df7ffa1207ae5c35d84fa449749d0cef4434dc7a6e9d23ecaa3197156f9f23fe

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05-06-2024 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

986b641d5e47246bccc94e95a544ada2_JaffaCakes118.html
Size

355KB
MD5

986b641d5e47246bccc94e95a544ada2
SHA1

4286b61ad43e8806a0817e58f59a5c2874b0fa24
SHA256

df7ffa1207ae5c35d84fa449749d0cef4434dc7a6e9d23ecaa3197156f9f23fe
SHA512

7817781454671a77fae4b687d6c05fbbf121362ef0f3976b11e2122c892af387d0272cb52b6ba14e48c1ac952c8c4598d45c6870950478b6bef53a5494f1b309
SSDEEP

6144:SqcN7+3gkBjHdORjlIlUlQV17nWFl3lcCRdD5Ftew:SqcN7+3gUrjWFl3lzt

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
2140	msedge.exe
2140	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 5068	2140	msedge.exe	84
PID 2140 wrote to memory of 5068	2140	msedge.exe	84
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 3872	2140	msedge.exe	85
PID 2140 wrote to memory of 2884	2140	msedge.exe	86
PID 2140 wrote to memory of 2884	2140	msedge.exe	86
PID 2140 wrote to memory of 4628	2140	msedge.exe	87
PID 2140 wrote to memory of 4628	2140	msedge.exe	87
PID 2140 wrote to memory of 4628	2140	msedge.exe	87
PID 2140 wrote to memory of 4628	2140	msedge.exe	87
PID 2140 wrote to memory of 4628	2140	msedge.exe	87
PID 2140 wrote to memory of 4628	2140	msedge.exe	87
PID 2140 wrote to memory of 4628	2140	msedge.exe	87
PID 2140 wrote to memory of 4628	2140	msedge.exe	87
PID 2140 wrote to memory of 4628	2140	msedge.exe	87
PID 2140 wrote to memory of 4628	2140	msedge.exe	87
PID 2140 wrote to memory of 4628	2140	msedge.exe	87
PID 2140 wrote to memory of 4628	2140	msedge.exe	87
PID 2140 wrote to memory of 4628	2140	msedge.exe	87
PID 2140 wrote to memory of 4628	2140	msedge.exe	87
PID 2140 wrote to memory of 4628	2140	msedge.exe	87
PID 2140 wrote to memory of 4628	2140	msedge.exe	87
PID 2140 wrote to memory of 4628	2140	msedge.exe	87
PID 2140 wrote to memory of 4628	2140	msedge.exe	87
PID 2140 wrote to memory of 4628	2140	msedge.exe	87
PID 2140 wrote to memory of 4628	2140	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\986b641d5e47246bccc94e95a544ada2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaef7f46f8,0x7ffaef7f4708,0x7ffaef7f4718
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,14220583983637243256,8444207845268832050,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,14220583983637243256,8444207845268832050,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,14220583983637243256,8444207845268832050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14220583983637243256,8444207845268832050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14220583983637243256,8444207845268832050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14220583983637243256,8444207845268832050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14220583983637243256,8444207845268832050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14220583983637243256,8444207845268832050,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,14220583983637243256,8444207845268832050,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6136 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
23KB

MD5
e1c71f7c04be834f5587230db2ad24b3

SHA1
f3bab9cb99d9f343bf7ed3981aaa7450515d2424

SHA256
9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899

SHA512
205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
3d8ed72e925ea6014e117fbce6ffc3fc

SHA1
941ac0e75ad7a1d2e78ee720989595096610bfdc

SHA256
c48b35a355f990ad9a392d8e02dbaea67a4698d70af9e2b3cec295a9bcec7204

SHA512
df5cbcf6b8e64c265418dba79dd5ef3e18c64e2ec846fffa7d3df6874b5ae6a5d7f9b7a376c2e003f6a7d1954a8ad09e4c3dca28b719cb6ab603273936fbcb99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5db94da9fdb1cdc4957114e0cf603421

SHA1
27e9bf18bf0832025b1137c6f067993487b277d1

SHA256
b60ca11a858c2937014d78d5314de40c2d196601cb35673fc7e55bb38633764b

SHA512
c84dc33d25376893f367693eadf63d046bce7c2d3186e15d5b46098a1cd4fb88c39c825fc411caed36d12363bd75057cb79fbde156afd8fccf7431d3bdedf5a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2a3a0ac93ad2f738160f848f550ac3d8

SHA1
cff9012b0144c14c7074af7221eb5dbc9437db40

SHA256
a692a0ab6a5d329fe9804f0fb85b94c88c37092f68fd9a739b8107a53675793d

SHA512
19a1c4b32bc94e1e00d71213485048d89503c5247fc097ff76bea28878e45eff5b8409d7078a5a7fab6566d0c4a14923674022d0cf280cceca96b9f41e168283

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
986ed1bdbc1383a3dba4d50644aabcfb

SHA1
38f4c3bc8c29764775b21f3124df85aa040e6c8a

SHA256
891bc03402825065f8eba2cd2292af8fcf8d618a14120d09b61c89c494f99567

SHA512
2ffb5844450659b74434f1280f210e820cd8fccf32de55a8995e6b59a1dc580e61d7279868766b153c4ae808ff7f8ad3d4f3b282dbe32a38ccb93e2c43c480ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
86de0864e6d13165ca4685f794bcb11b

SHA1
d6fcdc8871e40f3327b305a7a08104726e96a327

SHA256
400f636e22087fe8fce128bc9290944ea04324aedb13f385b4eccf66bbff6c6f

SHA512
1b2629dccab47172b85480483d2ad3f86cc28814a2415aa1077f2a76994d1ea1fd576be90b94817a200a5a0233102e7eb8d086d0985c93dc90d5f17b265bf8bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ca6675ddef602ead04e2f43a348f54c7

SHA1
56792674bc81b9262d63077c4e5ffdb51ae72354

SHA256
1384922c33359c564938e671ef22f8688a5d326f7e3359efd01d7dc58b8fdb82

SHA512
515ff4243d87621b42773eb91b12dd07ea0fae9a03e0804a655a85c6147197a35051aea27ddaed3dc48e51e172f2a27fa5c134a42174b68fd52e0683e7ecf635

Download Submit