227021a9a6ddc5c674fcc35dc43634198bc250e1fecaebe787d4e12c64eee915

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8fae781cbb54e5c5c909036807331e33_JaffaCakes118.html
Size

83KB
MD5

8fae781cbb54e5c5c909036807331e33
SHA1

a6493586edc30100b3d96e200760c00e3953e0c1
SHA256

227021a9a6ddc5c674fcc35dc43634198bc250e1fecaebe787d4e12c64eee915
SHA512

5a9e80f2a88cc99c4c03f2e4c7b084fd5a2bf6c15eb228b49ba1740968bf2ca3051c156b37137013878decde87d0b97ec28605671b38c439e7ee3175aec9c6c3
SSDEEP

1536:PLy1iFblaFWUqsV4AMvAvwkkReJe0eAeoe7eFeWejeaeXeoeMepeUeSeIe8eueXT:zy1+UqsV4AMvndv7X/KtlOlg

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
3940	msedge.exe
3940	msedge.exe
436	identity_helper.exe
436	identity_helper.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 1452	3940	msedge.exe	84
PID 3940 wrote to memory of 1452	3940	msedge.exe	84
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 5104	3940	msedge.exe	87
PID 3940 wrote to memory of 4412	3940	msedge.exe	88
PID 3940 wrote to memory of 4412	3940	msedge.exe	88
PID 3940 wrote to memory of 4760	3940	msedge.exe	89
PID 3940 wrote to memory of 4760	3940	msedge.exe	89
PID 3940 wrote to memory of 4760	3940	msedge.exe	89
PID 3940 wrote to memory of 4760	3940	msedge.exe	89
PID 3940 wrote to memory of 4760	3940	msedge.exe	89
PID 3940 wrote to memory of 4760	3940	msedge.exe	89
PID 3940 wrote to memory of 4760	3940	msedge.exe	89
PID 3940 wrote to memory of 4760	3940	msedge.exe	89
PID 3940 wrote to memory of 4760	3940	msedge.exe	89
PID 3940 wrote to memory of 4760	3940	msedge.exe	89
PID 3940 wrote to memory of 4760	3940	msedge.exe	89
PID 3940 wrote to memory of 4760	3940	msedge.exe	89
PID 3940 wrote to memory of 4760	3940	msedge.exe	89
PID 3940 wrote to memory of 4760	3940	msedge.exe	89
PID 3940 wrote to memory of 4760	3940	msedge.exe	89
PID 3940 wrote to memory of 4760	3940	msedge.exe	89
PID 3940 wrote to memory of 4760	3940	msedge.exe	89
PID 3940 wrote to memory of 4760	3940	msedge.exe	89
PID 3940 wrote to memory of 4760	3940	msedge.exe	89
PID 3940 wrote to memory of 4760	3940	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8fae781cbb54e5c5c909036807331e33_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8517946f8,0x7ff851794708,0x7ff851794718
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,3406040654157074467,2457603869226294900,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,3406040654157074467,2457603869226294900,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,3406040654157074467,2457603869226294900,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3406040654157074467,2457603869226294900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3406040654157074467,2457603869226294900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,3406040654157074467,2457603869226294900,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,3406040654157074467,2457603869226294900,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3406040654157074467,2457603869226294900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3406040654157074467,2457603869226294900,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3406040654157074467,2457603869226294900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,3406040654157074467,2457603869226294900,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,3406040654157074467,2457603869226294900,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
399B

MD5
b8c282bdae78c86defa3f7c008a21b2a

SHA1
999459e41923ac59e982169fb5e4549cdb49e5d5

SHA256
eb0d8876fdae87bd862a0b0c1628c5e2a9089c4bbc5848c59792d7f966fffdd5

SHA512
3ca5f9844593b5833826f73057fdd7784307ffc9c73c4ea331cc993ee751d83549d9f812b583d0c59ba7e4c3266439f254f9e42bd1a81bdd264197d1c893cd64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
36d3ea94a36c94aeae26c83f1a4691c2

SHA1
50cbcbf7193157a68c1ee8a464086e088bb1fafe

SHA256
383035f453bd49b13544a2b281a941a3392145447b2dc5962497cc0d7d80b9d9

SHA512
e352bc7d43dfa34dce0f21bb1b08e4bc504291688fe6c5d6e02a88a168bd0bcd491c6b5e5bc3a6fc5abb5fd8bd21cf3ad057e5b2a261fbb74f31565b48fa88eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
791fbfe1166f231e5bf88333e2f52f7e

SHA1
d52367f75240c467b982799d65bff9212f76d149

SHA256
03eeca01170bc986fa3acea5ca9aace35f55669cb2f0906c76c7f84c70f5633a

SHA512
ea24e16dc3b74d4ad5b651fbf85797fbfdd806ba1e8d03408cece240e18ddfc5297012368ae4d1e5c8fc313c6c11bcdff294350338922e0e5927e4e22f321197

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
68570545e5518d08b3576a2f08bdc08c

SHA1
628bb8786d0c38545fdef7ff182bd88832ced778

SHA256
233baee7a9db923166ff31e22c35ab6857306c25678cbaf8c1ce61ad8b19f8eb

SHA512
46b0c19cae3a167bbcf55cc2c15e1a7dd9a96b96dbacc8260fef9518094104bd5951600608f6dea7b2f42fd4734c5840a3d1eae0d552d247ae29c03d23c0ac3b

Download Submit