95e5e344c446b2c14db759425ac1eeae2149a69e6db419a2599cea1b93e5d28f

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 17:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d31657797f9f23a8468454cf8fb7735_JaffaCakes118.html
Size

17KB
MD5

2d31657797f9f23a8468454cf8fb7735
SHA1

3fdd78d7e370c82f6c885ea73ed9386f6093dccf
SHA256

95e5e344c446b2c14db759425ac1eeae2149a69e6db419a2599cea1b93e5d28f
SHA512

4e167ce78652808ad682072f793e63d11f6427aeb33df51e730d240fc80cb75e71e2cc4a0630e4cc27d22ca068fa690f9ebdeef7eb4c380ae8eac9e78b92574c
SSDEEP

192:L1h35jcCARY6EatIjoBhzqfoZ9+FkZDrA5+rM3XUibl5gzI0Gh+Tpn98WDjRmlmX:5/c06EI3+pkZDrAqM3X8TGhKp+WD02V

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3660	msedge.exe
3660	msedge.exe
1612	msedge.exe
1612	msedge.exe
4948	identity_helper.exe
4948	identity_helper.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2764	1612	msedge.exe	83
PID 1612 wrote to memory of 2764	1612	msedge.exe	83
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 5100	1612	msedge.exe	84
PID 1612 wrote to memory of 3660	1612	msedge.exe	85
PID 1612 wrote to memory of 3660	1612	msedge.exe	85
PID 1612 wrote to memory of 1996	1612	msedge.exe	86
PID 1612 wrote to memory of 1996	1612	msedge.exe	86
PID 1612 wrote to memory of 1996	1612	msedge.exe	86
PID 1612 wrote to memory of 1996	1612	msedge.exe	86
PID 1612 wrote to memory of 1996	1612	msedge.exe	86
PID 1612 wrote to memory of 1996	1612	msedge.exe	86
PID 1612 wrote to memory of 1996	1612	msedge.exe	86
PID 1612 wrote to memory of 1996	1612	msedge.exe	86
PID 1612 wrote to memory of 1996	1612	msedge.exe	86
PID 1612 wrote to memory of 1996	1612	msedge.exe	86
PID 1612 wrote to memory of 1996	1612	msedge.exe	86
PID 1612 wrote to memory of 1996	1612	msedge.exe	86
PID 1612 wrote to memory of 1996	1612	msedge.exe	86
PID 1612 wrote to memory of 1996	1612	msedge.exe	86
PID 1612 wrote to memory of 1996	1612	msedge.exe	86
PID 1612 wrote to memory of 1996	1612	msedge.exe	86
PID 1612 wrote to memory of 1996	1612	msedge.exe	86
PID 1612 wrote to memory of 1996	1612	msedge.exe	86
PID 1612 wrote to memory of 1996	1612	msedge.exe	86
PID 1612 wrote to memory of 1996	1612	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2d31657797f9f23a8468454cf8fb7735_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6b6b46f8,0x7ffc6b6b4708,0x7ffc6b6b4718
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,12267606161077486306,6678750205459197649,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,12267606161077486306,6678750205459197649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,12267606161077486306,6678750205459197649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12267606161077486306,6678750205459197649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12267606161077486306,6678750205459197649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12267606161077486306,6678750205459197649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2020 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12267606161077486306,6678750205459197649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,12267606161077486306,6678750205459197649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,12267606161077486306,6678750205459197649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12267606161077486306,6678750205459197649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12267606161077486306,6678750205459197649,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12267606161077486306,6678750205459197649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12267606161077486306,6678750205459197649,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,12267606161077486306,6678750205459197649,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5820 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
de1d175f3af722d1feb1c205f4e92d1e

SHA1
019cf8527a9b94bd0b35418bf7be8348be5a1c39

SHA256
1b99cae942ebf99c31795fa279d51b1a2379ca0af7b27bd3c58ea6c78a033924

SHA512
f0dcd08afd3c6a761cc1afa2846ec23fb5438d6127ebd535a754498debabd0b1ebd04858d1b98be92faf14b512f982b1f3dcbb702860e96877eb835f763f9734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
06b496d28461d5c01fc81bc2be6a9978

SHA1
36e7a9d9c7a924d5bb448d68038c7fe5e6cbf5aa

SHA256
e4a2d1395627095b0fa55e977e527ccb5b71dff3cd2d138df498f50f9f5ab507

SHA512
6488a807c978d38d65010583c1e5582548ab8102ebd68ee827e603c9bdfcdbb9f98a488d31414a829409f6edca8bd2eb4aadd4ff31b144de41249fa63a26bc91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
187B

MD5
225e12a356c3015718e8af774caec1aa

SHA1
89cf516b7c5b2758d72d7855e345847d3dc8a77b

SHA256
2975163489cec27e1779c7e19ca646a5f4ff5897d6368fd49d33f3f04b242302

SHA512
bb0e8a1841196fa57e4eff4b6fccc2cb3dd30b1cd8b66efbe6eddf1e79cc0fe4adcdac753058a031a74b647da4bfe243a476a7e926cab20eff24185f923ed045

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a9ea2f8d74a39480bea156ddf275cc0c

SHA1
d2bde9721d435e217b8b275b7e24b846ae50b87b

SHA256
71ca9be7d839dc9db6b41fd4373339a77e7dabcfbb74de8b3e904eea553f5f12

SHA512
75ebc7d8846005bbae01c9770f95fdd878a93c5c75b7976d7d61542d6000c46473007588c747c723a816e3ee32dc4cdf755dbec738c6bdf132fb54bf8e674c8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
79fbf68d02f9309e3942f4a8739b50d0

SHA1
56230c8fa943449efa898ff6de63aada8722e93c

SHA256
15fcec9352ddf03e0052699b4a42a1b8c425fb766a7b02f6a13ae0f738d10ad3

SHA512
121a5893d298a21899f30d4f265f7dfb95ec496747311a82087e2c6b0c79e8c7e78def4cf49663af97f914286e03a5beaf6c3c2855f2c643c252e96781968427

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0a4bd793d54de540ba7ec77df1468027

SHA1
df6d4b84318ff176870378f3f71133c70ed6166b

SHA256
6178788f0c44161f34ef75bdf62f916d5de5c07aa1b3e7a5fd9f7a67b94d0137

SHA512
bea8f1c95c427bfc96ad9f9d518ea62df5e2d22d1f75689011b331fd94206b11dc0cc720c5b6dfbd021da676057bdf8b1586b3f7339a8ba764da0910f13e2cdb

Download Submit