d9887cb822b9b6fb460a5a6775c3b110574f84d41730da2d507b693f0d426b4e

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2024, 23:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a23297672c71375741f0f96103d9da3_JaffaCakes118.html
Size

6KB
MD5

2a23297672c71375741f0f96103d9da3
SHA1

f4be29a514a08618e1b59d54a9bea4d86d5b1d0f
SHA256

d9887cb822b9b6fb460a5a6775c3b110574f84d41730da2d507b693f0d426b4e
SHA512

304fb19532ffdfdaf9f985a3eb57286040bff7c58436755f97518dd24d048f550b9ee74a173cb51047c6c590f3edaa90dd7594d15a37802c91626aeceb625fb0
SSDEEP

96:uzVs+ux7QvLLY1k9o84d12ef7CSTUJn/6/NcEZ7ru7f:csz7QvAYS/i4Nb76f

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4688	msedge.exe
4688	msedge.exe
1620	msedge.exe
1620	msedge.exe
1956	identity_helper.exe
1956	identity_helper.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1076	1620	msedge.exe	82
PID 1620 wrote to memory of 1076	1620	msedge.exe	82
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4844	1620	msedge.exe	85
PID 1620 wrote to memory of 4688	1620	msedge.exe	86
PID 1620 wrote to memory of 4688	1620	msedge.exe	86
PID 1620 wrote to memory of 812	1620	msedge.exe	87
PID 1620 wrote to memory of 812	1620	msedge.exe	87
PID 1620 wrote to memory of 812	1620	msedge.exe	87
PID 1620 wrote to memory of 812	1620	msedge.exe	87
PID 1620 wrote to memory of 812	1620	msedge.exe	87
PID 1620 wrote to memory of 812	1620	msedge.exe	87
PID 1620 wrote to memory of 812	1620	msedge.exe	87
PID 1620 wrote to memory of 812	1620	msedge.exe	87
PID 1620 wrote to memory of 812	1620	msedge.exe	87
PID 1620 wrote to memory of 812	1620	msedge.exe	87
PID 1620 wrote to memory of 812	1620	msedge.exe	87
PID 1620 wrote to memory of 812	1620	msedge.exe	87
PID 1620 wrote to memory of 812	1620	msedge.exe	87
PID 1620 wrote to memory of 812	1620	msedge.exe	87
PID 1620 wrote to memory of 812	1620	msedge.exe	87
PID 1620 wrote to memory of 812	1620	msedge.exe	87
PID 1620 wrote to memory of 812	1620	msedge.exe	87
PID 1620 wrote to memory of 812	1620	msedge.exe	87
PID 1620 wrote to memory of 812	1620	msedge.exe	87
PID 1620 wrote to memory of 812	1620	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2a23297672c71375741f0f96103d9da3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9524146f8,0x7ff952414708,0x7ff952414718
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,8319518887448648502,3345348700918017836,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,8319518887448648502,3345348700918017836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,8319518887448648502,3345348700918017836,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8319518887448648502,3345348700918017836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8319518887448648502,3345348700918017836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8319518887448648502,3345348700918017836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8319518887448648502,3345348700918017836,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,8319518887448648502,3345348700918017836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,8319518887448648502,3345348700918017836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8319518887448648502,3345348700918017836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8319518887448648502,3345348700918017836,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,8319518887448648502,3345348700918017836,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4536 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0d9e81bdd937f066a00d0199bfe4954b

SHA1
b50a52ccd719019700743abe3938a138f664d615

SHA256
4dfb9af62a9862397d550711d213e32f17994634ddcab0f1cd3d79544a59ef68

SHA512
e4350f37c92e5b63dc2d3be21b332c6d976c2ab0122922b5baa2c7738436d117bb01ed34564fd290ae046bc3a2e9d081b44f0411d5f4ae04b0b2c106705d49b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
250d7431b92068412fe786ebe40ec79c

SHA1
6031e9d9561cf93ea0de7f1fbe12ffecfffa18f4

SHA256
a2ac87e6365458a77a43ef421dac577bfa7e22e6096e39d31bcd553c8bf16834

SHA512
15eb9609a92be7cea46f3df6b805cb0512bfd68eeb5f1cf28bfa77dce5199827926ec5384efd24a4b3cf249ebb00a8e5c42076f0b802794c1ba2657636df8b90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f1122260fb6936ff2ab36b7c444bb1d2

SHA1
537a8abe9976f4c814600c4412235e3907c39ba0

SHA256
eae09898ba20103cf0be1bc9b602e4e5f6f7ab4598e52e9a00ff9892f6b4eb86

SHA512
2b141dfe7aa982c083651a4e7ed29e8347160f24adebfb4c04d91167ea166553d45bd32bd8618d1648905dc4e6f0e89e706b0461fa36df5ca351c06292ec3a0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f582ffcc1f0ac915ef914de88e38c754

SHA1
22ed1b51d47c4e3c2bbeb2347a4ae4ef05cf6d35

SHA256
4fb218e891497605d29174457a3e19c45dfc21d29cdc864a22003460d2e684b5

SHA512
378f6a1cca81a6bdb0ede3db6f0a773a0b0d7b1a17b871ae05e0d46fee4c99c04c327c7983290288ea709b669135b35328fb0458bf7f200d9cc0243825a9a51f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
095cd3eb0f7eb33b8777af619e25cc92

SHA1
bc9fbbcfe504769501deb125ca73aa97c11d3817

SHA256
a30fa7c125828a637ef7e68dbe72eca59bcb91c4effc4337a4f11f82704eafef

SHA512
e115e8b84bc4a24cfa30d9582cf15554f252c20a87b8df95cf80a32da27becf799f8619b075c78d9501d2adbe165ae76eba2c8e12acb1302f66d741749c03107

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e9f85889c59c3619091d5b2fda8f25a4

SHA1
43fa7125704f959d224ec3c5372b706517915cfa

SHA256
e21a1b5843fe7e6ffa626565aae537b4d72b7d3a39f6636688712ba624965f22

SHA512
6a0e4ece3fa5690712141b341e95c44159975451558824ee4c46771bc6c202747e2f79ac5f51a0e2f7bdbac8314d8f88adb8a368f02f8b02d41a8704619bcc09

Download Submit