09f513a18899026002096e9127bc7c5519c792e61b72996bc5a96b33c02e9681

Analysis

max time kernel
145s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 14:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8aced1775150cbfcb49a0b8b49698f55_JaffaCakes118.html
Size

23KB
MD5

8aced1775150cbfcb49a0b8b49698f55
SHA1

3cb87eb8ff8e005f70baf351efa98bcd89858a93
SHA256

09f513a18899026002096e9127bc7c5519c792e61b72996bc5a96b33c02e9681
SHA512

ece17b02ed777f4903407859aa334190d22e75cee0820968d1af77d103129fc15bfd49ebfd4b1266649a0119cbae829cfb9a79cf26e211831dac7c0a98611fe4
SSDEEP

192:uWrEb5nimnQjxn5Q/9nQieYNnwnQOkEntrXnQTbn5nQqCnQtywMB4qnYnQ7tneYN:LQ/eSg7

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
380	msedge.exe
380	msedge.exe
3316	msedge.exe
3316	msedge.exe
3940	identity_helper.exe
3940	identity_helper.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 2096	3316	msedge.exe	83
PID 3316 wrote to memory of 2096	3316	msedge.exe	83
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 3412	3316	msedge.exe	84
PID 3316 wrote to memory of 380	3316	msedge.exe	85
PID 3316 wrote to memory of 380	3316	msedge.exe	85
PID 3316 wrote to memory of 3416	3316	msedge.exe	86
PID 3316 wrote to memory of 3416	3316	msedge.exe	86
PID 3316 wrote to memory of 3416	3316	msedge.exe	86
PID 3316 wrote to memory of 3416	3316	msedge.exe	86
PID 3316 wrote to memory of 3416	3316	msedge.exe	86
PID 3316 wrote to memory of 3416	3316	msedge.exe	86
PID 3316 wrote to memory of 3416	3316	msedge.exe	86
PID 3316 wrote to memory of 3416	3316	msedge.exe	86
PID 3316 wrote to memory of 3416	3316	msedge.exe	86
PID 3316 wrote to memory of 3416	3316	msedge.exe	86
PID 3316 wrote to memory of 3416	3316	msedge.exe	86
PID 3316 wrote to memory of 3416	3316	msedge.exe	86
PID 3316 wrote to memory of 3416	3316	msedge.exe	86
PID 3316 wrote to memory of 3416	3316	msedge.exe	86
PID 3316 wrote to memory of 3416	3316	msedge.exe	86
PID 3316 wrote to memory of 3416	3316	msedge.exe	86
PID 3316 wrote to memory of 3416	3316	msedge.exe	86
PID 3316 wrote to memory of 3416	3316	msedge.exe	86
PID 3316 wrote to memory of 3416	3316	msedge.exe	86
PID 3316 wrote to memory of 3416	3316	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8aced1775150cbfcb49a0b8b49698f55_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fe9b46f8,0x7ff8fe9b4708,0x7ff8fe9b4718
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,6550580435402882352,422102437321916297,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,6550580435402882352,422102437321916297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,6550580435402882352,422102437321916297,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6550580435402882352,422102437321916297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6550580435402882352,422102437321916297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,6550580435402882352,422102437321916297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4616 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,6550580435402882352,422102437321916297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4616 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6550580435402882352,422102437321916297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6550580435402882352,422102437321916297,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6550580435402882352,422102437321916297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6550580435402882352,422102437321916297,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,6550580435402882352,422102437321916297,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4700 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7fca7df433cc3329f1964ffbea6aebbe

SHA1
6a6fc71b5bcd0c919418a9d8b2937f3ed1012b15

SHA256
3770c29225eb687d90664225bf4c463d592ec57efff1c132a12a9358f556a7e6

SHA512
f56b4c7a0142fd72a7c193524b5df09a280bc5589714b055b298e3be73b04f3692dd2198815423e70b6876ebe1d0ab00338b6b3c86837e31eed0dff0be86c113

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
edc6e5c79b58c0b0771e0e4b303d6b11

SHA1
95221be1cf2db52a50ff3b580d7f9c551f94b9b3

SHA256
a1033dadccf1c97f9ca5f098d414a9586f455ae5fe98f57e195d862f4dd44e5d

SHA512
5d594192c4758bf399b6421fff06f0ca3c57a5285cf6e670744e7447adcd5f53269d350f8e0bdf06883b69e5694baa16cfb113c312676c85a892ba64997af2e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
27f063f18ea37c8f75413aa81c1f003f

SHA1
a88eb383371a426f13aaa972558b1df851fa7bb0

SHA256
211d116251408c35b0a1214f2882e2cafb3524b32c9a6576eb2b38b16751e2b7

SHA512
50f1ca52f98ef32b216248736a7a78acf392b9d2c17e0ba7edadf3e9f58ea4dfc62831f88cfdd3e4be3bba018c309237f711b2050620ec3338c589c23b045d4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a890b148a3a4646d9d2e4c8a5b9eb617

SHA1
39a610d9706cf1f15ff7c43e799e5967922770a5

SHA256
319b23f38226daae1b3a67ef808006f5c456180cac446de3566fb8e8d9fa5d37

SHA512
a66c39c2b690c29082d0397b8001ff1ccb0278fe1a50f221ed96ea46e17ff9d3827b810fd548e243446c7c9aa18ef5ac2aefbd1f71a9d25faa1ac7af670499c4

Download Submit