05c18b702b92999c91eeaf3560d291c1d8d32a23a25a38b6363f8fdb483fd1f6

Analysis

max time kernel
145s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 14:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8acf291e8c8a53c4d4eb18e2652b7c83_JaffaCakes118.html
Size

31KB
MD5

8acf291e8c8a53c4d4eb18e2652b7c83
SHA1

8f60810fcdf85164f87b4258a5e1dfdd577f07a5
SHA256

05c18b702b92999c91eeaf3560d291c1d8d32a23a25a38b6363f8fdb483fd1f6
SHA512

8efab53a8612bd8e464b8f9c619b7542e8f15fc677ffa839ce6f4e0a0a4c1e8e09b7424469abf581aae5ab0aed59360519e5afac24b3d1aa5145bea60c7c73c9
SSDEEP

768:qv58+EPTjIaCbCQC0CXC+CkQYrajk+3g3:qv58+EPTjIaYNHEvL8k

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3888	msedge.exe
3888	msedge.exe
4476	msedge.exe
4476	msedge.exe
3592	identity_helper.exe
3592	identity_helper.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 1380	4476	msedge.exe	83
PID 4476 wrote to memory of 1380	4476	msedge.exe	83
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 656	4476	msedge.exe	84
PID 4476 wrote to memory of 3888	4476	msedge.exe	85
PID 4476 wrote to memory of 3888	4476	msedge.exe	85
PID 4476 wrote to memory of 2008	4476	msedge.exe	86
PID 4476 wrote to memory of 2008	4476	msedge.exe	86
PID 4476 wrote to memory of 2008	4476	msedge.exe	86
PID 4476 wrote to memory of 2008	4476	msedge.exe	86
PID 4476 wrote to memory of 2008	4476	msedge.exe	86
PID 4476 wrote to memory of 2008	4476	msedge.exe	86
PID 4476 wrote to memory of 2008	4476	msedge.exe	86
PID 4476 wrote to memory of 2008	4476	msedge.exe	86
PID 4476 wrote to memory of 2008	4476	msedge.exe	86
PID 4476 wrote to memory of 2008	4476	msedge.exe	86
PID 4476 wrote to memory of 2008	4476	msedge.exe	86
PID 4476 wrote to memory of 2008	4476	msedge.exe	86
PID 4476 wrote to memory of 2008	4476	msedge.exe	86
PID 4476 wrote to memory of 2008	4476	msedge.exe	86
PID 4476 wrote to memory of 2008	4476	msedge.exe	86
PID 4476 wrote to memory of 2008	4476	msedge.exe	86
PID 4476 wrote to memory of 2008	4476	msedge.exe	86
PID 4476 wrote to memory of 2008	4476	msedge.exe	86
PID 4476 wrote to memory of 2008	4476	msedge.exe	86
PID 4476 wrote to memory of 2008	4476	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8acf291e8c8a53c4d4eb18e2652b7c83_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad02946f8,0x7ffad0294708,0x7ffad0294718
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,13224446078620484307,9971650275007714344,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,13224446078620484307,9971650275007714344,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,13224446078620484307,9971650275007714344,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13224446078620484307,9971650275007714344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13224446078620484307,9971650275007714344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,13224446078620484307,9971650275007714344,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,13224446078620484307,9971650275007714344,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13224446078620484307,9971650275007714344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13224446078620484307,9971650275007714344,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13224446078620484307,9971650275007714344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13224446078620484307,9971650275007714344,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,13224446078620484307,9971650275007714344,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fd18edf9c4ba236e56309c16ce21c9f6

SHA1
3afd8011f43461d38fed8d6231ece4ebf1dc6290

SHA256
a7eaf52008158ea9a20f3d56e982df9c94ad97bcb65de3e4baf6fd3790c52ce7

SHA512
f3aa97f7ddc903a5edee31c2fa4fab9adccf3d16e9f61814f86b924e6c2c31a926a206ecccac8a87004baf5babe4be0ef2ec081c37cbf98d9d520b5f45b53df5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8e4bff4b1a8daed2916b62064614bbfd

SHA1
671ff7f3b797cc01f23c1bf658026fe6b3caf729

SHA256
cfd9d81ad47666a68e694d98dcedabf14b0c57f1a10f8144f541bd1126e92d86

SHA512
564ce70d521e41825785ca871d2cd3747f4b7558fe3f315c03fb92dfa7b1570ede9ae8230058025731f96e014d81566fd1f9c2bd9cfab931ba6196ed386a51ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\afdc4934-faff-474d-8493-f8d355255913.tmp

Filesize
6KB

MD5
e41be4cf5396c3ab1dd52bdb57605647

SHA1
6bd2db00eb5c56e611a6a4ad044d55644708748a

SHA256
91be7f07ef10230b9d04c40c0a6e5910b07e6ad564eed14efaf032a582d66018

SHA512
d6b1d207816d5294785e4653358bd012e888b83b03c0b2c8f215f89b73b7f9b4112053595bb8294b172e7a302212b17a30e1a9738c3b999e4dd91306609d9f9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b72877f04c6e9069851159177d1f1805

SHA1
8be8c925623191d33d7b7921b777e5dc9ab2ca96

SHA256
ed82e6a661f574ead8e761234c03ced023676ebb0b041e2355be954f5f9e557e

SHA512
241e3883355e3d5f14d11ec8346b0adab3ab5cdae0d98225d34b69984cd24d6d53e5a0957e527699de807a3e548e128f03291111353301af8b39d82f5828584e

Download Submit