8394fc13281d2a2c1e15fe7c0bc9385e853251018021337a0a80b132d3c445b0

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

84f83b0adcd7c0b3576b7dddfd95feb1_JaffaCakes118.html
Size

36KB
MD5

84f83b0adcd7c0b3576b7dddfd95feb1
SHA1

7e25a629ba7c23ae11acd02dc76a24944638b31f
SHA256

8394fc13281d2a2c1e15fe7c0bc9385e853251018021337a0a80b132d3c445b0
SHA512

06d7dedc96697395e68e72f5d984b2583c60af52eb1b33c55c6cf74a47fb56463941dcc31d932336ab34b6fed7d127785c9263f9f7a2b4e6096ddf16e49cdb94
SSDEEP

768:zwx/MDTHU+Ug88hARnZPXiE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TtZO46lrl6lLy:Q/fbJxNVuu0Sx/c8GK

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
972	msedge.exe
972	msedge.exe
4236	msedge.exe
4236	msedge.exe
1984	identity_helper.exe
1984	identity_helper.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 4144	4236	msedge.exe	81
PID 4236 wrote to memory of 4144	4236	msedge.exe	81
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 2704	4236	msedge.exe	82
PID 4236 wrote to memory of 972	4236	msedge.exe	83
PID 4236 wrote to memory of 972	4236	msedge.exe	83
PID 4236 wrote to memory of 996	4236	msedge.exe	84
PID 4236 wrote to memory of 996	4236	msedge.exe	84
PID 4236 wrote to memory of 996	4236	msedge.exe	84
PID 4236 wrote to memory of 996	4236	msedge.exe	84
PID 4236 wrote to memory of 996	4236	msedge.exe	84
PID 4236 wrote to memory of 996	4236	msedge.exe	84
PID 4236 wrote to memory of 996	4236	msedge.exe	84
PID 4236 wrote to memory of 996	4236	msedge.exe	84
PID 4236 wrote to memory of 996	4236	msedge.exe	84
PID 4236 wrote to memory of 996	4236	msedge.exe	84
PID 4236 wrote to memory of 996	4236	msedge.exe	84
PID 4236 wrote to memory of 996	4236	msedge.exe	84
PID 4236 wrote to memory of 996	4236	msedge.exe	84
PID 4236 wrote to memory of 996	4236	msedge.exe	84
PID 4236 wrote to memory of 996	4236	msedge.exe	84
PID 4236 wrote to memory of 996	4236	msedge.exe	84
PID 4236 wrote to memory of 996	4236	msedge.exe	84
PID 4236 wrote to memory of 996	4236	msedge.exe	84
PID 4236 wrote to memory of 996	4236	msedge.exe	84
PID 4236 wrote to memory of 996	4236	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\84f83b0adcd7c0b3576b7dddfd95feb1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f56546f8,0x7ff8f5654708,0x7ff8f5654718
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,1584569942440583520,784269072720349889,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,1584569942440583520,784269072720349889,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,1584569942440583520,784269072720349889,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1584569942440583520,784269072720349889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1584569942440583520,784269072720349889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,1584569942440583520,784269072720349889,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,1584569942440583520,784269072720349889,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1584569942440583520,784269072720349889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1584569942440583520,784269072720349889,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1584569942440583520,784269072720349889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1584569942440583520,784269072720349889,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,1584569942440583520,784269072720349889,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3212 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
613B

MD5
687fa706fe5ee1c349d146f0731f396a

SHA1
f2a45610a8744c58ee5c69e13ab61b18a8a0a478

SHA256
4e671b426835c5d42d5e991d6a787a31a8e4b91df49518bd26f3f5bf7b10c241

SHA512
68a8ea9d1ad6df07e1e3abed0fa2f3746828ced87e73632b183a20e21bcf279e42c31bae8c7730841e0cf66cbe04183dbdc567985041f8d9d8b9cb5266eb2151

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
db28e11c8bf3a55eff6ddfb4b307e61c

SHA1
4be30dafc8ed486cb97b8cbbc49d6436d6104540

SHA256
f9c85820dba1ac905984b500fabc1efc4ae0c7ebbfdb32b0c713d532f8d5c33d

SHA512
11668692db817a38cbc187441858bd4ec0115ac1e0f1b90671cc3b5e4824dde6462767b8bc6fbfd5642d7f8235b18ba8cc68614b4371a3dba784b0f92d11aa20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0d03e0fd0ed80b271ffcda1ac510742f

SHA1
f5132a2cf5676928dbe5ce6639eb18dc2d0407d0

SHA256
40c1dc8ca4f856260f7f0570b7d1b2806362afeb41005d737791c1eefa0f2eb6

SHA512
5094cd57c33a01a4c713e78a76c7a78675af67fb518295843a9441d968084cba7671181c892e7c90f7604e7659d7e735eb46ac9ab818beff4088da0d623db2c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ab5338f1ea7f2204b944a38d412f005e

SHA1
12a3ce4cdef503b3d58bfc87129b29b2685db339

SHA256
1eaf314e2196bbcba3b3f193d0f38e888ac6671c011574d9b031d467f9305e47

SHA512
1d425c891ba9da7df9dcdb5f050b771f262d37de2120e89b661c247aafaafa3c8718baa11cb6662d187d5e424b3b256e4fb2c7683854a86b344bac4cda542c57

Download Submit