d32fd79a4694662159e20a7a5a1adc7b53799566486925f289ace0176cec2b42

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-06-2024 17:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9291b6010e3f9a30da679c3c33359c85_JaffaCakes118.html
Size

24KB
MD5

9291b6010e3f9a30da679c3c33359c85
SHA1

8c259682bd155f8e29c2853e305ad30ffc1ceb20
SHA256

d32fd79a4694662159e20a7a5a1adc7b53799566486925f289ace0176cec2b42
SHA512

3d3743953b7173f60bd1e486b6a04ddb53abd003c1d161504fad600474f78632e5393b989a3dcca8a736655a20811dd7b4e065a6f53deb7ae2de5a4f91961af6
SSDEEP

768:g59ebtFy0r5sOCnIekX72DqaREuRgV3uR:g59ebtRrPCnIekX72DqaREuRgV3uR

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3592	msedge.exe
3592	msedge.exe
1412	msedge.exe
1412	msedge.exe
2444	identity_helper.exe
2444	identity_helper.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 116	1412	msedge.exe	82
PID 1412 wrote to memory of 116	1412	msedge.exe	82
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 4980	1412	msedge.exe	83
PID 1412 wrote to memory of 3592	1412	msedge.exe	84
PID 1412 wrote to memory of 3592	1412	msedge.exe	84
PID 1412 wrote to memory of 3224	1412	msedge.exe	85
PID 1412 wrote to memory of 3224	1412	msedge.exe	85
PID 1412 wrote to memory of 3224	1412	msedge.exe	85
PID 1412 wrote to memory of 3224	1412	msedge.exe	85
PID 1412 wrote to memory of 3224	1412	msedge.exe	85
PID 1412 wrote to memory of 3224	1412	msedge.exe	85
PID 1412 wrote to memory of 3224	1412	msedge.exe	85
PID 1412 wrote to memory of 3224	1412	msedge.exe	85
PID 1412 wrote to memory of 3224	1412	msedge.exe	85
PID 1412 wrote to memory of 3224	1412	msedge.exe	85
PID 1412 wrote to memory of 3224	1412	msedge.exe	85
PID 1412 wrote to memory of 3224	1412	msedge.exe	85
PID 1412 wrote to memory of 3224	1412	msedge.exe	85
PID 1412 wrote to memory of 3224	1412	msedge.exe	85
PID 1412 wrote to memory of 3224	1412	msedge.exe	85
PID 1412 wrote to memory of 3224	1412	msedge.exe	85
PID 1412 wrote to memory of 3224	1412	msedge.exe	85
PID 1412 wrote to memory of 3224	1412	msedge.exe	85
PID 1412 wrote to memory of 3224	1412	msedge.exe	85
PID 1412 wrote to memory of 3224	1412	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9291b6010e3f9a30da679c3c33359c85_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f8da46f8,0x7ff8f8da4708,0x7ff8f8da4718
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,6965347842130949008,15556433979872195928,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,6965347842130949008,15556433979872195928,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,6965347842130949008,15556433979872195928,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6965347842130949008,15556433979872195928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6965347842130949008,15556433979872195928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6965347842130949008,15556433979872195928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6965347842130949008,15556433979872195928,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,6965347842130949008,15556433979872195928,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3328 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,6965347842130949008,15556433979872195928,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6965347842130949008,15556433979872195928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6965347842130949008,15556433979872195928,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,6965347842130949008,15556433979872195928,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
182B

MD5
e8d89bf23b32e41f2b4ce7029484d94c

SHA1
0ea4948e92563fa501faad79999c394950e239fd

SHA256
31e2bcfc96bc2a345cc324a71a6eafbe2bc0386c1b11316737e67271b605f847

SHA512
9f7dd967bf18f19701dd2c967c7010c9e815fc6aa19c636b04758ad7ce06aef925a969429c2bdcf0e8ff4edd328c2bb93e0f5adb215cc9088ecadebfb1d91d7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bf0a88f2dca4fd6bffdab51c42d4db13

SHA1
0bf461ed6472dde6f09e04a189215529ae2f0b66

SHA256
5111a18ee26a8836b07836c357b8fedfdb2525d92282e0af4852b4633b95f5e4

SHA512
1ce13393e2d6e5a85898660a22469064010b31ea42be0fbdf69b9f3946964f29a3e7ceded6842ce5712550fa98b7aff3bada4bf44beefd1a596c186a18e47fd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d4497b78bff3e0b9713f163ea772f812

SHA1
5979154d569d66481205381418011f4752bfc600

SHA256
e0e0ec6b7c9773afcc58975dd91354d496c333c021034a01091faf9c662791e7

SHA512
44b16e8e92e35806d8b658a733668ff0fb62bb231020551f72166e26fd701233791a61979da33c56e5c3b8236213ad60eb3779b16c2535d3bd3b96724399aeb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e77be5f1ae20d2f249eac9c5576ef06b

SHA1
43ba66af22e0c6a5e72ff0c3cf57acca74a728fa

SHA256
898019933f78160935680cc6d83c22530beb0ba0180b54b82595545d366480a9

SHA512
d2cc9b226b336185c91c4db61ba53716c816b5d885c5182ed01ca2bab67501fdade161c6eb34c265906c54786f198a43e2b106548e1b232201e75266a9472ac9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
13af32e660523ee47bc8f57b3e3af922

SHA1
cebbca9cff16658f384274713bc1871286392cde

SHA256
ebcf427453af16907f791d2089f3e104a782ae718f5d4eb92d14608f84abb262

SHA512
910f4e4e949f2f416f1e1ea47e8e54a17518d12912bee199b214dd3f3e38eda7f9e580c1a3f43e80d24a5a16ef1b92ce15ab5eb42e666a75abd95c1d16d23639

Download Submit