cc64f7fccafc5a9a8c918a315dbb08f01973f0a2f2f22644bfe572568d7c1cd4

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89d88892984e0555a9e41c125a3732dc_JaffaCakes118.html
Size

36KB
MD5

89d88892984e0555a9e41c125a3732dc
SHA1

76179c8299974cf1a1b992f4199cfd5b535a3c3f
SHA256

cc64f7fccafc5a9a8c918a315dbb08f01973f0a2f2f22644bfe572568d7c1cd4
SHA512

c2eae6b491ba354a50aa31b51bc2bdfa0672f8549fdbd1822acf2a89ac906736f82c7999b74806ad66281bc6b1f51eb80ff423f1202a4ce37c4057c7e6052b3c
SSDEEP

768:zwx/MDTH9188hAR/ZPXKE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TtZO46lrl6lLRc0:Q/nbJxNVuu0Sx/c83K

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
3388	msedge.exe
3388	msedge.exe
4640	identity_helper.exe
4640	identity_helper.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 1488	3388	msedge.exe	82
PID 3388 wrote to memory of 1488	3388	msedge.exe	82
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 1768	3388	msedge.exe	83
PID 3388 wrote to memory of 4492	3388	msedge.exe	84
PID 3388 wrote to memory of 4492	3388	msedge.exe	84
PID 3388 wrote to memory of 4960	3388	msedge.exe	85
PID 3388 wrote to memory of 4960	3388	msedge.exe	85
PID 3388 wrote to memory of 4960	3388	msedge.exe	85
PID 3388 wrote to memory of 4960	3388	msedge.exe	85
PID 3388 wrote to memory of 4960	3388	msedge.exe	85
PID 3388 wrote to memory of 4960	3388	msedge.exe	85
PID 3388 wrote to memory of 4960	3388	msedge.exe	85
PID 3388 wrote to memory of 4960	3388	msedge.exe	85
PID 3388 wrote to memory of 4960	3388	msedge.exe	85
PID 3388 wrote to memory of 4960	3388	msedge.exe	85
PID 3388 wrote to memory of 4960	3388	msedge.exe	85
PID 3388 wrote to memory of 4960	3388	msedge.exe	85
PID 3388 wrote to memory of 4960	3388	msedge.exe	85
PID 3388 wrote to memory of 4960	3388	msedge.exe	85
PID 3388 wrote to memory of 4960	3388	msedge.exe	85
PID 3388 wrote to memory of 4960	3388	msedge.exe	85
PID 3388 wrote to memory of 4960	3388	msedge.exe	85
PID 3388 wrote to memory of 4960	3388	msedge.exe	85
PID 3388 wrote to memory of 4960	3388	msedge.exe	85
PID 3388 wrote to memory of 4960	3388	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\89d88892984e0555a9e41c125a3732dc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc4d6946f8,0x7ffc4d694708,0x7ffc4d694718
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,2204553514352044863,14445225952724455934,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,2204553514352044863,14445225952724455934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,2204553514352044863,14445225952724455934,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2204553514352044863,14445225952724455934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2204553514352044863,14445225952724455934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,2204553514352044863,14445225952724455934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,2204553514352044863,14445225952724455934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2204553514352044863,14445225952724455934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2204553514352044863,14445225952724455934,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2204553514352044863,14445225952724455934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2204553514352044863,14445225952724455934,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,2204553514352044863,14445225952724455934,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4812 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
614B

MD5
c68e257d07fb331365a44983d3fbc5a4

SHA1
2341b9999e7fc025c504f024efda964b50e30945

SHA256
6a7b0ae4cce09c7c03d27310c544a58b32b9fbe5f7a952e192b70153887fe995

SHA512
39dd84661d148507181d815b40b3f378a3587c0261252883bb380cc4510ee6a7cc95fb48afb69f621a6a3cf256c820d3c0855949b93b0d3e4aae1b07ad9bf115

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8a842f8071705b3855fecdec9c6546a9

SHA1
93152b25ade87496edc42ba507e9b3d573e0100d

SHA256
47419639cffe444c062cb719b118d1abc9fc09f186f0f3be277667dcbcf0c17e

SHA512
e49382763f92d517b3a9ca943305e51d44b855dfdf6617353df065ac89baa47ee243bcec72cb1d7cfa6f8bbc2989968edab122e795542c344e4a2b9d0aaf4965

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2132430f74023bbbde1040afd7f15a4b

SHA1
82d338b0114801a8a45eea4bbbdfed3a881e9a8f

SHA256
f9f1e74fe58a58e7b7d247bda71c041df3fc0c891fa1f34c03dac93beef518c6

SHA512
91e983ad913b29c65c718c30f762cabe81f4c25ed4aa7a027d58425315d3e3fd8fabf2ae439c623565f98a937bbf133df26f2ed75e7bdcc526cf1231ba88a149

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6ba5347ca0da502a54439f3f183584b5

SHA1
56889d1902031a5e230e9dcd75411623caaaeacf

SHA256
bbd3710be701f8568126fc285832c06fdbf638829cefc93292d53cdb17cf6066

SHA512
7a1fef4b7c9c3dd94aaaa3fa9c681d983b026daa147f7752ac3ecea5bdd8578852df45f29ca96ff2a56b18febb14c000d9fe05c1326809dd16ef9f62b5c284dd

Download Submit