5844e370b0a1a903309e98f2f5025b2e4505d5f3d03be74b0dad3fbd21f047ac

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 19:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f35b6bb34045e12b7ec7e65e2f57d8d_JaffaCakes118.html
Size

12KB
MD5

8f35b6bb34045e12b7ec7e65e2f57d8d
SHA1

ebcd03e770faf6144132a4bf780844e29a657ceb
SHA256

5844e370b0a1a903309e98f2f5025b2e4505d5f3d03be74b0dad3fbd21f047ac
SHA512

89956661c53807f4f724f095c0243814edf95b5b71929f3e6570caee789271ff7d26aee53d02dac315e8c9a2705cd8e4a68a59cdd6e3fd3758f41439f286260c
SSDEEP

96:ifuTm2roh9gzZdqtnucn/Pxu/1nMsG6m5sncjbqjuRIYg6B3z05P+d+6cQiNvpSU:ifAE81tRq6mb/Ie3Y5L6riNvpSeon2V

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1884	msedge.exe
1884	msedge.exe
552	msedge.exe
552	msedge.exe
1860	identity_helper.exe
1860	identity_helper.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 1636	552	msedge.exe	82
PID 552 wrote to memory of 1636	552	msedge.exe	82
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 3696	552	msedge.exe	83
PID 552 wrote to memory of 1884	552	msedge.exe	84
PID 552 wrote to memory of 1884	552	msedge.exe	84
PID 552 wrote to memory of 4400	552	msedge.exe	85
PID 552 wrote to memory of 4400	552	msedge.exe	85
PID 552 wrote to memory of 4400	552	msedge.exe	85
PID 552 wrote to memory of 4400	552	msedge.exe	85
PID 552 wrote to memory of 4400	552	msedge.exe	85
PID 552 wrote to memory of 4400	552	msedge.exe	85
PID 552 wrote to memory of 4400	552	msedge.exe	85
PID 552 wrote to memory of 4400	552	msedge.exe	85
PID 552 wrote to memory of 4400	552	msedge.exe	85
PID 552 wrote to memory of 4400	552	msedge.exe	85
PID 552 wrote to memory of 4400	552	msedge.exe	85
PID 552 wrote to memory of 4400	552	msedge.exe	85
PID 552 wrote to memory of 4400	552	msedge.exe	85
PID 552 wrote to memory of 4400	552	msedge.exe	85
PID 552 wrote to memory of 4400	552	msedge.exe	85
PID 552 wrote to memory of 4400	552	msedge.exe	85
PID 552 wrote to memory of 4400	552	msedge.exe	85
PID 552 wrote to memory of 4400	552	msedge.exe	85
PID 552 wrote to memory of 4400	552	msedge.exe	85
PID 552 wrote to memory of 4400	552	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8f35b6bb34045e12b7ec7e65e2f57d8d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffff2ca46f8,0x7ffff2ca4708,0x7ffff2ca4718
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,15793466681525657057,6108836979535713315,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,15793466681525657057,6108836979535713315,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,15793466681525657057,6108836979535713315,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15793466681525657057,6108836979535713315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15793466681525657057,6108836979535713315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,15793466681525657057,6108836979535713315,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,15793466681525657057,6108836979535713315,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15793466681525657057,6108836979535713315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15793466681525657057,6108836979535713315,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15793466681525657057,6108836979535713315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15793466681525657057,6108836979535713315,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,15793466681525657057,6108836979535713315,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1260 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
309B

MD5
a5d1d495b2296e46e135286b06737894

SHA1
1fad0243f584dd3fd43d40ca73fd6b8030eabc92

SHA256
a3fada007d6806cd0d35bc010df85ca838a7343b7ffc32e72ae111f2d364dd71

SHA512
8820908e05a309110e34d31a4331512c2bb23df4028d23d8595310a8df047f058805d419b4a581e368b89c63db10d7b5f444b03fa25fe98cb99b6914a19384bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5c84994b1f09900a1fb4e15e211ed09b

SHA1
887ccda07116b52cc92c38b0dca244e140ab1a68

SHA256
a5832e8a00eff34ba2fab41bdb1a4daeacfe457b2e459b357f1dada89fc3c5db

SHA512
07e182df60f0dcf6cce2a21bb0de4b99791e047fe0e475970b8a0f81e41e06f4316e605aa4670677715b88c1a68e2d07e664ae7e168930e5dc2b3deb613b5bac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1f8ef5e2b829e00d5e81b92840c43bb2

SHA1
24add2c970c80f875b1b16d64385d22a81e28794

SHA256
fb2cc2f2d2c240c95d33f2360e95bd4e0fdb3860d6c2bcfb8612f3b4022f99d6

SHA512
2a9d909ab56d83564954894fc62b92cecbf58e885ee82398c04eaddd9f82be1c3a3b8da966c48fd6206cbb2483b7d627b9368630ec7049a6c526a6cf95b82d07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
82ca5ae184d7ccc9216e95991537f42d

SHA1
0381275ae818dce1364686b6cf14c336d4cad44b

SHA256
99cad59d7ffd919faced56f19d22bbcbd57a2b9fe16f625291e4a7ac8e5b7607

SHA512
be94f8a17f7ae7027ef50952f32e46eb5f3e148d96448339392f2ffac7d7b0caac902efb61923358fa6c657c02a7993acf2cc4050901eb13c986ee189443f0c5

Download Submit