10050b7ba00a4a4a659edfe255694b6fbdef89908a84ccee2fada7f37db9ee83

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1636c4c2ea65f6af7740986f1fb9cd70_JaffaCakes118.html
Size

6KB
MD5

1636c4c2ea65f6af7740986f1fb9cd70
SHA1

ae2b85ae6a8a4a4821b5d00d1b7527d194b654f2
SHA256

10050b7ba00a4a4a659edfe255694b6fbdef89908a84ccee2fada7f37db9ee83
SHA512

995fbb0fa03f44196bb2c83dbe0517be39c86b821bad8799ea0cbeb805de54347d5cf6c07784d1eb675bf83844d7ea39ab8598a094ae8386c952c82830cb40e6
SSDEEP

96:uzVs+ux76WLLY1k9o84d12ef7CSTUO7aYcEZ7ru7f:csz76WAYS/TaYb76f

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
2368	msedge.exe
2368	msedge.exe
1172	identity_helper.exe
1172	identity_helper.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1468	2368	msedge.exe	83
PID 2368 wrote to memory of 1468	2368	msedge.exe	83
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 2860	2368	msedge.exe	84
PID 2368 wrote to memory of 4940	2368	msedge.exe	85
PID 2368 wrote to memory of 4940	2368	msedge.exe	85
PID 2368 wrote to memory of 3728	2368	msedge.exe	86
PID 2368 wrote to memory of 3728	2368	msedge.exe	86
PID 2368 wrote to memory of 3728	2368	msedge.exe	86
PID 2368 wrote to memory of 3728	2368	msedge.exe	86
PID 2368 wrote to memory of 3728	2368	msedge.exe	86
PID 2368 wrote to memory of 3728	2368	msedge.exe	86
PID 2368 wrote to memory of 3728	2368	msedge.exe	86
PID 2368 wrote to memory of 3728	2368	msedge.exe	86
PID 2368 wrote to memory of 3728	2368	msedge.exe	86
PID 2368 wrote to memory of 3728	2368	msedge.exe	86
PID 2368 wrote to memory of 3728	2368	msedge.exe	86
PID 2368 wrote to memory of 3728	2368	msedge.exe	86
PID 2368 wrote to memory of 3728	2368	msedge.exe	86
PID 2368 wrote to memory of 3728	2368	msedge.exe	86
PID 2368 wrote to memory of 3728	2368	msedge.exe	86
PID 2368 wrote to memory of 3728	2368	msedge.exe	86
PID 2368 wrote to memory of 3728	2368	msedge.exe	86
PID 2368 wrote to memory of 3728	2368	msedge.exe	86
PID 2368 wrote to memory of 3728	2368	msedge.exe	86
PID 2368 wrote to memory of 3728	2368	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1636c4c2ea65f6af7740986f1fb9cd70_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8428346f8,0x7ff842834708,0x7ff842834718
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1776,9589304120977012339,7167766126274543622,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1776,9589304120977012339,7167766126274543622,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1776,9589304120977012339,7167766126274543622,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,9589304120977012339,7167766126274543622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,9589304120977012339,7167766126274543622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1776,9589304120977012339,7167766126274543622,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1776,9589304120977012339,7167766126274543622,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,9589304120977012339,7167766126274543622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,9589304120977012339,7167766126274543622,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,9589304120977012339,7167766126274543622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,9589304120977012339,7167766126274543622,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1776,9589304120977012339,7167766126274543622,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5360 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c5abc082d9d9307e797b7e89a2f755f4

SHA1
54c442690a8727f1d3453b6452198d3ec4ec13df

SHA256
a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716

SHA512
ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4a74bc775caf3de7fc9cde3c30ce482

SHA1
c6ed3161390e5493f71182a6cb98d51c9063775d

SHA256
dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280

SHA512
55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cb814e8cb18ba1d580cdd09e4d367352

SHA1
d6e66ded2627935ec5054ef3c8da8866b3860d0c

SHA256
bcd7cc57fa6fe2a1ed983c8b13ab2558a7d2c2b7cdb79b0400475475ac0407bd

SHA512
ec0afb6d57c168d96061319f146a75cef9c27d5f1eedeb674e81a7db17f1fbfb60eee4fb68e7c03f929bb62f299d6a8d6e9a386e724fe55f11eeedccbe57e901

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4402cfb68921dc4d4647e1300a65a078

SHA1
4075b1a5e6203ff587bc0b6794e24a5550f80890

SHA256
f8821f598cbbc5387d7a52617aea7cfe4576558cc66856057acd3fa2d4aa8df3

SHA512
969709f7cee85004f9a509f6caa9530b789b50da894fdf3396e915b3f1127b4de9dc63ecbd54a5b1a9abed41b08fdb8313d26dcd0e409d92456a787437ead529

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9abee71e8aeb5e610b1561338128ffa6

SHA1
a1c69580b52b16868efab95a8f3857279abd8220

SHA256
3e02b9dafdc9a4de8a2774342e8401b8d620ba11535f9f4b3693ff96c948cf89

SHA512
6470d37fac221d71c9199de8688a4a4dafa8a2bc427f9293f1617204e9c3e01f94aaf04257a62bf8390822e78ccb291e5f5b581e160e07c529682a1bd93041b1

Download Submit