d18bfaea9314b92bba16803bd2b5438cfe300f5597c1c1a1d9008d16206bb64a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 15:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

955f69c169b14cd0ddbb2179ed9a35a1_JaffaCakes118.html
Size

48KB
MD5

955f69c169b14cd0ddbb2179ed9a35a1
SHA1

64409d99bfa5e8f2a6d0a77259be37c25be598ed
SHA256

d18bfaea9314b92bba16803bd2b5438cfe300f5597c1c1a1d9008d16206bb64a
SHA512

dda98f17e8628d7c2129893189ed997dbc8a78e6b7962722de4f8f9be46d4b98f3965d5b5d18f0c9b52ad4f78a5c6665651eb07315b5a9f7b0ec88d7cbbf7ad9
SSDEEP

768:SAHlYuQIdnJNi1mjIo0MsKMhlv5CUc9DVViKEEroF/glBg46Pgp3XugpaWgUk1gf:SOT7jIdlv5MNKfqQSrQ8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
2132	msedge.exe
2132	msedge.exe
3716	identity_helper.exe
3716	identity_helper.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 3480	2132	msedge.exe	83
PID 2132 wrote to memory of 3480	2132	msedge.exe	83
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 2340	2132	msedge.exe	84
PID 2132 wrote to memory of 1524	2132	msedge.exe	85
PID 2132 wrote to memory of 1524	2132	msedge.exe	85
PID 2132 wrote to memory of 4304	2132	msedge.exe	86
PID 2132 wrote to memory of 4304	2132	msedge.exe	86
PID 2132 wrote to memory of 4304	2132	msedge.exe	86
PID 2132 wrote to memory of 4304	2132	msedge.exe	86
PID 2132 wrote to memory of 4304	2132	msedge.exe	86
PID 2132 wrote to memory of 4304	2132	msedge.exe	86
PID 2132 wrote to memory of 4304	2132	msedge.exe	86
PID 2132 wrote to memory of 4304	2132	msedge.exe	86
PID 2132 wrote to memory of 4304	2132	msedge.exe	86
PID 2132 wrote to memory of 4304	2132	msedge.exe	86
PID 2132 wrote to memory of 4304	2132	msedge.exe	86
PID 2132 wrote to memory of 4304	2132	msedge.exe	86
PID 2132 wrote to memory of 4304	2132	msedge.exe	86
PID 2132 wrote to memory of 4304	2132	msedge.exe	86
PID 2132 wrote to memory of 4304	2132	msedge.exe	86
PID 2132 wrote to memory of 4304	2132	msedge.exe	86
PID 2132 wrote to memory of 4304	2132	msedge.exe	86
PID 2132 wrote to memory of 4304	2132	msedge.exe	86
PID 2132 wrote to memory of 4304	2132	msedge.exe	86
PID 2132 wrote to memory of 4304	2132	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\955f69c169b14cd0ddbb2179ed9a35a1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffffe346f8,0x7fffffe34708,0x7fffffe34718
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,878573725004158903,736881513258017166,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,878573725004158903,736881513258017166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,878573725004158903,736881513258017166,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,878573725004158903,736881513258017166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,878573725004158903,736881513258017166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,878573725004158903,736881513258017166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,878573725004158903,736881513258017166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,878573725004158903,736881513258017166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,878573725004158903,736881513258017166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,878573725004158903,736881513258017166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,878573725004158903,736881513258017166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,878573725004158903,736881513258017166,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5028 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
da722c01151e0725cb4ad5b1585544dd

SHA1
8a3c13901933fc5d71c66622cc7e3dd516a007c7

SHA256
09bec5a58ab9a773399829b31316f1caa08fa1556174407ff0ee7ed282e67039

SHA512
bdc509826e0f08e45857d1ca723d583cb737c617dc38bc929ac3da6acceb24bb3719b42290ae4c5d43d20a6bccebfa7d2a06a50e8c7ee6ec77bab85290b2d98d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d0636165e982815e34fcb6d5543e6f1b

SHA1
b9df3d2d7981d4f339d97cfe7323488048723328

SHA256
389cce03b16bc810e0bad32c0005a7fbafc46cbe0f40b2b968e5bfbd5bb9ae2e

SHA512
ea4f259002bf54f7817e74ca6444c7a7c47e44a4573e62cd5db65e83de83867296197d714a0285b433a9c6fe0494504debbe7a058d1f61257ff6f2df4ab78e63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ed540a67f8d62bf3701fe384c157587e

SHA1
26f45ec308da930874d033e01ddf3896a3aae858

SHA256
5e1b7fb0bdbcd02e4c1f2f7795dc6548ad404eda590088cf6b4b1aa2044a5f12

SHA512
7c6efae4869c8409dc3faa34d17b46bd51a17e8729640a4b3f2ecb32771e9942b9c961357f1b6f5c9b04812c738943f199e9d4f586663bfa5f8004acb7ed3d94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
459ff981c786b01727230e052f459cc2

SHA1
9700c2ad19e95c13a223c25e2c3e306af9f28dfa

SHA256
9dc1c8ae88f2d0d5148609e3a71e70cc4a4f2bf42249c264bf5abc8a5d2dfc09

SHA512
dc14df03ec4271a8a47d52c8d000900d51e7f1bf753a971683069f61eb75b640ecdff4a4b486d560ac6e209021fd00242216fbbf702be950fad9e794ac676f85

Download Submit