4439133bde192a79ddb457a52eb0821b65c1428e92338c0f57347af9cf9f6a09

Analysis

max time kernel
145s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2024 16:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9571617597e730b87fbf5aa472515ec6_JaffaCakes118.html
Size

143KB
MD5

9571617597e730b87fbf5aa472515ec6
SHA1

010a31d997fe379381f9f9e0f36cba88c6fb2ea1
SHA256

4439133bde192a79ddb457a52eb0821b65c1428e92338c0f57347af9cf9f6a09
SHA512

c84fd01caf611a572e138eb0a784d5cf26f08af1610d7b850ee9d34e224fed629f9dcf16c4d0a284948545a59fafeb2f664409281d9ed1b744e3cd714f0c70c0
SSDEEP

1536:BmljeUpVkpT3g9DDj6YU2uuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP0B:ByNyfkMY+BES09JXAnyrZalI+YP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
4352	msedge.exe
4352	msedge.exe
912	identity_helper.exe
912	identity_helper.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 1104	4352	msedge.exe	82
PID 4352 wrote to memory of 1104	4352	msedge.exe	82
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1252	4352	msedge.exe	83
PID 4352 wrote to memory of 1628	4352	msedge.exe	84
PID 4352 wrote to memory of 1628	4352	msedge.exe	84
PID 4352 wrote to memory of 2092	4352	msedge.exe	85
PID 4352 wrote to memory of 2092	4352	msedge.exe	85
PID 4352 wrote to memory of 2092	4352	msedge.exe	85
PID 4352 wrote to memory of 2092	4352	msedge.exe	85
PID 4352 wrote to memory of 2092	4352	msedge.exe	85
PID 4352 wrote to memory of 2092	4352	msedge.exe	85
PID 4352 wrote to memory of 2092	4352	msedge.exe	85
PID 4352 wrote to memory of 2092	4352	msedge.exe	85
PID 4352 wrote to memory of 2092	4352	msedge.exe	85
PID 4352 wrote to memory of 2092	4352	msedge.exe	85
PID 4352 wrote to memory of 2092	4352	msedge.exe	85
PID 4352 wrote to memory of 2092	4352	msedge.exe	85
PID 4352 wrote to memory of 2092	4352	msedge.exe	85
PID 4352 wrote to memory of 2092	4352	msedge.exe	85
PID 4352 wrote to memory of 2092	4352	msedge.exe	85
PID 4352 wrote to memory of 2092	4352	msedge.exe	85
PID 4352 wrote to memory of 2092	4352	msedge.exe	85
PID 4352 wrote to memory of 2092	4352	msedge.exe	85
PID 4352 wrote to memory of 2092	4352	msedge.exe	85
PID 4352 wrote to memory of 2092	4352	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9571617597e730b87fbf5aa472515ec6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd711f46f8,0x7ffd711f4708,0x7ffd711f4718
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,18350242039462598119,8162049958416112203,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,18350242039462598119,8162049958416112203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,18350242039462598119,8162049958416112203,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,18350242039462598119,8162049958416112203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,18350242039462598119,8162049958416112203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,18350242039462598119,8162049958416112203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,18350242039462598119,8162049958416112203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,18350242039462598119,8162049958416112203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,18350242039462598119,8162049958416112203,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,18350242039462598119,8162049958416112203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,18350242039462598119,8162049958416112203,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,18350242039462598119,8162049958416112203,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7bbb11eb0af1e733514d2b33d8e36280

SHA1
429360f83b6d1b7e7733c1bbcf7824c5994bcc2f

SHA256
cb5bdaaa63761f0620bee776a154420a3ffc160d4ff0382314a8c0135ddb86c6

SHA512
9aac356d67260fe0b2e5bbaf9e1d5da09aca6a6071f8556ca270d96f5212208c4af27e5847526f49306d9aadc943690ea0b0accd9495fc9578b368cfd7b319ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
565f5909a8fec4d6e4f67bdae5999ab7

SHA1
94428e8fde444cdf914ef6f9f621040673cd1379

SHA256
c3f2106f1093d94c83aabcfc435fa26630ecfc335422fb366143678794a80b70

SHA512
65732d664df58e09c0c1427f2f09c222836521f357f689a4e1ef2a05771ce26293871597523db22a5d510c52fea81ecbebcf4108520581bb0d4a7881168218ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a71471bc4bd02ebd18ff42ecdb34c9b5

SHA1
181cb1b819c53db5e27b4908f51bdb374886f299

SHA256
9d671ff52a6feef5fe6ab261ee39261370feda17612ed2cfe29b8826bd4a602c

SHA512
99756ef4e270abf78a64b16b4c8bf8982aec41824fc6e1e9274e9f16311e8d5538b9222255455ab8d88aee86fffbb9eff0da8ad031e870eaff99bd7d356c8b4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
842b9041a67cbdfe2d2f876bf4b28633

SHA1
935132961a2e1efbf6fd4c175d4d346005ba4678

SHA256
0a87c5cff8852d1f0cafa71e275da66b542ce5c29fc7f4c9ccf333ecacb58b66

SHA512
760f6e2bf30b55416be69ba1b6544425b1054d80cb6c0065deb1d3fb59b1842353b44c7f1850c4e8d8eb46174ad85a390675a908ba8bbb47b45afc361c365d2a

Download Submit