2308	msedge.exe	87
PID 2308 wrote to memory of 4596	2308	msedge.exe	87
PID 2308 wrote to memory of 4596	2308	msedge.exe	87
PID 2308 wrote to memory of 4596	2308	msedge.exe	87
PID 2308 wrote to memory of 4596	2308	msedge.exe	87
PID 2308 wrote to memory of 4596	2308	msedge.exe	87
PID 2308 wrote to memory of 4596	2308	msedge.exe	87
PID 2308 wrote to memory of 4596	2308	msedge.exe	87
PID 2308 wrote to memory of 4596	2308	msedge.exe	87
PID 2308 wrote to memory of 4596	2308	msedge.exe	87
PID 2308 wrote to memory of 4596	2308	msedge.exe	87
PID 2308 wrote to memory of 4596	2308	msedge.exe	87
PID 2308 wrote to memory of 4596	2308	msedge.exe	87
PID 2308 wrote to memory of 4596	2308	msedge.exe	87
PID 2308 wrote to memory of 4596	2308	msedge.exe	87
PID 2308 wrote to memory of 4596	2308	msedge.exe	87
PID 2308 wrote to memory of 4596	2308	msedge.exe	87
PID 2308 wrote to memory of 4596	2308	msedge.exe	87
PID 2308 wrote to memory of 4596	2308	msedge.exe	87
PID 2308 wrote to memory of 4596	2308	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\82b080ef45de2bec6940b298724b5a29_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf44a46f8,0x7ffaf44a4708,0x7ffaf44a4718
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,2894353955884604646,7936733098257071516,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,2894353955884604646,7936733098257071516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,2894353955884604646,7936733098257071516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2894353955884604646,7936733098257071516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2894353955884604646,7936733098257071516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,2894353955884604646,7936733098257071516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,2894353955884604646,7936733098257071516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2894353955884604646,7936733098257071516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2894353955884604646,7936733098257071516,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2894353955884604646,7936733098257071516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2894353955884604646,7936733098257071516,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,2894353955884604646,7936733098257071516,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
395B

MD5
e2542894e8496a73a0de0b9c1c51e2cf

SHA1
205e20202b6666148d2af3b49b70a3863fa04fc5

SHA256
ed9699ba455e54512056cea9d0f9aa680c8f6086980c6a7bcbe5c9c461e75158

SHA512
2245ebffa8bf1d3dc389ba9ccf4c972ef59f0528a5ea07dfdb23d76b09781339b4303ede84186ec6a3478a2be60172cdab2bf080e2d103e051d4d9600f18b4a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7b5cc8bf4fe6b41bbc78149b0a2d88d3

SHA1
c4109e4f732fc8e1fd102b8feade46316062299a

SHA256
02acf08bc78deaf6884281e1f0f3e9fbf49048663b9368c794b150e6ae72659e

SHA512
471ce4638c32ee22fba4f3e23f34125215f573770069b3f1ea9d50aab1d21584171aa99d6decda4c2928c4ffc9aa538dc75aca0a2bd85ef2b61f888c7cbb0fc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
01564dea261aff849f2f9f7487249535

SHA1
80ce9cb407173778465456ed310592ea1de1b598

SHA256
97194b7a7188b2b3436c2c6cf9d063bc8e314a29e9b6a2f9dbc0a61cf4e35781

SHA512
22339e0ec818c1d160f7c716e556258a4932e860098b48c94c170aae19e3d58a3b67952a49086c2ead899e5fddc8cbb2fccaf1af8fa9d12c57f66f18ab64f529

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c6eece987cbf5932bf1ee1cf65458d9a

SHA1
9dc09b8f399901c9db2b064f358d045c790767f5

SHA256
ebb66cc8f56c326989e091818362d9bd3a46707a1f81f442872cbe242da77339

SHA512
d8f1a257318719905f6d01270cae553494b0dc374c48a943845af9956e238f585a92f068f8e2c8406f95cbf09139e58265bafcf2794070713a9a1e4a796e9541

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ce1ec66b880b54ef1c036037d5eda4a3

SHA1
2b921af5715069bbf9b3f4d9eaef156bb4060499

SHA256
b3d490e3657ac37018a0545de2e2ba912fc6df318e41c6dc205a71a01850ce6b

SHA512
e5a77403ce415517b916ec5d85472dd6049f69e9f2f85c372021bef8ce7841f2e7be2df693c7d6d6fe85e1bca9a3a400502723cc2505f0947e917a3c2656da8b

Download Submit