b8d068eecf1ce604bd5e6902e6266dcae3ed3cd305eafbc3342b8b22eae141b2

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8a778f63e6fde6f02c4e13ce2282b71f_JaffaCakes118.html
Size

461KB
MD5

8a778f63e6fde6f02c4e13ce2282b71f
SHA1

637b34049ca9f398bd67bbedf344a19f8d49f2f2
SHA256

b8d068eecf1ce604bd5e6902e6266dcae3ed3cd305eafbc3342b8b22eae141b2
SHA512

eebb6582c3ff72fed40e4d033134cf37858e69fe246587217d6af37f84fcaaa125c49f99f72e579492b1af156e3a598b0dd1237b776befeef6248097675eead9
SSDEEP

6144:SysMYod+X3oI+YoQIsMYod+X3oI+YYsMYod+X3oI+YLsMYod+X3oI+YQ:d5d+X3M5d+X3c5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
4628	msedge.exe
4628	msedge.exe
5012	identity_helper.exe
5012	identity_helper.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 1232	4628	msedge.exe	82
PID 4628 wrote to memory of 1232	4628	msedge.exe	82
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 3540	4628	msedge.exe	83
PID 4628 wrote to memory of 4116	4628	msedge.exe	84
PID 4628 wrote to memory of 4116	4628	msedge.exe	84
PID 4628 wrote to memory of 3376	4628	msedge.exe	85
PID 4628 wrote to memory of 3376	4628	msedge.exe	85
PID 4628 wrote to memory of 3376	4628	msedge.exe	85
PID 4628 wrote to memory of 3376	4628	msedge.exe	85
PID 4628 wrote to memory of 3376	4628	msedge.exe	85
PID 4628 wrote to memory of 3376	4628	msedge.exe	85
PID 4628 wrote to memory of 3376	4628	msedge.exe	85
PID 4628 wrote to memory of 3376	4628	msedge.exe	85
PID 4628 wrote to memory of 3376	4628	msedge.exe	85
PID 4628 wrote to memory of 3376	4628	msedge.exe	85
PID 4628 wrote to memory of 3376	4628	msedge.exe	85
PID 4628 wrote to memory of 3376	4628	msedge.exe	85
PID 4628 wrote to memory of 3376	4628	msedge.exe	85
PID 4628 wrote to memory of 3376	4628	msedge.exe	85
PID 4628 wrote to memory of 3376	4628	msedge.exe	85
PID 4628 wrote to memory of 3376	4628	msedge.exe	85
PID 4628 wrote to memory of 3376	4628	msedge.exe	85
PID 4628 wrote to memory of 3376	4628	msedge.exe	85
PID 4628 wrote to memory of 3376	4628	msedge.exe	85
PID 4628 wrote to memory of 3376	4628	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8a778f63e6fde6f02c4e13ce2282b71f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9903a46f8,0x7ff9903a4708,0x7ff9903a4718
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,3311638640092295428,8834503714418117764,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,3311638640092295428,8834503714418117764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,3311638640092295428,8834503714418117764,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3311638640092295428,8834503714418117764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3311638640092295428,8834503714418117764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,3311638640092295428,8834503714418117764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,3311638640092295428,8834503714418117764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3311638640092295428,8834503714418117764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3311638640092295428,8834503714418117764,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3311638640092295428,8834503714418117764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3311638640092295428,8834503714418117764,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,3311638640092295428,8834503714418117764,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2796 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
deaefba7b536f75d1963fbae155a82ba

SHA1
a52f332adb13d8098be8ae586234f5d3e11d6005

SHA256
bdc44ff721aa260e51906d2e1782f1eb6f0b080dd71faa05a30612d0785dbfb5

SHA512
1cb0196c9cc31a0b4faa978313529b199c1163ec80a42be3475f10cc3edce06ee46fe102d6d0caa51cdc98e971f4ebe76616c8fbb322b4ebf0aa3c853510632f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
673a2694991a152f4f6a5ea7d71e06ff

SHA1
5cf2642e671ac59fae2f821f5f2066caa3325511

SHA256
80f477a5f00f991bb9847c2981c7bc59b54a206c4a0977b1a9ba5fa77779734b

SHA512
ebd7d245f56dfa025e96b75ab81f71c3a137a6fdba054bffc91b69a93b8c19df00f252567bdf5369754406de09eb962129a37ae9fd988c24307d568e3572fee7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0f640142acd3570b89f30303a28a4009

SHA1
358111d3d10f6950c363f15482ebebfb7aa00efb

SHA256
9b751a2551c1bef05985fd23791c0a693debad4c736f3a62203b712c10dd5c75

SHA512
28484e63276e501535e7565b62f8df955b14c14e2a0cbb5312846e0525c9c2353ce2abb14d557bd1cefb6ad7c3880e950c28ee6fb6a593ecb41fb860d7c4df8b

Download Submit