50502473bb7ebf499c4f6e9304c92af40e94d3f51a2793e13c8d55b47e9480f8

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31-05-2024 17:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87ca27e443c9e81b0f2a2fb7dafa32d1_JaffaCakes118.html
Size

35KB
MD5

87ca27e443c9e81b0f2a2fb7dafa32d1
SHA1

74232fe9ef3339e20a14578d6365a926ca727c82
SHA256

50502473bb7ebf499c4f6e9304c92af40e94d3f51a2793e13c8d55b47e9480f8
SHA512

a23612c1daf9038446f789d297d07b85a4053659e300fd8004e5b4171b23d9685587a0aaa35df9ab537949a68556a575f489752f61bd707a6a8603ff5609855d
SSDEEP

768:zwx/MDTHas88hARdZPXAE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TzZOl6DJtxo6lL3:Q/PbJxNV2u0Sf/k85K

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe
3012	msedge.exe
3012	msedge.exe
3660	identity_helper.exe
3660	identity_helper.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 1948	3012	msedge.exe	82
PID 3012 wrote to memory of 1948	3012	msedge.exe	82
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 1436	3012	msedge.exe	83
PID 3012 wrote to memory of 4224	3012	msedge.exe	84
PID 3012 wrote to memory of 4224	3012	msedge.exe	84
PID 3012 wrote to memory of 3064	3012	msedge.exe	85
PID 3012 wrote to memory of 3064	3012	msedge.exe	85
PID 3012 wrote to memory of 3064	3012	msedge.exe	85
PID 3012 wrote to memory of 3064	3012	msedge.exe	85
PID 3012 wrote to memory of 3064	3012	msedge.exe	85
PID 3012 wrote to memory of 3064	3012	msedge.exe	85
PID 3012 wrote to memory of 3064	3012	msedge.exe	85
PID 3012 wrote to memory of 3064	3012	msedge.exe	85
PID 3012 wrote to memory of 3064	3012	msedge.exe	85
PID 3012 wrote to memory of 3064	3012	msedge.exe	85
PID 3012 wrote to memory of 3064	3012	msedge.exe	85
PID 3012 wrote to memory of 3064	3012	msedge.exe	85
PID 3012 wrote to memory of 3064	3012	msedge.exe	85
PID 3012 wrote to memory of 3064	3012	msedge.exe	85
PID 3012 wrote to memory of 3064	3012	msedge.exe	85
PID 3012 wrote to memory of 3064	3012	msedge.exe	85
PID 3012 wrote to memory of 3064	3012	msedge.exe	85
PID 3012 wrote to memory of 3064	3012	msedge.exe	85
PID 3012 wrote to memory of 3064	3012	msedge.exe	85
PID 3012 wrote to memory of 3064	3012	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\87ca27e443c9e81b0f2a2fb7dafa32d1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8dd7f46f8,0x7ff8dd7f4708,0x7ff8dd7f4718
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,4337144143798721562,10426536652109650421,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,4337144143798721562,10426536652109650421,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,4337144143798721562,10426536652109650421,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,4337144143798721562,10426536652109650421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,4337144143798721562,10426536652109650421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,4337144143798721562,10426536652109650421,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,4337144143798721562,10426536652109650421,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,4337144143798721562,10426536652109650421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,4337144143798721562,10426536652109650421,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,4337144143798721562,10426536652109650421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,4337144143798721562,10426536652109650421,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,4337144143798721562,10426536652109650421,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1380 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
614B

MD5
82e038308060463d02a6734e6bbfa414

SHA1
b8d3abb512934a109a8da44ebdca8c3d024155b7

SHA256
196836734623f64b01d3306b2b13c68fce3de0fc9b07385d8a33cd544879f0c5

SHA512
d8a0844aa2c6b030c165a536f3371898f1b544dea7bfaf0f7d1164a7a17761a3f0a73fc975354c3b0d22c48d200bff9c80578def4b9afbb9e61ff1612771d1c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cd25efa78da47eb6943bf64929a62b67

SHA1
ff7a4a587f86c2cfa982845b912a455cfe71e3e7

SHA256
92e0a9fec0399dc26b2339096e168cdd897afadbf750d3595db74679a6e6b978

SHA512
efbc0e4116ac084be5626cf9ae77e9357e71ef6b24219b075ec40d6f8cd35c2bd5bd841cf6574c9e469f3626a4e3354965aaff2f2fa9d92db2ffd3419282ab1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dd300f2b7830fdd052841c439da3cfc2

SHA1
7e5afc83fd447de966dcc6a6d221443592563295

SHA256
f8be91321413e1e4a15a293b7b84c9b36b7086ecdea8d85e78ca4218d8f71c76

SHA512
f2dafb5b33feebda101a69c5aba43771c4a13500ea0afd1e46c77a843dad75deb8269f43b495e1cfca6ee26d0570a7dff512d9f56432b5ca6ae7a55dc5c2eda4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f48a7ab0d073c4fedbe1d6dc83565e10

SHA1
53523da29031f7b9541177beff62833bcb432110

SHA256
3763db8347b8066f8b4f226ce2bc61740a37d037b5a4f72508c3c39299d0319b

SHA512
b3fb82e7e1594b4ec3e14a2b962b6593b32862efb0f8adfbf30a7bbb689ab62df03b846030b8e1dfa8317e27348756801a4aad537300669e157b37e4bc2eb95a

Download Submit