1209fbcbc56ec9800367f0ece0f220e0ff7e2a524bb6b142693191e41a6fcdaa

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 11:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9dff24bf02842b7e592c9f94a832e0b1_JaffaCakes118.html
Size

69KB
MD5

9dff24bf02842b7e592c9f94a832e0b1
SHA1

48bfff3de5e922308e377aa7be0a87d537989434
SHA256

1209fbcbc56ec9800367f0ece0f220e0ff7e2a524bb6b142693191e41a6fcdaa
SHA512

9530707b36a3bcbc331c1a4b2abb38b1af7f96fe5f141fe47ac2599d5302aae053b7fd7dcc97ae7662dfcd91c492be11948162782eea789a5c8523bfa1fbba08
SSDEEP

768:Ji3gcMWR3sI2PDDnd0g6jQG7PW2L9MoTye1wCZkoTyMdtbBnfBgN8/lboiGhcRob:JTpcTvNen0tbrga90hcJNnspv

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4516	msedge.exe
4516	msedge.exe
220	msedge.exe
220	msedge.exe
4520	identity_helper.exe
4520	identity_helper.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 4808	220	msedge.exe	81
PID 220 wrote to memory of 4808	220	msedge.exe	81
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 1480	220	msedge.exe	82
PID 220 wrote to memory of 4516	220	msedge.exe	83
PID 220 wrote to memory of 4516	220	msedge.exe	83
PID 220 wrote to memory of 1200	220	msedge.exe	84
PID 220 wrote to memory of 1200	220	msedge.exe	84
PID 220 wrote to memory of 1200	220	msedge.exe	84
PID 220 wrote to memory of 1200	220	msedge.exe	84
PID 220 wrote to memory of 1200	220	msedge.exe	84
PID 220 wrote to memory of 1200	220	msedge.exe	84
PID 220 wrote to memory of 1200	220	msedge.exe	84
PID 220 wrote to memory of 1200	220	msedge.exe	84
PID 220 wrote to memory of 1200	220	msedge.exe	84
PID 220 wrote to memory of 1200	220	msedge.exe	84
PID 220 wrote to memory of 1200	220	msedge.exe	84
PID 220 wrote to memory of 1200	220	msedge.exe	84
PID 220 wrote to memory of 1200	220	msedge.exe	84
PID 220 wrote to memory of 1200	220	msedge.exe	84
PID 220 wrote to memory of 1200	220	msedge.exe	84
PID 220 wrote to memory of 1200	220	msedge.exe	84
PID 220 wrote to memory of 1200	220	msedge.exe	84
PID 220 wrote to memory of 1200	220	msedge.exe	84
PID 220 wrote to memory of 1200	220	msedge.exe	84
PID 220 wrote to memory of 1200	220	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9dff24bf02842b7e592c9f94a832e0b1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff96de446f8,0x7ff96de44708,0x7ff96de44718
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,17410846078505878126,7603359655036117863,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,17410846078505878126,7603359655036117863,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,17410846078505878126,7603359655036117863,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2492 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17410846078505878126,7603359655036117863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17410846078505878126,7603359655036117863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17410846078505878126,7603359655036117863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,17410846078505878126,7603359655036117863,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,17410846078505878126,7603359655036117863,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17410846078505878126,7603359655036117863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17410846078505878126,7603359655036117863,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17410846078505878126,7603359655036117863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17410846078505878126,7603359655036117863,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,17410846078505878126,7603359655036117863,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5928 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
74cb6a5c9eccf121b5b3c048ffa659bc

SHA1
45418851787fbc8bf2c56576956ec81eea2ff2fe

SHA256
ab101f53bb3878bb26c026fea8bb5d608aded36bdf1c7613b8b3fcec54095b12

SHA512
0c2fb363dcad89aa9a9f9b039f65511dcb556dfad7137862df10d5cd7c1cb0beb4e00b676df673f1679902b12406398655c69c73bd19bfcdab20d771ee5674da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
409B

MD5
1a80a103fb73e6acd198befa94ff3c96

SHA1
163aa6c3c33e4c61776cd30f8fb33c3e6a23f161

SHA256
ec76799a77e2375deb962f3c9a69dc3dda7aad79ce65561c197e45bb70f5db5e

SHA512
19cb4b8f5abd8b5875046e94a76d13a8afe7a6fe6d8d81d230d98cf789a7e33aaa2ecf4c5ac93a846b011633d8c6d29768478c20918854064bc128187f09b34c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c172ba04c024968c59c007468374d274

SHA1
a68247dc1d332e0863ac0b57a83155e59e1f8c6b

SHA256
11d067f15e17a5da0cf19d131768e8a816b02c8b203b0a259275c463a78429fd

SHA512
0ee7caec56822c8f469cdc04fe57afda96bf6e81af842d5822a143079beb786263e08d3bda048e685c8d32e2ada9f1b692dfffd69ead266d554cf9629e040bf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ee6e22f80028a62ddb74d87e9650e643

SHA1
632a3659e2851ceae3b70b7fdc9e1af32240b7f7

SHA256
ac01696a5151ccabd814e10f306fa3e8e1410357659b5cb4222f490b728c5819

SHA512
5a6e36c1c8990fa31c8739f2137b60a9ea90a682984be1508671d84d4d93fa6b4c756ebff94170e66ca260a882ffacef562d582d5902bb94e804e04c9201a7d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9642186553d7b412608ba8a38356833b

SHA1
e889ad0d82dac5d1f65597ea3c8b731a519029ca

SHA256
29600a6a1d1bcc53af59d648fb86f1800e35ef9b1e11e3a02aef061e00494d2a

SHA512
e9e01a11a172cde38a495dd547db4e84c8026626267489547a8d87a3608fd293dfb981f318f1cd5135b47aa8560a18524839f69f8bbb036e69a5d0ac2bcf6a3d

Download Submit