9555c8bad22d8f3c21603e3acbcfeb5f954d9d4bd8a21ca5e777054fe9430125

Analysis

max time kernel
145s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8cd0bdf4a62ef2359a27a1f172b97376_JaffaCakes118.html
Size

10KB
MD5

8cd0bdf4a62ef2359a27a1f172b97376
SHA1

2188a314fcf08363e29f73e1fdeae920e0687775
SHA256

9555c8bad22d8f3c21603e3acbcfeb5f954d9d4bd8a21ca5e777054fe9430125
SHA512

d6165aa784330536c98a0c83b99a5bd47aa283116dbbaff785d145c2db0a1cbec31c767bc9fa9dd98ee621c15eb7ea9ca1807f39ecd1a6f25cb9ec030e76ec6c
SSDEEP

192:rRLAPr3eLOTciZelio6/jIBCuyMBhVa7PE65nqhaHu6OWehUz3D:rRLw3/TMlio6/jIBCUL87PE65nqkHu6p

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3456	msedge.exe
3456	msedge.exe
3012	msedge.exe
3012	msedge.exe
1048	identity_helper.exe
1048	identity_helper.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 1792	3012	msedge.exe	83
PID 3012 wrote to memory of 1792	3012	msedge.exe	83
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 548	3012	msedge.exe	84
PID 3012 wrote to memory of 3456	3012	msedge.exe	85
PID 3012 wrote to memory of 3456	3012	msedge.exe	85
PID 3012 wrote to memory of 3084	3012	msedge.exe	86
PID 3012 wrote to memory of 3084	3012	msedge.exe	86
PID 3012 wrote to memory of 3084	3012	msedge.exe	86
PID 3012 wrote to memory of 3084	3012	msedge.exe	86
PID 3012 wrote to memory of 3084	3012	msedge.exe	86
PID 3012 wrote to memory of 3084	3012	msedge.exe	86
PID 3012 wrote to memory of 3084	3012	msedge.exe	86
PID 3012 wrote to memory of 3084	3012	msedge.exe	86
PID 3012 wrote to memory of 3084	3012	msedge.exe	86
PID 3012 wrote to memory of 3084	3012	msedge.exe	86
PID 3012 wrote to memory of 3084	3012	msedge.exe	86
PID 3012 wrote to memory of 3084	3012	msedge.exe	86
PID 3012 wrote to memory of 3084	3012	msedge.exe	86
PID 3012 wrote to memory of 3084	3012	msedge.exe	86
PID 3012 wrote to memory of 3084	3012	msedge.exe	86
PID 3012 wrote to memory of 3084	3012	msedge.exe	86
PID 3012 wrote to memory of 3084	3012	msedge.exe	86
PID 3012 wrote to memory of 3084	3012	msedge.exe	86
PID 3012 wrote to memory of 3084	3012	msedge.exe	86
PID 3012 wrote to memory of 3084	3012	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8cd0bdf4a62ef2359a27a1f172b97376_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff871a346f8,0x7ff871a34708,0x7ff871a34718
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,991227130731218790,15632279994434791897,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,991227130731218790,15632279994434791897,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,991227130731218790,15632279994434791897,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,991227130731218790,15632279994434791897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,991227130731218790,15632279994434791897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,991227130731218790,15632279994434791897,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,991227130731218790,15632279994434791897,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,991227130731218790,15632279994434791897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,991227130731218790,15632279994434791897,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,991227130731218790,15632279994434791897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,991227130731218790,15632279994434791897,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,991227130731218790,15632279994434791897,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d88e17c367b081636bbdf06012f54073

SHA1
d75efb41e890cc9b2c5105d565e8356d81d35e28

SHA256
2f76d5bd9710f1c4c7ded767e9e717612f28f08d99aecef84f4ec7bb9734c600

SHA512
898f9760832dd6435461322bc80d6e3109e4b606d3457bb1543784c795c731fc2370ed385a9e872bbf057c142ea5c04d658699904e7f93c60ae8f374f6cb85b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d2b2cdc031b38fc1782001aba1bcc09d

SHA1
f65e0bbbc6189e7f7b2c1731767210d359ed0084

SHA256
79f5427c9c2c9a2811b50addf9f0d058d2a77c37c732436f665e202c480f927b

SHA512
24febf3effdd6fd27fb197c4acbdaf49945de79eda0921f5e0f433ebce70ac9b168128ec9967596ca64ce1907184d65559f3b1894318a00d87cdafd802d1a08d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d0bdc51267aab62fe2483bce155ab931

SHA1
6fdf97ad547035f9c6188c4c94749bd30955873b

SHA256
745083eb4b81247a9bf59081d5f8b549a10d153b412d3c3870d3aa2e361b0926

SHA512
816e71b768baf9890f58fb6d1c0104d38201955e4d4d98381dc81b43a8e129b5fddff96b34e1e9dd76eed849dcdfe8fd8f244068172f35cb3e24d25761d8c254

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
85f305f9a305a64bf5e7c7e5fdc662a4

SHA1
db7b6d17fa03bad194beb0f499ea8055ac683647

SHA256
df4763668b62913097b2b66d89708bc6b65a041a8c6dc77d05a2da09865f5f8b

SHA512
162c0957e32ccc9dac25289757bf6f42393692ebacd560174e7a2d6c6f330b587c185e0ebe8a64daae5ef44dde535356d8e52f4032b44706b2d7d669051b3ca8

Download Submit