9d7cf04acf6f425e0ab4a8c2758a3c4f1d97c10915e8a5b27279d2aeace539ef

Analysis

max time kernel
145s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a20e36483b73901ac9fb3986af1844f3_JaffaCakes118.html
Size

203KB
MD5

a20e36483b73901ac9fb3986af1844f3
SHA1

9df9dcda0001b13903e6dabcdc2826dd52d2df43
SHA256

9d7cf04acf6f425e0ab4a8c2758a3c4f1d97c10915e8a5b27279d2aeace539ef
SHA512

0aa97fc4e5d98ec6c3de5de1849a3e397a56eed1fa62a52691c38ba0e850336ad99215191323afbcc31c10d9ebf9fccfebfa73a420972bcf48e954bab016d23b
SSDEEP

3072:SoOx3sfoZyfkMY+BES09JXAnyrZalI+Y6XXI6EyA8:SoOx8f9sMYod+X3oI+YS1tA8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
4944	msedge.exe
4944	msedge.exe
4456	identity_helper.exe
4456	identity_helper.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 1960	4944	msedge.exe	83
PID 4944 wrote to memory of 1960	4944	msedge.exe	83
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 4428	4944	msedge.exe	85
PID 4944 wrote to memory of 3516	4944	msedge.exe	86
PID 4944 wrote to memory of 3516	4944	msedge.exe	86
PID 4944 wrote to memory of 3560	4944	msedge.exe	87
PID 4944 wrote to memory of 3560	4944	msedge.exe	87
PID 4944 wrote to memory of 3560	4944	msedge.exe	87
PID 4944 wrote to memory of 3560	4944	msedge.exe	87
PID 4944 wrote to memory of 3560	4944	msedge.exe	87
PID 4944 wrote to memory of 3560	4944	msedge.exe	87
PID 4944 wrote to memory of 3560	4944	msedge.exe	87
PID 4944 wrote to memory of 3560	4944	msedge.exe	87
PID 4944 wrote to memory of 3560	4944	msedge.exe	87
PID 4944 wrote to memory of 3560	4944	msedge.exe	87
PID 4944 wrote to memory of 3560	4944	msedge.exe	87
PID 4944 wrote to memory of 3560	4944	msedge.exe	87
PID 4944 wrote to memory of 3560	4944	msedge.exe	87
PID 4944 wrote to memory of 3560	4944	msedge.exe	87
PID 4944 wrote to memory of 3560	4944	msedge.exe	87
PID 4944 wrote to memory of 3560	4944	msedge.exe	87
PID 4944 wrote to memory of 3560	4944	msedge.exe	87
PID 4944 wrote to memory of 3560	4944	msedge.exe	87
PID 4944 wrote to memory of 3560	4944	msedge.exe	87
PID 4944 wrote to memory of 3560	4944	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a20e36483b73901ac9fb3986af1844f3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8aaa946f8,0x7ff8aaa94708,0x7ff8aaa94718
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,6803110239637734025,6284280713474593793,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,6803110239637734025,6284280713474593793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,6803110239637734025,6284280713474593793,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6803110239637734025,6284280713474593793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6803110239637734025,6284280713474593793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,6803110239637734025,6284280713474593793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4192 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,6803110239637734025,6284280713474593793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6803110239637734025,6284280713474593793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6803110239637734025,6284280713474593793,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6803110239637734025,6284280713474593793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6803110239637734025,6284280713474593793,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,6803110239637734025,6284280713474593793,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3b24207c-ebd0-42c6-bacd-303ef362759b.tmp

Filesize
6KB

MD5
04f0b94dcb507adb63f5147b96055f8e

SHA1
99a09aba3566c16472e6c1e1266d53b174d60854

SHA256
5b024ee74173b98c65fc1c8b43527ca9483cfa037148787b16955a8d8540a101

SHA512
282522f5405f2270c4c84100e63b33294e0bbbc8f06fcb80584e0b9fc8ec4a39d13cf7369959b18bc47ecb9813513e120e9d36271cc237fb4a043b45390a5bdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dc391fcd9b4d9e3fd4353973bc0c92f5

SHA1
eb3e9e114a0d546937120fb106b63d28c625b228

SHA256
2cde75781505163cd7023fecba9c78c596e92936887463829fbcc233229a55d4

SHA512
35a69ffca9f6d3ce69b7b2a655705d657427041296807ca626f1257273c46240f8b9502055683d247d6812e7ab8d5cf539df7a6226fc3b982985ed24aca10a26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
415a51836473c2ce5aaa3115f4b93cbd

SHA1
af61f5b4d265386e4757227e378b2833c1a237e1

SHA256
7a07eb70ff7d26ae8a8d958a0252b69f44d0a5230ba1d46af5207448bd579ba2

SHA512
023949a40b89d2c5c60ed242302247590e7395c58c1df73a12af6828fc1b061bd1d790719f766643d698c247a94c9303b07f226c0c91d9befbfa30e01c885552

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b1a7300848bc17d16f294d9ab4297d62

SHA1
deef401a7a25c4c86f1bc20535f5da42b3408efb

SHA256
2c792491ebe81ad3a9df44a2bd2f51f7596537e8fdc2160964cb0e2a4af82d6c

SHA512
829dbb25271e085d6c100823088e64917a23318912f6ffd3a909e45d683cc1ab21ef946f28d004f1da66da44251fc4efa34154ef9f7d2eca9a63e6289420a665

Download Submit