b786180e5894f3e4ae29053b0b8f387b8f6ae28011cedc17ca3fd1ee3dac2ab7

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 08:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9118312d16c2dfca81faff979b2aa2ea_JaffaCakes118.html
Size

643B
MD5

9118312d16c2dfca81faff979b2aa2ea
SHA1

823fb0d1e35c0fbeab99c1435b04ab66f62bd08f
SHA256

b786180e5894f3e4ae29053b0b8f387b8f6ae28011cedc17ca3fd1ee3dac2ab7
SHA512

a00c5133dae1566c45bc16026ea50d1933204520e5ca4b06dd04184bb713417866179ee76ca406aeba6bd81e199d2614f393f76bb29094536445d91010f0c794

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2820	msedge.exe
2820	msedge.exe
3492	msedge.exe
3492	msedge.exe
4256	identity_helper.exe
4256	identity_helper.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 1340	3492	msedge.exe	82
PID 3492 wrote to memory of 1340	3492	msedge.exe	82
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 1004	3492	msedge.exe	83
PID 3492 wrote to memory of 2820	3492	msedge.exe	84
PID 3492 wrote to memory of 2820	3492	msedge.exe	84
PID 3492 wrote to memory of 1300	3492	msedge.exe	85
PID 3492 wrote to memory of 1300	3492	msedge.exe	85
PID 3492 wrote to memory of 1300	3492	msedge.exe	85
PID 3492 wrote to memory of 1300	3492	msedge.exe	85
PID 3492 wrote to memory of 1300	3492	msedge.exe	85
PID 3492 wrote to memory of 1300	3492	msedge.exe	85
PID 3492 wrote to memory of 1300	3492	msedge.exe	85
PID 3492 wrote to memory of 1300	3492	msedge.exe	85
PID 3492 wrote to memory of 1300	3492	msedge.exe	85
PID 3492 wrote to memory of 1300	3492	msedge.exe	85
PID 3492 wrote to memory of 1300	3492	msedge.exe	85
PID 3492 wrote to memory of 1300	3492	msedge.exe	85
PID 3492 wrote to memory of 1300	3492	msedge.exe	85
PID 3492 wrote to memory of 1300	3492	msedge.exe	85
PID 3492 wrote to memory of 1300	3492	msedge.exe	85
PID 3492 wrote to memory of 1300	3492	msedge.exe	85
PID 3492 wrote to memory of 1300	3492	msedge.exe	85
PID 3492 wrote to memory of 1300	3492	msedge.exe	85
PID 3492 wrote to memory of 1300	3492	msedge.exe	85
PID 3492 wrote to memory of 1300	3492	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9118312d16c2dfca81faff979b2aa2ea_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc074f46f8,0x7ffc074f4708,0x7ffc074f4718
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,17905639258771788109,9509009572632596712,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,17905639258771788109,9509009572632596712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,17905639258771788109,9509009572632596712,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17905639258771788109,9509009572632596712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17905639258771788109,9509009572632596712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17905639258771788109,9509009572632596712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17905639258771788109,9509009572632596712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,17905639258771788109,9509009572632596712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,17905639258771788109,9509009572632596712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17905639258771788109,9509009572632596712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17905639258771788109,9509009572632596712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17905639258771788109,9509009572632596712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17905639258771788109,9509009572632596712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,17905639258771788109,9509009572632596712,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
a88e6280b910cd9e9498f223f22db218

SHA1
0569742f0993f93d22287a33f1cefa2fd2638136

SHA256
4bf064441e0a50313dececc95370eb3a641cae76af0e3ef88947f95ab3061d04

SHA512
34cdc8caa9067a2550d00e673ce3726f177b1b425755f27b5d9d9e3203892149951581d2f5f2457b6e2eae341fdd651bf5076e944325fde83a2ad750da0f2bd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2af155cf53cef974d3097c01e0bb8c33

SHA1
529f5069938951c889323ed1b89a85e427697736

SHA256
7dd72ccd8fd2cbfcbe1d0264933a5e2f84deae0bd365511de485dd29ed0b8c19

SHA512
9c061d176ce497bec2eb5742082eed5bf0817c99ed01a27d1494a7ad9e88206e21d6f75fc934e7fb55d33ef79f59d19738688491cacb77b0129140103c0d8f8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
32426607dd1924a0767ed22a2a0d3e89

SHA1
fdf4c28975b48b9673171d8768643a7531044ec9

SHA256
1650bb01ca9ad23e64b78064afec94064620a960904ea37a2584c287f340b1a8

SHA512
ef446b01ee4dfa49c37484751804ef75a3bd866eb5dd655b7e8624f98c5edd53a992219633d31364cc1b246a94ac3fafecf5da1c345ad3fc7b8318edfdac97dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
54482980a71c793e4f1a166880ea6ebc

SHA1
bbd97f672bf4ef18d42bbee704431240df35dfd0

SHA256
e22f0bb9e45365c28f2be69fdd2f400ff088f355353b11c28fcb1e9ccd93b59c

SHA512
67b3c271bd29452d3715e27f3cbccc778cddbbb310164d0753860595b96677fe58aa0e334592014ba1f1d048cfbe49a20c9b17b8da2f3dcf4d8b8d6144b08a46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
de29b5760052d79ce8b57bcc040b7b09

SHA1
cf161f35d73feb63bf193cc2c0ca64ee194d83e0

SHA256
5c1c4bd1c02b10bd4c3b9f222a24538e7eedf791a369c5b0dc02052bd28553b3

SHA512
8c2e976a1eb7a77595dc8c4a7eec9c42d666e17e5bed8a7436ee2d2a6a0787087c17545853a458612a214ee0a9ea88946e1a3fa28438013bc38c35875041f9d7

Download Submit