9801ddf937532b6a7eb697b2d0015eec599281fca902f4730f29d0d64b7d79d9

Analysis

max time kernel
145s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 20:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

991f977e813ffdd23a85f5b41659df5e_JaffaCakes118.html
Size

2KB
MD5

991f977e813ffdd23a85f5b41659df5e
SHA1

8694fcc615be0a8678f84cc219790bbde205d1b7
SHA256

9801ddf937532b6a7eb697b2d0015eec599281fca902f4730f29d0d64b7d79d9
SHA512

7eeca2ab9e3302c9d1dab6926e9875646ffcd3778e208749af79532eb7555b4c03cdc4ebbb368555e880390f9068ff929b0cd4477bc80b5a1e686edfc0d25ca2

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
944	msedge.exe
944	msedge.exe
1064	msedge.exe
1064	msedge.exe
4608	identity_helper.exe
4608	identity_helper.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 3084	1064	msedge.exe	81
PID 1064 wrote to memory of 3084	1064	msedge.exe	81
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 756	1064	msedge.exe	82
PID 1064 wrote to memory of 944	1064	msedge.exe	83
PID 1064 wrote to memory of 944	1064	msedge.exe	83
PID 1064 wrote to memory of 376	1064	msedge.exe	84
PID 1064 wrote to memory of 376	1064	msedge.exe	84
PID 1064 wrote to memory of 376	1064	msedge.exe	84
PID 1064 wrote to memory of 376	1064	msedge.exe	84
PID 1064 wrote to memory of 376	1064	msedge.exe	84
PID 1064 wrote to memory of 376	1064	msedge.exe	84
PID 1064 wrote to memory of 376	1064	msedge.exe	84
PID 1064 wrote to memory of 376	1064	msedge.exe	84
PID 1064 wrote to memory of 376	1064	msedge.exe	84
PID 1064 wrote to memory of 376	1064	msedge.exe	84
PID 1064 wrote to memory of 376	1064	msedge.exe	84
PID 1064 wrote to memory of 376	1064	msedge.exe	84
PID 1064 wrote to memory of 376	1064	msedge.exe	84
PID 1064 wrote to memory of 376	1064	msedge.exe	84
PID 1064 wrote to memory of 376	1064	msedge.exe	84
PID 1064 wrote to memory of 376	1064	msedge.exe	84
PID 1064 wrote to memory of 376	1064	msedge.exe	84
PID 1064 wrote to memory of 376	1064	msedge.exe	84
PID 1064 wrote to memory of 376	1064	msedge.exe	84
PID 1064 wrote to memory of 376	1064	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\991f977e813ffdd23a85f5b41659df5e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ffc76fa46f8,0x7ffc76fa4708,0x7ffc76fa4718
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,10235851332547234704,1767817624112328262,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,10235851332547234704,1767817624112328262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,10235851332547234704,1767817624112328262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10235851332547234704,1767817624112328262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10235851332547234704,1767817624112328262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,10235851332547234704,1767817624112328262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,10235851332547234704,1767817624112328262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10235851332547234704,1767817624112328262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10235851332547234704,1767817624112328262,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2032 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10235851332547234704,1767817624112328262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10235851332547234704,1767817624112328262,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,10235851332547234704,1767817624112328262,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3964 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
092ce54fd06a147ef0dc45b57f553968

SHA1
47e1c2a56a6d34a328ae9ca119786dc9bef20292

SHA256
a62a8f43aba954f06805192c64f87e92b1b3903b246b8b01df016911d8364314

SHA512
6b613873c7b86614eb556ecaa68f5b93d8c9a90ca0ed6ea50482946877a6986f26a9e95b4ff2b82fd2773f4174a34a29e0028739c6618a43f620b4eb87a0631c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
23d05c335e3b73ccdfe49985437f091b

SHA1
b4652f80d5b7012eea3ef011c96731ef6918140e

SHA256
09492de888ccbbec13664359f4e7b8faadfe21277dd2082d5701589ddb02c657

SHA512
bc452ecc4ec67a163086dfebf1b5f3850171e9ccfc1f1bdc1e6da21f8558362513c58b2072557ea64edfa8ac643a44fab4f980b357a127de2310336b9892587b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dcc1ce156e6daa2f814b8b96ec256288

SHA1
1cf5ff8443933be338ef8a29b2614bd69c529b4e

SHA256
7a2c83969302a2b28ad9f0f3d2cae975a41a869752850023df35d1f6538ee88a

SHA512
e4a52947a5eb67ee9579ce87d35bef96bc26a5803509061db02a90eda01f6f568a6db673b1d69f983ea20c039831d8752c2aac2588ed73ad3251670a803d6b8c

Download Submit