a3b0e1286e2def92446ae23cf76e0f7718c0a84a59bfeba48852253f4d22b3ed

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

927eb99a9140e5f7840b7df5f92955f4_JaffaCakes118.html
Size

41KB
MD5

927eb99a9140e5f7840b7df5f92955f4
SHA1

68da21767154a1b8f5d8850d7df3a53aa1c6ee76
SHA256

a3b0e1286e2def92446ae23cf76e0f7718c0a84a59bfeba48852253f4d22b3ed
SHA512

8b5e6e8e17f9990d8b65d3430f526223f7eeedc28c4b6d510a4ab31db5134276296a592d29fcdc6b976fa90156441b85c81e691648991347f6c35779b9f39d7b
SSDEEP

192:uwfzb5n6GnQjxn5Q/inQieBNnNnQOkEntuEnQTbn5nQmSwxxubtisEs7hQmaEgBJ:kQ/GtxittnYVs6

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5060	msedge.exe
5060	msedge.exe
440	msedge.exe
440	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 440 wrote to memory of 612	440	msedge.exe	82
PID 440 wrote to memory of 612	440	msedge.exe	82
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 2872	440	msedge.exe	83
PID 440 wrote to memory of 5060	440	msedge.exe	84
PID 440 wrote to memory of 5060	440	msedge.exe	84
PID 440 wrote to memory of 1820	440	msedge.exe	85
PID 440 wrote to memory of 1820	440	msedge.exe	85
PID 440 wrote to memory of 1820	440	msedge.exe	85
PID 440 wrote to memory of 1820	440	msedge.exe	85
PID 440 wrote to memory of 1820	440	msedge.exe	85
PID 440 wrote to memory of 1820	440	msedge.exe	85
PID 440 wrote to memory of 1820	440	msedge.exe	85
PID 440 wrote to memory of 1820	440	msedge.exe	85
PID 440 wrote to memory of 1820	440	msedge.exe	85
PID 440 wrote to memory of 1820	440	msedge.exe	85
PID 440 wrote to memory of 1820	440	msedge.exe	85
PID 440 wrote to memory of 1820	440	msedge.exe	85
PID 440 wrote to memory of 1820	440	msedge.exe	85
PID 440 wrote to memory of 1820	440	msedge.exe	85
PID 440 wrote to memory of 1820	440	msedge.exe	85
PID 440 wrote to memory of 1820	440	msedge.exe	85
PID 440 wrote to memory of 1820	440	msedge.exe	85
PID 440 wrote to memory of 1820	440	msedge.exe	85
PID 440 wrote to memory of 1820	440	msedge.exe	85
PID 440 wrote to memory of 1820	440	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\927eb99a9140e5f7840b7df5f92955f4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe413d46f8,0x7ffe413d4708,0x7ffe413d4718
  2⤵
  PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,14637132530657221478,12461832681989550182,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,14637132530657221478,12461832681989550182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,14637132530657221478,12461832681989550182,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14637132530657221478,12461832681989550182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14637132530657221478,12461832681989550182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,14637132530657221478,12461832681989550182,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14637132530657221478,12461832681989550182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3052 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14637132530657221478,12461832681989550182,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1816 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,14637132530657221478,12461832681989550182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:1508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4179d84ca64b5c11b03efb3693344e0f

SHA1
30e8268e2f608258941144f4126ac031266caaac

SHA256
b414bda0a94e477b9db69499ec09b4263dab61f5b2613d47f7daddbff5f57be9

SHA512
f7c94572334948ceb0ba917f3f72d640b991ce5440ff80ab08cea322a2968c3d0e676fd9dff9905f3c30fef33952a0d8eb1254c24a3604563b50db0d1d8e683c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d4e7b9ab0bad092211f0c14b970d3870

SHA1
26acc6cf50e23229ffaf50ef27ca83e84fd5e147

SHA256
589e2b41718f65420b5b21e144604fc9720c4cdda28df6caebfafe1f789d95d1

SHA512
90939571585efc8f773a22f0dffc912a8534954d225d52c1b137df3c849cb023ff1df65603c50dbe5b1ae7b300e901f7f1373a76a64b2b07b34656379731fe86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
941c65a0240cfc75c094529c07e017ab

SHA1
91ccd7f0c71c7999b44b83175bf92b6fc31f384d

SHA256
5cd1cb3653e8855adc1ee4a2df582023daad606086ce8727b7d2d093b4a61ac2

SHA512
167b62be66f5165d63631ee86d6cee61f9b436373357935e2c5f0ab6b310b598503f5169110cdb1c37b5fcacb662721ebd0877c6aba1e766e72aa14795aafde7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
524a93da339090b939ce02aadd29751c

SHA1
70400583e27f4b613e35c19d2d2e397602bd0758

SHA256
9205052ee81d6d2985639ecfc8438b14da06f350d8167ab578260ff4dba34536

SHA512
d1afba2bae713cfe3c4c7a4193406085ddaac9c631ee5d8897dab0fcb789d2f383cf2d9a7ca3c194fd6370eb00d36f6bd11f24480efc540be530d42c1e6f9cd2

Download Submit