71ff2dadc45db02d18552b9edd7aa2d554b41d5afd1c948c151b5a363f36bdbf

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 19:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8f2010e39e2ae3a16f6a6e5435c28ad0_JaffaCakes118.html
Size

15KB
MD5

8f2010e39e2ae3a16f6a6e5435c28ad0
SHA1

486a58d0eaa0beae32cce83da78a68389bf00441
SHA256

71ff2dadc45db02d18552b9edd7aa2d554b41d5afd1c948c151b5a363f36bdbf
SHA512

789bf8734f96f894609cbf920437431c3775497da049019be65f41d6b7dd11b5b44217c96ec9e387dbc4adcb65752e5c2e8e3a4d43cbe7063df9365bfce23228
SSDEEP

192:P2sOPGqom88LsCHRZ+XUI6Iunn7EhdmOY/+ZEJKmt+p8GLcD:P2Cm88LsCH+2kmO2+ZuKbp8i2

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe
4268	msedge.exe
4268	msedge.exe
4400	identity_helper.exe
4400	identity_helper.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 3092	4268	msedge.exe	83
PID 4268 wrote to memory of 3092	4268	msedge.exe	83
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 3832	4268	msedge.exe	84
PID 4268 wrote to memory of 2428	4268	msedge.exe	85
PID 4268 wrote to memory of 2428	4268	msedge.exe	85
PID 4268 wrote to memory of 652	4268	msedge.exe	86
PID 4268 wrote to memory of 652	4268	msedge.exe	86
PID 4268 wrote to memory of 652	4268	msedge.exe	86
PID 4268 wrote to memory of 652	4268	msedge.exe	86
PID 4268 wrote to memory of 652	4268	msedge.exe	86
PID 4268 wrote to memory of 652	4268	msedge.exe	86
PID 4268 wrote to memory of 652	4268	msedge.exe	86
PID 4268 wrote to memory of 652	4268	msedge.exe	86
PID 4268 wrote to memory of 652	4268	msedge.exe	86
PID 4268 wrote to memory of 652	4268	msedge.exe	86
PID 4268 wrote to memory of 652	4268	msedge.exe	86
PID 4268 wrote to memory of 652	4268	msedge.exe	86
PID 4268 wrote to memory of 652	4268	msedge.exe	86
PID 4268 wrote to memory of 652	4268	msedge.exe	86
PID 4268 wrote to memory of 652	4268	msedge.exe	86
PID 4268 wrote to memory of 652	4268	msedge.exe	86
PID 4268 wrote to memory of 652	4268	msedge.exe	86
PID 4268 wrote to memory of 652	4268	msedge.exe	86
PID 4268 wrote to memory of 652	4268	msedge.exe	86
PID 4268 wrote to memory of 652	4268	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8f2010e39e2ae3a16f6a6e5435c28ad0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bed246f8,0x7ff8bed24708,0x7ff8bed24718
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4677283326784664349,15216223580916718435,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,4677283326784664349,15216223580916718435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,4677283326784664349,15216223580916718435,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4677283326784664349,15216223580916718435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4677283326784664349,15216223580916718435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4677283326784664349,15216223580916718435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4677283326784664349,15216223580916718435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4677283326784664349,15216223580916718435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4677283326784664349,15216223580916718435,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4677283326784664349,15216223580916718435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4677283326784664349,15216223580916718435,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4677283326784664349,15216223580916718435,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4832 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
954B

MD5
c5d549dd0e64d1c5293ab8346af4ce30

SHA1
7e15db579ef288910e1248036e94e8b5f7106202

SHA256
0fb890f8e53ead62b7afc20fb38b827f13acd399c18cd0a53e91350df0059b18

SHA512
e559b9d039dcc9a1276c5abe77196f943ce361689aeab8cd1c0231e99504b88098744f8642685bba3f4e2e7602da0bd8be1d7331371269d20d057c6573595423

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
43de7db1ef89db659a5fdaa5d7a3ba46

SHA1
8d9dee3fb0cf2718f152476eeff8f75bc314f700

SHA256
3193475719071a23e1c6b60a4a464e8579b6dface8218eeb6f6d0643de927138

SHA512
2913a666b2d60b6fbc7481507a4d7f20a781c6b83e7f72688a24e61f11ac0775500c5cefa087f148b94921100a359302c4d5db57e9a199c4a6388f048719ebf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bf4a5a0e996c17ac24248583e379de9a

SHA1
774622aa556063a43df917864dc526f4d45c13f8

SHA256
d1286d9e9da9b33209ce5f32a01274f29ec60d92b9fcb648ecf2d30b20b2f1e1

SHA512
724285a74bf600dbb51ee4ae83289c9316071b9b4809b673e40da42dd990245bae219465d1c744beffaa69dbd97de4d5b088f259b4b632f5d6db34b5a98abcac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bc4f0351d9654f771038046b45c5db8b

SHA1
84dc7777760776483de4fd5f61d0047f2581af0f

SHA256
6b640b01bd19defbf151297e5167e134b1255141993ded482b048270490985dc

SHA512
308a5d4c82775382541608e10d7b93662f33ed34c8e0e50f2e2f8be6a48a86441d2e056e77f73ed36212e2f30446d675543e7116836c6ccd4990de6aac080d35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f485ce3302c5eaa33e61033f98eba026

SHA1
cf35782c22fe99b65bd706b2c32cbfd8cc2e8544

SHA256
a876f5230d6ccfd72a3dcf52189f53200069967115fccbdda60f2511ee5b61bb

SHA512
b062c72bde03a3c7ff453f8fd3576d251e6ab6438c1db582586151a0d845b22b6ea01b8cabbbc488057b3f9472793df736e214799d13ce7bb2ade40b7a09bb37

Download Submit