084467174f6b2169896b4958c7a899a0cd1f8000ba7713725227cd5ed0735783

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 07:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

27c446d33f96b9dc6835759dcc9180dc_JaffaCakes118.html
Size

18KB
MD5

27c446d33f96b9dc6835759dcc9180dc
SHA1

06be80e2d32c55058a0ec1884563efe5e6b190c6
SHA256

084467174f6b2169896b4958c7a899a0cd1f8000ba7713725227cd5ed0735783
SHA512

c4dcdd391376fb7055d9095581cf72b7ea5036ebf17d3b2c31c76fb5329e4119b23b0c029202791c476bdab6bfea705a7241d4cb7b742c20d74c3d9d79be5621
SSDEEP

384:uQwiuWx6/KrqWhRtqYKF2HrfByXBL1DWCoaAuAxsG8aZCuIf2V2OM7ZIak6hwI6n:twiYSWWhy7c9yRfFAxsG8aZ22Vf6KRjf

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1596	msedge.exe
1596	msedge.exe
4776	msedge.exe
4776	msedge.exe
4212	identity_helper.exe
4212	identity_helper.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 4496	4776	msedge.exe	82
PID 4776 wrote to memory of 4496	4776	msedge.exe	82
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 532	4776	msedge.exe	83
PID 4776 wrote to memory of 1596	4776	msedge.exe	84
PID 4776 wrote to memory of 1596	4776	msedge.exe	84
PID 4776 wrote to memory of 4292	4776	msedge.exe	85
PID 4776 wrote to memory of 4292	4776	msedge.exe	85
PID 4776 wrote to memory of 4292	4776	msedge.exe	85
PID 4776 wrote to memory of 4292	4776	msedge.exe	85
PID 4776 wrote to memory of 4292	4776	msedge.exe	85
PID 4776 wrote to memory of 4292	4776	msedge.exe	85
PID 4776 wrote to memory of 4292	4776	msedge.exe	85
PID 4776 wrote to memory of 4292	4776	msedge.exe	85
PID 4776 wrote to memory of 4292	4776	msedge.exe	85
PID 4776 wrote to memory of 4292	4776	msedge.exe	85
PID 4776 wrote to memory of 4292	4776	msedge.exe	85
PID 4776 wrote to memory of 4292	4776	msedge.exe	85
PID 4776 wrote to memory of 4292	4776	msedge.exe	85
PID 4776 wrote to memory of 4292	4776	msedge.exe	85
PID 4776 wrote to memory of 4292	4776	msedge.exe	85
PID 4776 wrote to memory of 4292	4776	msedge.exe	85
PID 4776 wrote to memory of 4292	4776	msedge.exe	85
PID 4776 wrote to memory of 4292	4776	msedge.exe	85
PID 4776 wrote to memory of 4292	4776	msedge.exe	85
PID 4776 wrote to memory of 4292	4776	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\27c446d33f96b9dc6835759dcc9180dc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce25146f8,0x7ffce2514708,0x7ffce2514718
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,13616850505870771967,17617237780959071046,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,13616850505870771967,17617237780959071046,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2548 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,13616850505870771967,17617237780959071046,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13616850505870771967,17617237780959071046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13616850505870771967,17617237780959071046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13616850505870771967,17617237780959071046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,13616850505870771967,17617237780959071046,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,13616850505870771967,17617237780959071046,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13616850505870771967,17617237780959071046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13616850505870771967,17617237780959071046,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13616850505870771967,17617237780959071046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13616850505870771967,17617237780959071046,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,13616850505870771967,17617237780959071046,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4848 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
de1d175f3af722d1feb1c205f4e92d1e

SHA1
019cf8527a9b94bd0b35418bf7be8348be5a1c39

SHA256
1b99cae942ebf99c31795fa279d51b1a2379ca0af7b27bd3c58ea6c78a033924

SHA512
f0dcd08afd3c6a761cc1afa2846ec23fb5438d6127ebd535a754498debabd0b1ebd04858d1b98be92faf14b512f982b1f3dcbb702860e96877eb835f763f9734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
06b496d28461d5c01fc81bc2be6a9978

SHA1
36e7a9d9c7a924d5bb448d68038c7fe5e6cbf5aa

SHA256
e4a2d1395627095b0fa55e977e527ccb5b71dff3cd2d138df498f50f9f5ab507

SHA512
6488a807c978d38d65010583c1e5582548ab8102ebd68ee827e603c9bdfcdbb9f98a488d31414a829409f6edca8bd2eb4aadd4ff31b144de41249fa63a26bc91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
51422a2d2f514e4b1a033629f2666d97

SHA1
f94975d7794855d0c2e8b184187c3e1218b28cfa

SHA256
20dfb101e1bf62c4380e713840315540ff5493b7f938f4ac9d8bf6ff1108a4cc

SHA512
37dbeeee9d0adb3b4b107ca41fe004359343983c2f013b4d810fda24597ad1ff3141ef1b8ce775d1ebca7102201142db3fe2efcce4584c0a2d04f495f74c2f3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
722B

MD5
e199132eb2dbde80066e20807b45e87e

SHA1
e29071dbe26c42af0773ebeb44435c4e25e6f16e

SHA256
18a1eae26fe931e384d47ce9d98ef1fe41e096c53dd70074edd3f028322dec63

SHA512
0c89cfe68529f54aa59e03dfba34e3266018991b4a1a9f40e7ee8049edb30d7f1a57618c181d0588523a23614d6c58b28db221199c9433c36dd069c411ffdeee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c06ef61f8377e6c49a5c9405d9db5560

SHA1
9f90dafd7e4906ada7ddc4ee3651651315dca195

SHA256
ba15fdb3123f6e2cb032ca527d0d8e3c1b014df1ad3a41271f820e08715a939c

SHA512
1283a837dcc2f5402d5b251a27124a6c82ac328a82c5e1adee2e47d083346aa39151c7d8220a96f451cc49806a834342e75898045a025dcd4e800fadee7e2601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
83a7373e41f55c8c26ad912e47498472

SHA1
5df83e40a7de3b72916615642f70425d424d0d9c

SHA256
a7ad23ddd9eda768218ca5a8cf254558f823fc9b957e123211a09c3feb0a353f

SHA512
ffb6b907a98395709cbe7124f335cfe8b6726d788e7eaf603f15c2caa6dec1d8b5a36094e3592d3a00a65ef0e7defe4be633a143dd16efe7b64690c7ba84d8b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d15816dd1495f6ac36c3d64d9a208e73

SHA1
e28044adbab1b4046ce9ffd90566ac65d5d4637e

SHA256
b2842ca41abb940d0d9b67afb74bbf44338624bb76d93d274c0b9e8979eee045

SHA512
2210626022a4cdd43fd9202dabe0a6e607f30e0b0c6c290f02b6ab7c395689d9763cb4cdb6445227f31c440eec6a8b22197ebd852293a00437adc9475e7fc4c8

Download Submit