24141a0f0afed16847792d194ab1cddc1caae137cb21376c80fa4729d10a72df

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03-06-2024 13:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91f2d235bca238718eda7df4c29c9a91_JaffaCakes118.html
Size

20KB
MD5

91f2d235bca238718eda7df4c29c9a91
SHA1

cde2c1b2cdd18c8237020acd34c2abe136067e1c
SHA256

24141a0f0afed16847792d194ab1cddc1caae137cb21376c80fa4729d10a72df
SHA512

53cc5018b692a3d2b662bc79658981674a8c2d4a68eb12f45c804b6bf38f667930850b78b9725ac9db5b823815ac7ef91c36a98dc781b4fcbe2d2225dcc8bb5e
SSDEEP

384:SInI6s0/eZeoKwjj+M++zeCQndc4uEQ9akJDvcmMs1VkVKVoHLAXiXieiYiDneVl:SNP02Zeop+QZ9PDv1MkCU4LAXy/lIe7n

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1792	msedge.exe
1792	msedge.exe
3620	msedge.exe
3620	msedge.exe
3548	identity_helper.exe
3548	identity_helper.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 3308	3620	msedge.exe	81
PID 3620 wrote to memory of 3308	3620	msedge.exe	81
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 2776	3620	msedge.exe	82
PID 3620 wrote to memory of 1792	3620	msedge.exe	83
PID 3620 wrote to memory of 1792	3620	msedge.exe	83
PID 3620 wrote to memory of 2352	3620	msedge.exe	84
PID 3620 wrote to memory of 2352	3620	msedge.exe	84
PID 3620 wrote to memory of 2352	3620	msedge.exe	84
PID 3620 wrote to memory of 2352	3620	msedge.exe	84
PID 3620 wrote to memory of 2352	3620	msedge.exe	84
PID 3620 wrote to memory of 2352	3620	msedge.exe	84
PID 3620 wrote to memory of 2352	3620	msedge.exe	84
PID 3620 wrote to memory of 2352	3620	msedge.exe	84
PID 3620 wrote to memory of 2352	3620	msedge.exe	84
PID 3620 wrote to memory of 2352	3620	msedge.exe	84
PID 3620 wrote to memory of 2352	3620	msedge.exe	84
PID 3620 wrote to memory of 2352	3620	msedge.exe	84
PID 3620 wrote to memory of 2352	3620	msedge.exe	84
PID 3620 wrote to memory of 2352	3620	msedge.exe	84
PID 3620 wrote to memory of 2352	3620	msedge.exe	84
PID 3620 wrote to memory of 2352	3620	msedge.exe	84
PID 3620 wrote to memory of 2352	3620	msedge.exe	84
PID 3620 wrote to memory of 2352	3620	msedge.exe	84
PID 3620 wrote to memory of 2352	3620	msedge.exe	84
PID 3620 wrote to memory of 2352	3620	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91f2d235bca238718eda7df4c29c9a91_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1ff746f8,0x7ffe1ff74708,0x7ffe1ff74718
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2280,15944794810076102376,11841520854715845396,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2280,15944794810076102376,11841520854715845396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2280,15944794810076102376,11841520854715845396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,15944794810076102376,11841520854715845396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,15944794810076102376,11841520854715845396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2280,15944794810076102376,11841520854715845396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2280,15944794810076102376,11841520854715845396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,15944794810076102376,11841520854715845396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,15944794810076102376,11841520854715845396,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,15944794810076102376,11841520854715845396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,15944794810076102376,11841520854715845396,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2280,15944794810076102376,11841520854715845396,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4884 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
732B

MD5
122bb0167325eff28c6fbf0e1952f0e8

SHA1
7b3ba44f80f6e669efe1dbfd9f2cf7bd4a03c495

SHA256
fa9f982dbeb27108d0a038f2041e0be92d7b76b021195bf5adcf47c735897df6

SHA512
9535e8331dc9b2b319304fead18d8be68750cfa8d4017d37ee21fb62ce89696aa66ff0b861fc6f53254c68b081850b164848795e40ee25f414f9e975db1783d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
669B

MD5
4940bbef016d1af5e556dfb81880beee

SHA1
de68680f84be968f0d4950ca0d145ca5d4c31a87

SHA256
514c6d3e2db0f7e20b498a460bafbd066c70f6adf83b23488b3a190fbf23e660

SHA512
d1dcd2945b0bb831ff873756eeb3f0378c8a564e151024e251af4a222744e69a30546a4576682eabbbf6474f0c1833a9c392ec23bfa4f2d83f030fae95f3b7ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
065d3aa9682a9218d26b3199fc23bb74

SHA1
6ea48a0908f856c4cb37fd213a19d0783a348958

SHA256
9718b46257d05c2f7ffe1a8a3cdf45479b54e4b8191a5e3e4c9665c821026ae5

SHA512
33b633b953f365c2dbf6734bc25a29b1516d097dd27c6f22551191a8a40faeddcde2d92075480f1ccdc253f437e6cea203da16a592cd488ed3614905bd60f5fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a3876e0d764830f06fbb5ce81a6d8c8c

SHA1
565814ff29dcf60f213d40b249ea93d73d90306d

SHA256
ee8de0ae55fd34fcdcc3c40b8a97896b6bd09f7d1100019f9d1f589d69f58548

SHA512
039168a37f2601e363e130b5f8a02ac89dd515de8cbbd987eb1b9b8b096fdafb22e7f32a57a09bcae5a78cde4948186caf11438250da0373305546da0a18ea6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
110b9d3ceb946b22454ed4b34c18dc23

SHA1
873007af37c8c44c0be5637e85db243f2dfa1629

SHA256
517ec3b6dd100fd40ecf6ec9e08796be7c6514d562422c52b0752f2a85d8f123

SHA512
a34038973912c46543f909ffc3fdc5d8fedf7ab19410b729aca4e7d0dc8b8bb1418daf162f9c9fa8b2a815206d0d01ef8eeb8bdb8a8a38fd2b84779f7699c614

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ffc01001889df0609e1d7b62cb81936d

SHA1
dd9d52b55aeb738ca2aaba23fda29664d75d28e5

SHA256
0d32f2b5716aaf84a48fe77308bb71085e4cb83ad21a2c58d6506827fda369d8

SHA512
1e228f3ac33dae0eef0f9a87f9671e6513e0f7e75fb3bb8571d32ec188eb5466accef9fbe1bede98cfc51fbfb8e3617f65ab072b3e058e43dfd9d7e507f0275a

Download Submit