09facc05ccb5b8968c600bcab9b8f09182c80dbd14f607a8007027dfedd3fef3

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 14:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9530d17b4bf3f75a376c0a90656374e3_JaffaCakes118.html
Size

69KB
MD5

9530d17b4bf3f75a376c0a90656374e3
SHA1

6c41375c4a3e6500da1b39cc76e530a3043a0690
SHA256

09facc05ccb5b8968c600bcab9b8f09182c80dbd14f607a8007027dfedd3fef3
SHA512

9ad0c6d314b2146a8b133ed89bfc5559d03bbd9e8d6ed3db07d8ff882770dff1e59d320c267ed7a8d48619f3e9fba51e3de891e8dbef979ce5737bb68f255717
SSDEEP

768:JicgcMWR3sI2PDDnd0g62xwWIvLH2oT2e1wCZkoTyMdtbBnfBgN8/lboiGhcRfQv:JqX9kHTTNen0tbrga90hc+NnhVJ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3828	msedge.exe
3828	msedge.exe
2784	msedge.exe
2784	msedge.exe
1172	identity_helper.exe
1172	identity_helper.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 3416	2784	msedge.exe	81
PID 2784 wrote to memory of 3416	2784	msedge.exe	81
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 2108	2784	msedge.exe	83
PID 2784 wrote to memory of 3828	2784	msedge.exe	84
PID 2784 wrote to memory of 3828	2784	msedge.exe	84
PID 2784 wrote to memory of 4984	2784	msedge.exe	85
PID 2784 wrote to memory of 4984	2784	msedge.exe	85
PID 2784 wrote to memory of 4984	2784	msedge.exe	85
PID 2784 wrote to memory of 4984	2784	msedge.exe	85
PID 2784 wrote to memory of 4984	2784	msedge.exe	85
PID 2784 wrote to memory of 4984	2784	msedge.exe	85
PID 2784 wrote to memory of 4984	2784	msedge.exe	85
PID 2784 wrote to memory of 4984	2784	msedge.exe	85
PID 2784 wrote to memory of 4984	2784	msedge.exe	85
PID 2784 wrote to memory of 4984	2784	msedge.exe	85
PID 2784 wrote to memory of 4984	2784	msedge.exe	85
PID 2784 wrote to memory of 4984	2784	msedge.exe	85
PID 2784 wrote to memory of 4984	2784	msedge.exe	85
PID 2784 wrote to memory of 4984	2784	msedge.exe	85
PID 2784 wrote to memory of 4984	2784	msedge.exe	85
PID 2784 wrote to memory of 4984	2784	msedge.exe	85
PID 2784 wrote to memory of 4984	2784	msedge.exe	85
PID 2784 wrote to memory of 4984	2784	msedge.exe	85
PID 2784 wrote to memory of 4984	2784	msedge.exe	85
PID 2784 wrote to memory of 4984	2784	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9530d17b4bf3f75a376c0a90656374e3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc53246f8,0x7ffcc5324708,0x7ffcc5324718
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,2148751739008051258,18163264369546246259,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,2148751739008051258,18163264369546246259,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,2148751739008051258,18163264369546246259,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2148751739008051258,18163264369546246259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2148751739008051258,18163264369546246259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2148751739008051258,18163264369546246259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,2148751739008051258,18163264369546246259,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,2148751739008051258,18163264369546246259,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2148751739008051258,18163264369546246259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2148751739008051258,18163264369546246259,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2148751739008051258,18163264369546246259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2148751739008051258,18163264369546246259,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,2148751739008051258,18163264369546246259,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
cab3a83092a95dbb6d70039d2f407506

SHA1
9cbe4054a22d430cc5e41b25493deaa0eeca6151

SHA256
1396366a7018fa23c6fb17a79c6af1f6873458f397ed11fddb206605dad4dd36

SHA512
be6d57ef8ecd5bbf547379fdade89c586274a0783f964835164dd060dafc11c8bdb3b1c96c50f2b046bf014eaa7db9b6dd318feeab8c8faf3c9815885f69e4fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
410B

MD5
12e93115971776708afb85e4df98bd35

SHA1
5a2a147a37ebc8bda6b05cf06ca54958e90763c0

SHA256
c9c49d2468372b8edec5f6b485ad7bafa314fd99eae320c9498d00677090ed29

SHA512
c910f940b7752490f27d9ee92741ceb72b582a984c0e219d77796e318b7bca5e78f554842e683e5bd653e92092bf18b304c0dbb62ea5f7d2955781b1a95fdaf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8d12fa4342b48d2024a51949613a5e7d

SHA1
f00357f6161c8f5be1e9dfbaafb4d87e6719e4d3

SHA256
42058ee36b3e93580adcd817f6489daa43ead4256bc4bdd989f030d58d269a41

SHA512
37837cde72599635ae39ce1cd5abb8fca11997a315f27c83078b12dc8873245393efa21596c1bc1e1bfb64eb8fbeaca84babc7134e51c87e5fd3d128bd1a85b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4795c3faec1bde5439c6aa66bb4e3fb0

SHA1
f5f9a85e9ec3047853f09b7d46b9fef35646c76d

SHA256
19cd399baa0a2ea0b22925c2cbb62ca371d90eae34761ea885a8039ddec42b02

SHA512
6e4b5b0e67505c7649025030896ca3f930a9d4bf3185bac8c17526acfc480c17c005d05ec7ebe0cdec152df6cfff2ee13f5b74e95c479da0253255b7d2f34643

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e9ca3191cd8d8c4064c025d50064d360

SHA1
7bac7d8e0052b715746d0109c2f00778ad42eb64

SHA256
28de25fa92adf8666330b64264c5e06305dacd15828a274732391e86459622f8

SHA512
d918091e2ef95b187dc02abe490852fb645520cb1c0fb4d61f00ae59c25f61b5af34521af88bced8bb1322ee4b72aa75a6a5e6c5865588c5f96f018d06c642bd

Download Submit