666924bf0d47a604043c587f108b297ac26d6df7f3145a3dc30d1813920eba2e

Analysis

max time kernel
145s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 16:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8eb598ee488a02af351a600bcfdeb211_JaffaCakes118.html
Size

251KB
MD5

8eb598ee488a02af351a600bcfdeb211
SHA1

d52320fb7b0cc92300d1b61b6bb70e1cbafe2b39
SHA256

666924bf0d47a604043c587f108b297ac26d6df7f3145a3dc30d1813920eba2e
SHA512

41b6a4b871a01de1f53e7d84500f0e5b928199c475b2d03aed4b9cdb67d12644053933e40c7d08340f1b225b9b45f9cc1c0e132aab482080ef0068b0c6ba10f9
SSDEEP

6144:JZtiu69pxkZJwO1CA5kiDb3CyQ5xrQe/0STMb8fW2xt:JZtiu6eZJwO1CA5kiDb3CyQ5xrQe/0Sf

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4076	msedge.exe
4076	msedge.exe
1356	msedge.exe
1356	msedge.exe
3744	identity_helper.exe
3744	identity_helper.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 1116	1356	msedge.exe	82
PID 1356 wrote to memory of 1116	1356	msedge.exe	82
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4768	1356	msedge.exe	83
PID 1356 wrote to memory of 4076	1356	msedge.exe	84
PID 1356 wrote to memory of 4076	1356	msedge.exe	84
PID 1356 wrote to memory of 5036	1356	msedge.exe	85
PID 1356 wrote to memory of 5036	1356	msedge.exe	85
PID 1356 wrote to memory of 5036	1356	msedge.exe	85
PID 1356 wrote to memory of 5036	1356	msedge.exe	85
PID 1356 wrote to memory of 5036	1356	msedge.exe	85
PID 1356 wrote to memory of 5036	1356	msedge.exe	85
PID 1356 wrote to memory of 5036	1356	msedge.exe	85
PID 1356 wrote to memory of 5036	1356	msedge.exe	85
PID 1356 wrote to memory of 5036	1356	msedge.exe	85
PID 1356 wrote to memory of 5036	1356	msedge.exe	85
PID 1356 wrote to memory of 5036	1356	msedge.exe	85
PID 1356 wrote to memory of 5036	1356	msedge.exe	85
PID 1356 wrote to memory of 5036	1356	msedge.exe	85
PID 1356 wrote to memory of 5036	1356	msedge.exe	85
PID 1356 wrote to memory of 5036	1356	msedge.exe	85
PID 1356 wrote to memory of 5036	1356	msedge.exe	85
PID 1356 wrote to memory of 5036	1356	msedge.exe	85
PID 1356 wrote to memory of 5036	1356	msedge.exe	85
PID 1356 wrote to memory of 5036	1356	msedge.exe	85
PID 1356 wrote to memory of 5036	1356	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8eb598ee488a02af351a600bcfdeb211_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe4ac46f8,0x7fffe4ac4708,0x7fffe4ac4718
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,12493260362970129570,16231173482780864017,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,12493260362970129570,16231173482780864017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,12493260362970129570,16231173482780864017,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12493260362970129570,16231173482780864017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12493260362970129570,16231173482780864017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12493260362970129570,16231173482780864017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12493260362970129570,16231173482780864017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,12493260362970129570,16231173482780864017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,12493260362970129570,16231173482780864017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12493260362970129570,16231173482780864017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12493260362970129570,16231173482780864017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,12493260362970129570,16231173482780864017,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5584 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\14f7c405-13bc-4cdd-8c0d-6ad8c5093c05.tmp

Filesize
6KB

MD5
30a05651ecca331a485dfb57af2cc096

SHA1
864c1308395f0620990e936de825cbf616c5adbf

SHA256
ae6515a1278de810097999dfd66ec4acad18b179d6d2765950b34a7746e8cb44

SHA512
f42a456608d411bd060caece5855de6011d52dcff11b54a145287ecb12254a3683a9f0cfaf85363c4af9354b39dec7446a031c707391d4547570a0259eaa578b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
183B

MD5
36e530f1819729cbde3b8312d0369762

SHA1
5bb52f8bdd1d5bc6e5852df0302054943703c825

SHA256
5f90bb6703e01223e4a8b3c8a7a30ab50278021f065ea230422c1d6be3d6e868

SHA512
34afec7579589631952d5a33667fd6ac4c1bbed01e857de4c6acaaf77070a2b777a07f0a956acd8ed032d133e8d6d5a0d056e1690bb5f64e94006e659c98f3f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7d2d313588087a1505864581f564158f

SHA1
8334f3ecdec96a1702ff9179a1a3e9b8bc7c8eb1

SHA256
2332cb15e802a682ef80fec9efbe294540286a88a04a7a6e31cbacc6130f1879

SHA512
75284ad707b0d32441e9fc7292ecef7c257ddb9298bee617d8b14636d2af7dca0f53ae983305cfafa3819cb138464a614e23a02003724d2939d44d897559c75f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a42d1620783d20a3316f1d0964e27ba2

SHA1
464496b543642e2b291af1705b2e6df0367c9b4a

SHA256
3e8d141a07ebeddd02633c4681234fd21967cb07e8f28587ce1d1d68f136d4af

SHA512
54dd5d974910567d97402050fa86f46dd6bbe0efb09530de6ddc1f2377c0891c6f9bdb7d602ba02febf80d1f033faf1cd31913f27405e43977e24380d5f29d40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
b6b4cce664712cb852ee55058c816d10

SHA1
2f55695f365012ac96f68c51924a66ee4c5cd6a0

SHA256
64b3abeee97aa7e57cdb5281bac4d2e508da0c1d1125abeb4238485dd7c275ef

SHA512
e038952410978b73913f8fc137541d8e46e36ca48b716408b6be28773cb5eff73c19983e71a9a0140060347bf0363fa75df9a81bd5875e35b365960bfef55784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ba95.TMP

Filesize
203B

MD5
36d2d35a9a322e08fd7df86d081beb66

SHA1
faeddd57e4bdd51f58f34949f7555367ab6192dc

SHA256
871d4f9a04534b894bd97c39ae803d96b3560c77a2451911408ad3e3d4c5e894

SHA512
30c74a0b2711780d8b22ec97654505d615c469a9867c8959ffd361af035ecd23a06bd04244eb62097c15bd4d4a25d0ff18c52f3c8c8c2522213794b44473e3ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cc8b42c71598e5101aea980a914eca81

SHA1
ad0bf704dac7e5ba0cd025f36b207dadaec257e0

SHA256
420be09cc7a259a0f16d7ecad78324ec621e526189dc86a511d05d12f620c4fe

SHA512
e40df8fc546611518cccb60aa24a951c2b0d07dc3a671381313b81acf21b4803acfdc4d23e75017bd296f1fc83c2fc27975fb524a20b994ecaff3428b2a8f568

Download Submit