31f68581584857c97a532459f8ce562f43aa3f5088a87c1af9c7400169758323

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 17:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84e360d4f10777fb173419471f05de9c_JaffaCakes118.html
Size

4KB
MD5

84e360d4f10777fb173419471f05de9c
SHA1

7368f9bb361fa8e6df16a63512f919e59a616f50
SHA256

31f68581584857c97a532459f8ce562f43aa3f5088a87c1af9c7400169758323
SHA512

05b5779a19efca12fc09737ab95090cf92466b5428e2226b6158d7a09e2216e0bdbc9ad77c9fc793068010bf9f407e1384a7e79d3f482befff3026bcb4bb1627
SSDEEP

48:CdlLRlAbAGMPyfghqQevaKs9JuVfXp2Je3i8GB22S2h3Kh9JFT0D:CHAbBQSucv1ssMJePfkGFID

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1424	msedge.exe
1424	msedge.exe
4668	msedge.exe
4668	msedge.exe
4236	identity_helper.exe
4236	identity_helper.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 2128	4668	msedge.exe	82
PID 4668 wrote to memory of 2128	4668	msedge.exe	82
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 5036	4668	msedge.exe	83
PID 4668 wrote to memory of 1424	4668	msedge.exe	84
PID 4668 wrote to memory of 1424	4668	msedge.exe	84
PID 4668 wrote to memory of 4068	4668	msedge.exe	85
PID 4668 wrote to memory of 4068	4668	msedge.exe	85
PID 4668 wrote to memory of 4068	4668	msedge.exe	85
PID 4668 wrote to memory of 4068	4668	msedge.exe	85
PID 4668 wrote to memory of 4068	4668	msedge.exe	85
PID 4668 wrote to memory of 4068	4668	msedge.exe	85
PID 4668 wrote to memory of 4068	4668	msedge.exe	85
PID 4668 wrote to memory of 4068	4668	msedge.exe	85
PID 4668 wrote to memory of 4068	4668	msedge.exe	85
PID 4668 wrote to memory of 4068	4668	msedge.exe	85
PID 4668 wrote to memory of 4068	4668	msedge.exe	85
PID 4668 wrote to memory of 4068	4668	msedge.exe	85
PID 4668 wrote to memory of 4068	4668	msedge.exe	85
PID 4668 wrote to memory of 4068	4668	msedge.exe	85
PID 4668 wrote to memory of 4068	4668	msedge.exe	85
PID 4668 wrote to memory of 4068	4668	msedge.exe	85
PID 4668 wrote to memory of 4068	4668	msedge.exe	85
PID 4668 wrote to memory of 4068	4668	msedge.exe	85
PID 4668 wrote to memory of 4068	4668	msedge.exe	85
PID 4668 wrote to memory of 4068	4668	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\84e360d4f10777fb173419471f05de9c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9849246f8,0x7ff984924708,0x7ff984924718
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,514393291087977225,14857693860348683504,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,514393291087977225,14857693860348683504,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,514393291087977225,14857693860348683504,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,514393291087977225,14857693860348683504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,514393291087977225,14857693860348683504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,514393291087977225,14857693860348683504,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,514393291087977225,14857693860348683504,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,514393291087977225,14857693860348683504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,514393291087977225,14857693860348683504,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,514393291087977225,14857693860348683504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,514393291087977225,14857693860348683504,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,514393291087977225,14857693860348683504,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1352 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
467B

MD5
9728d585ce5c430c750d037af9afe019

SHA1
6e038dd4df7612c48c602ae072b709e2dd8d6380

SHA256
2e70d4161204068a3d7f5223043b817db444eadd023a512657ba3a3059922f69

SHA512
a67221f1f82528699ba1c0dabee14f792b91e9389fa66b9a38e73840b520dd626ebbc0367c2a72ae111bbc020f83b47721172d319176e065467c517a4e5a2a1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bc064646aaed01ca4512806ceef75b4d

SHA1
5fb8270990ea7bebfe2b14f476a5cd68d95851c0

SHA256
a9cc98e2bf27020a91d9e8d5ac40948fea8b99cfb090573b1c27d04a3071aff7

SHA512
6fcda604f5eebb22655ac9424a3dc50e4a200a94e59e773ff06b10fcd30e03eb1734f31d8fa35770bd5750a13a56f628b7b9696ad2b77de113be23db64b08994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dbf015d3475dc836f2f139e7ef6b9244

SHA1
b2a01cc862626da33e8fc486ebd4036ca815cf6e

SHA256
60be793465b13ef7dba5ab48857795ad9dc496c426652f574f62e65d017aa617

SHA512
5aff14534b2a2ae435d934b877d694d20a7f26391bfe21a11db9fcf67e5a6a351f8c09a56c5c5c8ab7703cd56574c9d06ae8923e019208f09aa8d642d5fb6231

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a12b53432a5fa1ce13cd2c5a8fdb57ce

SHA1
e463583a2db67515e0ecc92b846a50af4b5d11a1

SHA256
12f8af8cfe8e0e7162865aac7449ab1756a20995a52bf40cb91d97d79e8f179f

SHA512
3f0dce2d142fa9fb2403cc2ae715479a4375ecc19424101d3ba0169950dd03941528591c0d70427a1af1e2839d212486de9b63fc8f1fd351a0323825e6c56d82

Download Submit