8534e17d7febc7f8319f22b0a89341aa25be4faca55d11c99e551b84c855c03e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d7a738305138dbc58ba32ef675b1672_JaffaCakes118.html
Size

68KB
MD5

8d7a738305138dbc58ba32ef675b1672
SHA1

83cca2181063e32b06bfb9559df8eab75d3c2a4b
SHA256

8534e17d7febc7f8319f22b0a89341aa25be4faca55d11c99e551b84c855c03e
SHA512

4d8517f585cca9892bfe7341dc26b3de621c6230c8b2d7547ed3a04123e3b12f10ab17f2f731992f4351da834cbf6697b48612096be65c401153b43ece2ff7fe
SSDEEP

1536:J8QGTGuFOGux3TcNen0tbrga94hcuNnQC:JhGTmb3TcNUq4hcuZX

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4968	msedge.exe
4968	msedge.exe
1712	identity_helper.exe
1712	identity_helper.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 3280	4968	msedge.exe	82
PID 4968 wrote to memory of 3280	4968	msedge.exe	82
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4740	4968	msedge.exe	83
PID 4968 wrote to memory of 4640	4968	msedge.exe	84
PID 4968 wrote to memory of 4640	4968	msedge.exe	84
PID 4968 wrote to memory of 1684	4968	msedge.exe	85
PID 4968 wrote to memory of 1684	4968	msedge.exe	85
PID 4968 wrote to memory of 1684	4968	msedge.exe	85
PID 4968 wrote to memory of 1684	4968	msedge.exe	85
PID 4968 wrote to memory of 1684	4968	msedge.exe	85
PID 4968 wrote to memory of 1684	4968	msedge.exe	85
PID 4968 wrote to memory of 1684	4968	msedge.exe	85
PID 4968 wrote to memory of 1684	4968	msedge.exe	85
PID 4968 wrote to memory of 1684	4968	msedge.exe	85
PID 4968 wrote to memory of 1684	4968	msedge.exe	85
PID 4968 wrote to memory of 1684	4968	msedge.exe	85
PID 4968 wrote to memory of 1684	4968	msedge.exe	85
PID 4968 wrote to memory of 1684	4968	msedge.exe	85
PID 4968 wrote to memory of 1684	4968	msedge.exe	85
PID 4968 wrote to memory of 1684	4968	msedge.exe	85
PID 4968 wrote to memory of 1684	4968	msedge.exe	85
PID 4968 wrote to memory of 1684	4968	msedge.exe	85
PID 4968 wrote to memory of 1684	4968	msedge.exe	85
PID 4968 wrote to memory of 1684	4968	msedge.exe	85
PID 4968 wrote to memory of 1684	4968	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8d7a738305138dbc58ba32ef675b1672_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa439e46f8,0x7ffa439e4708,0x7ffa439e4718
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,10277212575807991213,8114098309382815238,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,10277212575807991213,8114098309382815238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,10277212575807991213,8114098309382815238,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,10277212575807991213,8114098309382815238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,10277212575807991213,8114098309382815238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,10277212575807991213,8114098309382815238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,10277212575807991213,8114098309382815238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,10277212575807991213,8114098309382815238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,10277212575807991213,8114098309382815238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,10277212575807991213,8114098309382815238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,10277212575807991213,8114098309382815238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,10277212575807991213,8114098309382815238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,10277212575807991213,8114098309382815238,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2cba5aeb-aea8-4287-a5aa-7b25dc3f08f5.tmp

Filesize
410B

MD5
5e5ec2a8bca5c16577c3117e9530b063

SHA1
00d7860bec1729468a97aea3a8203dbfbcfaced3

SHA256
28e13af4b7e369d3b9b4ef77f20629fcfcdded7f33a0ac42df564899b6774725

SHA512
e9ad8f01dc976b2ff2c4cf1d973d84ee8757ee7d8142b7cdfb53d6a211f57791408bd8e33b6269db52923c48e501c48532c576b71e0e680c09ece926d9285f7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
133f3b8752de20bc563bd20907adaf62

SHA1
2068914e23658b727a75f815240f22df08a2d877

SHA256
41ca01dbfd4c473235f6e4bbadf3f5bee609379e4729def3bb629c4b3fdc67e6

SHA512
1e50eea2e6bf0d714a7f12aadc8a879639dc1dc5c614106c11c3ebeded8403925bc74f6d4b9ff1ba8536e07c3492db28470547c0df04a608da28f8b61aae5b9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
05ac2dfe50990cd69ba95752205b9bc5

SHA1
34b28c68c0877d0959f22bbf9943560baf88dbbf

SHA256
06e9c166ec353ebe9c246d07686cdbd6053d41c21a570e242c0652b200d5c152

SHA512
8c04177636d08e33e8820c7c3fe3d9b9722e1fef9495b45ab70b6b0ec2dd6fdeeb500d1b21275d982f551bc3b3bc599a062ec69444b263fa95d4ae89e0254428

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f2609620d1195b559d0035ac35bfa956

SHA1
efbdfa71411651d42abc7de97c4f2d3c9c4ec36a

SHA256
a14b21521962983c8796d144c1f9f2033a06728c56fa17b30a0c9dd8c00ef1ad

SHA512
79af4a3dea17fa90162668db21b5c99e5632aea65c57fb25df8353e3c9492a47f5052ba30421844383686d1f1820692e92da5f6080731ec414a628698c31f4bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cbca87a55bfe93d865b2a7d9f26f12f8

SHA1
1950b2a8b76a8a04865718fc12a2e3cc79a9cd9c

SHA256
eccb2bf169ef372ade481a8aa3bbc30e22863576988019c03b2d34bcd2ad55cf

SHA512
af8c2d5dbfa557ef04eebb7fb322385aaa13e93128df3e89ec37b9fd25263a323281114cb012ee1db6e2de42c81bc5d2d7cd369f8d798b631c207bccc59f6a66

Download Submit