1beed8b242edbfa9cafa6beb57d726e2689a13ab806c8deb849699743841fb3c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b2c4a508c6b1626e3f352a1be15b0d1_JaffaCakes118.html
Size

27KB
MD5

8b2c4a508c6b1626e3f352a1be15b0d1
SHA1

40b1f0f5cf6c4541441d6f61ac4de2f3a312cca5
SHA256

1beed8b242edbfa9cafa6beb57d726e2689a13ab806c8deb849699743841fb3c
SHA512

ad08fa4f30747258c36453eb7c2da024bb532328448a9ba680f32ab337394e69209e3f283a0ef9c05eb911435f9e7971e488e5e9681cb5404fdc7dff398261bb
SSDEEP

192:uq8z7eb5nwenQjxn5Q/rnQieSNn2WnnQOkEntpNnQTbn5nQICJVevo7NtJFo+NzU:nSQ/wWeygcq40f

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
464	msedge.exe
464	msedge.exe
1604	msedge.exe
1604	msedge.exe
4464	identity_helper.exe
4464	identity_helper.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 228	1604	msedge.exe	82
PID 1604 wrote to memory of 228	1604	msedge.exe	82
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 744	1604	msedge.exe	83
PID 1604 wrote to memory of 464	1604	msedge.exe	84
PID 1604 wrote to memory of 464	1604	msedge.exe	84
PID 1604 wrote to memory of 4384	1604	msedge.exe	85
PID 1604 wrote to memory of 4384	1604	msedge.exe	85
PID 1604 wrote to memory of 4384	1604	msedge.exe	85
PID 1604 wrote to memory of 4384	1604	msedge.exe	85
PID 1604 wrote to memory of 4384	1604	msedge.exe	85
PID 1604 wrote to memory of 4384	1604	msedge.exe	85
PID 1604 wrote to memory of 4384	1604	msedge.exe	85
PID 1604 wrote to memory of 4384	1604	msedge.exe	85
PID 1604 wrote to memory of 4384	1604	msedge.exe	85
PID 1604 wrote to memory of 4384	1604	msedge.exe	85
PID 1604 wrote to memory of 4384	1604	msedge.exe	85
PID 1604 wrote to memory of 4384	1604	msedge.exe	85
PID 1604 wrote to memory of 4384	1604	msedge.exe	85
PID 1604 wrote to memory of 4384	1604	msedge.exe	85
PID 1604 wrote to memory of 4384	1604	msedge.exe	85
PID 1604 wrote to memory of 4384	1604	msedge.exe	85
PID 1604 wrote to memory of 4384	1604	msedge.exe	85
PID 1604 wrote to memory of 4384	1604	msedge.exe	85
PID 1604 wrote to memory of 4384	1604	msedge.exe	85
PID 1604 wrote to memory of 4384	1604	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8b2c4a508c6b1626e3f352a1be15b0d1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f8da46f8,0x7ff8f8da4708,0x7ff8f8da4718
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,18051574318963945125,7678834862501418879,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,18051574318963945125,7678834862501418879,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,18051574318963945125,7678834862501418879,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18051574318963945125,7678834862501418879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18051574318963945125,7678834862501418879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,18051574318963945125,7678834862501418879,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,18051574318963945125,7678834862501418879,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18051574318963945125,7678834862501418879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18051574318963945125,7678834862501418879,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18051574318963945125,7678834862501418879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,18051574318963945125,7678834862501418879,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1712 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,18051574318963945125,7678834862501418879,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4980 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0d369482c3506e7c9cd1e56e4aa3bd36

SHA1
f765b5e09c2a1cec83d1640de19597c18f30ee42

SHA256
4e48cfd999d3663b65777216d6abeca8d10a1012221bdc59d299b16633c30926

SHA512
14d1c8f394fbce7cbb0f26602304e1eac69faaa74cd9350dd1e0214ec2b48fd46c323983bdb3d6643215d33c5460900792e57159160f55374e184a1aef76fa05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8ac90426a988f3597ac4caa009a90dab

SHA1
3c816dca47bb521a5bcfbe16e9606eb94d846bd1

SHA256
5c42220748987ec5d03bac04e4222b12d6bc39de4142db000259755cdd4b7bed

SHA512
12388a881444532e851e5008c26ae4413a494ef65a69890e4cf872b50d71e1901a0b4972c32e54b56889e2548b15bfa73e88772adfe3f33c29fc1277282b1d84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
488beeb6581a6019c6bbaf93d0a9ff34

SHA1
0390a9ec4b4876f648b441545ae30801ff175dba

SHA256
26a2c7d5c9f58a4d871419d95b3311c6b21fa506ca31f44367fe3b41b49194db

SHA512
97b10d3df54536310d0a09a3995f90517f11d5dea052cb3ec21291025d6e98076f2fc4544c8e28ebc6a7ddc7d488859c92ac9fa1f3ef3bdb708143081751794c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3dc340c2a6895aba942df6842f299d04

SHA1
a0bc05853e45e0f8e2b56dfe97a2ae33f6960f79

SHA256
af133bcd2beb2d01ca2f04ece61103f5c738cd8d24d7e669509ee8da901939bf

SHA512
d1a7c77e986e1ca141d56bfba759547de657e74b3486d213cc68515fadb3b8babda7875b7fa28c35f5e5303deeb38db4cfb68f7ac89b712a133b66e99bf51d6e

Download Submit