738a3f6358bff35759dbe21cbbd4d1377580d6e1c8229d4b0aa3550fd3c46d25

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f945fa8a6a3422d65d1b55abe7fcea8_JaffaCakes118.html
Size

19KB
MD5

8f945fa8a6a3422d65d1b55abe7fcea8
SHA1

bca0cf8eca1b93ada4d2ea931bca4f801bdade1c
SHA256

738a3f6358bff35759dbe21cbbd4d1377580d6e1c8229d4b0aa3550fd3c46d25
SHA512

6dae06a76b2399a9482a3acd6066138a5e560b20c4c57222a52e205e0799020deb5752ebe396b69e1a0640f110de8afda1fd4c8e1ff3110a323bc1e2ba7e5804
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAI14vzUnjBhhb82qDB8:SIMd0I5nvHFsvhAxDB8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
884	msedge.exe
884	msedge.exe
3084	msedge.exe
3084	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3084	msedge.exe
3084	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 4208	3084	msedge.exe	82
PID 3084 wrote to memory of 4208	3084	msedge.exe	82
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 3180	3084	msedge.exe	83
PID 3084 wrote to memory of 884	3084	msedge.exe	84
PID 3084 wrote to memory of 884	3084	msedge.exe	84
PID 3084 wrote to memory of 4660	3084	msedge.exe	85
PID 3084 wrote to memory of 4660	3084	msedge.exe	85
PID 3084 wrote to memory of 4660	3084	msedge.exe	85
PID 3084 wrote to memory of 4660	3084	msedge.exe	85
PID 3084 wrote to memory of 4660	3084	msedge.exe	85
PID 3084 wrote to memory of 4660	3084	msedge.exe	85
PID 3084 wrote to memory of 4660	3084	msedge.exe	85
PID 3084 wrote to memory of 4660	3084	msedge.exe	85
PID 3084 wrote to memory of 4660	3084	msedge.exe	85
PID 3084 wrote to memory of 4660	3084	msedge.exe	85
PID 3084 wrote to memory of 4660	3084	msedge.exe	85
PID 3084 wrote to memory of 4660	3084	msedge.exe	85
PID 3084 wrote to memory of 4660	3084	msedge.exe	85
PID 3084 wrote to memory of 4660	3084	msedge.exe	85
PID 3084 wrote to memory of 4660	3084	msedge.exe	85
PID 3084 wrote to memory of 4660	3084	msedge.exe	85
PID 3084 wrote to memory of 4660	3084	msedge.exe	85
PID 3084 wrote to memory of 4660	3084	msedge.exe	85
PID 3084 wrote to memory of 4660	3084	msedge.exe	85
PID 3084 wrote to memory of 4660	3084	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8f945fa8a6a3422d65d1b55abe7fcea8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8699846f8,0x7ff869984708,0x7ff869984718
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,10935781821155181710,13939944456221863851,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,10935781821155181710,13939944456221863851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,10935781821155181710,13939944456221863851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10935781821155181710,13939944456221863851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10935781821155181710,13939944456221863851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,10935781821155181710,13939944456221863851,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4900 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
47424cfefef8a6e0ea1f4d8a53339905

SHA1
8d06ac3d88d4c2d1fbacc3454649e05098f10edf

SHA256
0243fd8f1074f2499e82bc5462dc774e46cd54c878e6387e384c68b798332a65

SHA512
d24b6037a6c0ef7844ccbfa9d85d3cf0274a94ceffab13ff4e916dcebbf7bc009d6fc38064bb98778ab4b2837d299edcd4610c02dbb7e39de346a0a2790eb565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5bcf452c8384f1855279bcb346843ed8

SHA1
398ec44b679cb1f206873ddfa6175f08f02fe151

SHA256
874e2e92f277f731a2730f9e14426bbefb3f036345ae87d3acd6eb54c3937978

SHA512
245343113e4cd91c644eeeec59a85d5744292bee6a05ad041fea2e1014e112233a283e7ca485270512a9cd4f4fbe9045070cf1e8e7b08a5a3b7128e3ef25bc3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
17902812194c9ee76c65b43efaf04517

SHA1
828fde3faac42f76aacc657b7d215dad126174a6

SHA256
70607379d299f404bfa4a5702f5cf6d0afaa8edaa81d910d65fc2e5aae08257b

SHA512
dd5522a93d0ec27d70427e075a754bb9878e5ca685250403fa0d51bc78dc0e242b2a8a104ab5d7a439f03c8dd02df1a35ab59546c8ac059e00174c6565f06d01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0e65f9a1101e11aa5299a42dda154411

SHA1
1bad29765324cba6b3b00a1d8241f7572d432eb2

SHA256
4fb5ed63d014f43d34bf6ecd22721cc6c86f835ae9554777c49c7b78bf9cdb1d

SHA512
37bdc6db10b3bf0a769d52d3be95e1dd5c948f48cacf36402d35135d9fd32480977b33180a48a31effaca5562913946508d046d1eb042d94bfe089c5c12542fc

Download Submit