cb8ac0f4ff16dd7794cc522bb8200663c1a8632fef8bfada02eb7126547460bc

Analysis

max time kernel
145s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2024 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa103f48ac1701bd019c39dbb4b3cfc5_JaffaCakes118.html
Size

141KB
MD5

aa103f48ac1701bd019c39dbb4b3cfc5
SHA1

0b94a79b69fc504c71bf06bf5199e8b851461f7f
SHA256

cb8ac0f4ff16dd7794cc522bb8200663c1a8632fef8bfada02eb7126547460bc
SHA512

a0da797e4c63f64200f4da56bb54bd2e8b63eca213bf443295587ca9d69d5cf0f120f77e13ad13a862ab4f710655646a173abfaafb099a1590ce7a17d2a596f4
SSDEEP

3072:SydufNx7dyfkMY+BES09JXAnyrZalI+YQ:SyduVx7osMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5920	msedge.exe
5920	msedge.exe
4364	msedge.exe
4364	msedge.exe
396	identity_helper.exe
396	identity_helper.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 3800	4364	msedge.exe	81
PID 4364 wrote to memory of 3800	4364	msedge.exe	81
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 2556	4364	msedge.exe	82
PID 4364 wrote to memory of 5920	4364	msedge.exe	83
PID 4364 wrote to memory of 5920	4364	msedge.exe	83
PID 4364 wrote to memory of 2408	4364	msedge.exe	84
PID 4364 wrote to memory of 2408	4364	msedge.exe	84
PID 4364 wrote to memory of 2408	4364	msedge.exe	84
PID 4364 wrote to memory of 2408	4364	msedge.exe	84
PID 4364 wrote to memory of 2408	4364	msedge.exe	84
PID 4364 wrote to memory of 2408	4364	msedge.exe	84
PID 4364 wrote to memory of 2408	4364	msedge.exe	84
PID 4364 wrote to memory of 2408	4364	msedge.exe	84
PID 4364 wrote to memory of 2408	4364	msedge.exe	84
PID 4364 wrote to memory of 2408	4364	msedge.exe	84
PID 4364 wrote to memory of 2408	4364	msedge.exe	84
PID 4364 wrote to memory of 2408	4364	msedge.exe	84
PID 4364 wrote to memory of 2408	4364	msedge.exe	84
PID 4364 wrote to memory of 2408	4364	msedge.exe	84
PID 4364 wrote to memory of 2408	4364	msedge.exe	84
PID 4364 wrote to memory of 2408	4364	msedge.exe	84
PID 4364 wrote to memory of 2408	4364	msedge.exe	84
PID 4364 wrote to memory of 2408	4364	msedge.exe	84
PID 4364 wrote to memory of 2408	4364	msedge.exe	84
PID 4364 wrote to memory of 2408	4364	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\aa103f48ac1701bd019c39dbb4b3cfc5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa127d46f8,0x7ffa127d4708,0x7ffa127d4718
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,17962807098056453782,16468708030587638135,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,17962807098056453782,16468708030587638135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,17962807098056453782,16468708030587638135,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17962807098056453782,16468708030587638135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17962807098056453782,16468708030587638135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,17962807098056453782,16468708030587638135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,17962807098056453782,16468708030587638135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17962807098056453782,16468708030587638135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17962807098056453782,16468708030587638135,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17962807098056453782,16468708030587638135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17962807098056453782,16468708030587638135,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,17962807098056453782,16468708030587638135,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0c58054ff5079e8c24819ea3c5069b23

SHA1
f7d7155870f62924242051b004300f87dde90c51

SHA256
9e4b243d03aacc71a1faf97ac34349cdd95a8f0aa2781ae88544adc2c8a9f919

SHA512
4e7f536e2608779cf1beacc7c933716a25e22b3c880017497944417e80ab4e510221fab963771cb2a63069e9fe8a899e6dbb10b973c24637ff3d32fe0c9f1e26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b546f52444a5a38f2b85b89c36dbd5d8

SHA1
1819ec9fe8a7de4f168312576bc90338b8466779

SHA256
f1e44f2eb1c8fc7d28e69c58fa9458763ec75a06fe45d1c04745f364d8d13255

SHA512
244ecf50555cac71592a59c8b1a0f0c53c4d79993b3cec37f89626b1a7ccf9dbbc5bae51d2e1c360405a9cec65b3b2312b9dcdd191f2aa76a61eaf61e9056a71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
1af71ae26fa75fe58b5287a6f2cb6437

SHA1
ed8c44f641695a8afa3b41b6b3cfd6caa9d5cc16

SHA256
78e20f12a41a8194de73c7467f9f38c6025d0c722893a2451f4931b7f1bcb6aa

SHA512
07fe9ab98e04696e7b70aaae4207d94f56633327219e7839ab58cf718ea88c0b6f942de38555520823d29f43277a3d5dfd4b98e0d57089ffd307d372a1c7d9b4

Download Submit