663f1a47b00acb2f1fab18d6c0d3278be3934234e1087d89624664cc1aed4f6c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2024 11:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

949a788f0453483a9147e7edfcae211b_JaffaCakes118.html
Size

282KB
MD5

949a788f0453483a9147e7edfcae211b
SHA1

6b499e592bff22641fb745f992b285f840e67fda
SHA256

663f1a47b00acb2f1fab18d6c0d3278be3934234e1087d89624664cc1aed4f6c
SHA512

a81f6735d121741075d7cf4dd3a982b16f05a2dae14600692a377f5c2bfd5a7844cbac2bc6abbc7feea738992f52908ee4a94d85025d59fc60f5c224676bb020
SSDEEP

1536:rQazrHoEBIVtOanunEzWunEzBL3B1cunsTHdD0bUwHmE4U+gtOd:rQm2t4LXcuSHdD0bUwHmE4U+gtOd

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
828	msedge.exe
828	msedge.exe
3364	msedge.exe
3364	msedge.exe
2212	msedge.exe
2212	msedge.exe
2212	msedge.exe
2212	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 228	3364	msedge.exe	83
PID 3364 wrote to memory of 228	3364	msedge.exe	83
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 1268	3364	msedge.exe	84
PID 3364 wrote to memory of 828	3364	msedge.exe	85
PID 3364 wrote to memory of 828	3364	msedge.exe	85
PID 3364 wrote to memory of 1724	3364	msedge.exe	86
PID 3364 wrote to memory of 1724	3364	msedge.exe	86
PID 3364 wrote to memory of 1724	3364	msedge.exe	86
PID 3364 wrote to memory of 1724	3364	msedge.exe	86
PID 3364 wrote to memory of 1724	3364	msedge.exe	86
PID 3364 wrote to memory of 1724	3364	msedge.exe	86
PID 3364 wrote to memory of 1724	3364	msedge.exe	86
PID 3364 wrote to memory of 1724	3364	msedge.exe	86
PID 3364 wrote to memory of 1724	3364	msedge.exe	86
PID 3364 wrote to memory of 1724	3364	msedge.exe	86
PID 3364 wrote to memory of 1724	3364	msedge.exe	86
PID 3364 wrote to memory of 1724	3364	msedge.exe	86
PID 3364 wrote to memory of 1724	3364	msedge.exe	86
PID 3364 wrote to memory of 1724	3364	msedge.exe	86
PID 3364 wrote to memory of 1724	3364	msedge.exe	86
PID 3364 wrote to memory of 1724	3364	msedge.exe	86
PID 3364 wrote to memory of 1724	3364	msedge.exe	86
PID 3364 wrote to memory of 1724	3364	msedge.exe	86
PID 3364 wrote to memory of 1724	3364	msedge.exe	86
PID 3364 wrote to memory of 1724	3364	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\949a788f0453483a9147e7edfcae211b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed44d46f8,0x7ffed44d4708,0x7ffed44d4718
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,11148232937627821435,6811511711587595251,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,11148232937627821435,6811511711587595251,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,11148232937627821435,6811511711587595251,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11148232937627821435,6811511711587595251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11148232937627821435,6811511711587595251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11148232937627821435,6811511711587595251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11148232937627821435,6811511711587595251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11148232937627821435,6811511711587595251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11148232937627821435,6811511711587595251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,11148232937627821435,6811511711587595251,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
46KB

MD5
8020829282f8d6133736f8079e5665a1

SHA1
64ee9e05894d5f726b5719c7c35c10dfa8f863d3

SHA256
4035124285f7d7e8588e4fe69bc1bfe663090e68ca6b1a6438c0cc9de22b6540

SHA512
68a01229ceb0d09a76b646db8a7641c41b98cb89e8632d6a0261437fba750b01f8b8ff29c1f70242bb3cdba1850d9e8c31c5b7ef69ce5ad2323801b4f3e0503c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
44KB

MD5
23536ccfe05b737ae639fe63ee4cc435

SHA1
6d2e9822835dc3e6117a4d2addfc8f241fbdbc82

SHA256
6ae9edfc411ede03661a3d910fafddab3d6b313d1f4668dc8c5a84c5ab23a3ce

SHA512
f416e36b2322bbebd211fd1ea69c88883f00c7b00f14474a5fcce4a408840c0d1b0304eb8941509a38157d0583485f638959eb7d5b9ae668aa88c1d3eee8dd0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
4b28b7540d742a02f403b76574f3b669

SHA1
3229eef7e672b25f18efb8d8db1b76a409b94b92

SHA256
39b5575e202e51abf13d7d3eae1578269e078c07d32250d99bf4a4ba795fb527

SHA512
dacff9b14fdda3288c6b9947ca6a40b057e4f70d1d265cd8423021781ff4a7126b095b4aa4ff5daafe1cc0e56409aa6cb3c286c0d0b8be65b399c65c74bd7446

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
43389547bfbd5256f499d56d4d7c7308

SHA1
b0332cf9e568bf2b31fe27a2eac6ad04a0c5e8db

SHA256
81087aea7a7eac54e17fac9ca67ad0c2bec2fc0cc6b163351900c7fde8f989f2

SHA512
64880c95f1bee42578801906326daef03b7caf21d4dda9f0f35515403a3a02b4ae923491dee0017ca34e2a65b6b0d5cda84c01924705dabef7ec457aabc5e4eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
feea7dba42b2fd448aaf1d65a99c907c

SHA1
190d35c9f91437bce7188da891daf22f12249bdd

SHA256
f058de6808f97cfeb8e10f6f2cde939c003f19201fd970f9e5329e1dc46c526e

SHA512
79baa2ebf44300ba71bb063ba12b4121cb7303c5df4d324c8d9131000dcb66e20ef0c59367f2ddb1c502c54288259c179fb45cdc291f3470b68f393ed9264171

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
429009fca2a13817ddce79db4ca8d2d4

SHA1
40f152a4468fae6b680222d444273166cd830483

SHA256
337cbf60ab5d675e07d74615fcd4aeeb921cb7c84ff5802b097abf546eb5ccaf

SHA512
34472a9b8ca354bbf24b92954f0c938c50592a0096ddd441bfb8c50613c525509fdceb737bbc04066161983d8052628377a63cc1776b3190b1509bf533af34ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3e42962356f1881942a81231773b98db

SHA1
c30c24d7e713e1df4603c439899990a50024e7ae

SHA256
32088e8f38bb092a7f703f5498fa69d9dd45c1adb7e70058575bbc45320f74a1

SHA512
d7594033ee9885d4020aa3f18ea3e0a031560f0c91e6f829ea7c090c4e442679cd86dbcd956c536674eba0b57d92749109ed472169511b4281e0d1d96904bace

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
813bf9914ba6230772070cc018398706

SHA1
8215f619bbd1d07b79a86a821b2be66c6775d926

SHA256
ed60b49c053914fc60e4e33ca75eee4d0dcb1708bcc7f0668c624c820b1245c1

SHA512
e505cf35b4739bbb6cd9c27067c288bc4cd078403af4f576dc46bbe96a287fe5ab860c4df85c573aac94c9ebbfc142d2145b4c0e035f2d60e33fe599a10e992a

Download Submit