651d444547c48caf1dfe49fce151f8857b99e60c29fa7f5c91ef3f34c2cee1a9

Analysis

max time kernel
145s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 15:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84afa62b2f6e64d0d891d3e6f083c44e_JaffaCakes118.html
Size

27KB
MD5

84afa62b2f6e64d0d891d3e6f083c44e
SHA1

11b5f6bd75a6d3e1099f89716d549c7500f877e7
SHA256

651d444547c48caf1dfe49fce151f8857b99e60c29fa7f5c91ef3f34c2cee1a9
SHA512

3596b564bf88a372c0865b0ae603cc8dbcdb789a3fbc8861b89034534c9307978ba7d9eb1ebb70e63e5e29b1bd3299aac0305b6d507e0ebb4b0eae5ba486256e
SSDEEP

192:uwIdbuL6Z+8vb5nhKhzhtM8YMotae9nQjxn5Q/nFNnQierWNn9F7nQOkEnttfGsO:9Q/hZWUSbScnV

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
1440	msedge.exe
1440	msedge.exe
2364	identity_helper.exe
2364	identity_helper.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 5072	1440	msedge.exe	84
PID 1440 wrote to memory of 5072	1440	msedge.exe	84
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 4200	1440	msedge.exe	85
PID 1440 wrote to memory of 3980	1440	msedge.exe	86
PID 1440 wrote to memory of 3980	1440	msedge.exe	86
PID 1440 wrote to memory of 2760	1440	msedge.exe	87
PID 1440 wrote to memory of 2760	1440	msedge.exe	87
PID 1440 wrote to memory of 2760	1440	msedge.exe	87
PID 1440 wrote to memory of 2760	1440	msedge.exe	87
PID 1440 wrote to memory of 2760	1440	msedge.exe	87
PID 1440 wrote to memory of 2760	1440	msedge.exe	87
PID 1440 wrote to memory of 2760	1440	msedge.exe	87
PID 1440 wrote to memory of 2760	1440	msedge.exe	87
PID 1440 wrote to memory of 2760	1440	msedge.exe	87
PID 1440 wrote to memory of 2760	1440	msedge.exe	87
PID 1440 wrote to memory of 2760	1440	msedge.exe	87
PID 1440 wrote to memory of 2760	1440	msedge.exe	87
PID 1440 wrote to memory of 2760	1440	msedge.exe	87
PID 1440 wrote to memory of 2760	1440	msedge.exe	87
PID 1440 wrote to memory of 2760	1440	msedge.exe	87
PID 1440 wrote to memory of 2760	1440	msedge.exe	87
PID 1440 wrote to memory of 2760	1440	msedge.exe	87
PID 1440 wrote to memory of 2760	1440	msedge.exe	87
PID 1440 wrote to memory of 2760	1440	msedge.exe	87
PID 1440 wrote to memory of 2760	1440	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\84afa62b2f6e64d0d891d3e6f083c44e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb884446f8,0x7ffb88444708,0x7ffb88444718
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,10436361534716296012,5131117658244311872,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,10436361534716296012,5131117658244311872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,10436361534716296012,5131117658244311872,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10436361534716296012,5131117658244311872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10436361534716296012,5131117658244311872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,10436361534716296012,5131117658244311872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,10436361534716296012,5131117658244311872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10436361534716296012,5131117658244311872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10436361534716296012,5131117658244311872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10436361534716296012,5131117658244311872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2076 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10436361534716296012,5131117658244311872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,10436361534716296012,5131117658244311872,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5944 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
04c34dd6cb6772bcbe9f861f03367c6d

SHA1
c863a7852b57f7c39f5446f19921eb207db76f37

SHA256
d238da4dd39d9991e48d197c48c94123727b8640f81f857613204e1a76b3de76

SHA512
cf70dd44befc7bd7128a85b3b2f0a3727343388d8d8b65c130c3a17fe40b747659249e5bfcc448fd0f6521aaf9f7794348fb734f7415cc3245cfa086b02b8127

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8f9f33f3b98a9e3804ea28a06c400113

SHA1
8afe3be47c76fd8c746ccf285802485984a11b8c

SHA256
3f9a1b4d922f137a28856388ff08c99435db0c8e47d09a38917d11def2a408b9

SHA512
1730341ee85b4ffb672ce785d03642333d1cad912d137dbcaf3c0e9761482b76a67b08af93f4f845a12aace98e19713b717c95c50ca4e6bbda116de79e00af15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
78e7f4d8c0dd63eb5f10c4e54de42e6b

SHA1
6fe021c30b17df6906af8b37fbfdf15268570a92

SHA256
e50fbcf2c4f48a4a8c27c3f8b4acc1dc5972baace721cb52a7472b2020a1904f

SHA512
2c9bb0b0845bc96b69497c1dfb5222b986737a39e1563302e301fbc4554f38ae8515e6b0946255fed0e9f38a52620cb60774bd4b3ea9874c5eb8ee49827633b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6d643d4b7179b127d29942a5bf1508d0

SHA1
f292fb41f311d68f866c136830d82b16b5a218f8

SHA256
b80805220e9d21d8bc41d1bb604df52905a777111f3b66780d6483247b3cf08f

SHA512
c9e3ac98057e37cf173b19d25776024c5ed2ea22d371415ff7a0ef53537e0b4330cf7d6d158b7520a69069de1fdc48b1a68356ebe605cce5bcdf82a9e2032cf9

Download Submit