e45838f4dea388c75227065ff2c510cef8a7a6e0ab2f89dfb78203b38c5030b2

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 00:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5e58826f94adef329cbfea9e3e6232e4_JaffaCakes118.html
Size

591KB
MD5

5e58826f94adef329cbfea9e3e6232e4
SHA1

f612c25876ae164b0b788d1992a00bd96312a53c
SHA256

e45838f4dea388c75227065ff2c510cef8a7a6e0ab2f89dfb78203b38c5030b2
SHA512

8d3141610abb0d24da42a2635599d82977aa4f0b74c36dbdbbd13aeed5c4be39bf3b0eada103bf7e38d0a56bfd7d9da9678371c2f11277e492a52d08748659b9
SSDEEP

1536:NsPuhuTFpcWHQ9jYZBgSJLJHcVQ+mriEExBeHJPc3R8zn3zje63ZZ0XHoa+FLge6:NsPuhuTFp0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
1416	msedge.exe
1416	msedge.exe
2856	identity_helper.exe
2856	identity_helper.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 2832	1416	msedge.exe	84
PID 1416 wrote to memory of 2832	1416	msedge.exe	84
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4724	1416	msedge.exe	85
PID 1416 wrote to memory of 4700	1416	msedge.exe	86
PID 1416 wrote to memory of 4700	1416	msedge.exe	86
PID 1416 wrote to memory of 3008	1416	msedge.exe	87
PID 1416 wrote to memory of 3008	1416	msedge.exe	87
PID 1416 wrote to memory of 3008	1416	msedge.exe	87
PID 1416 wrote to memory of 3008	1416	msedge.exe	87
PID 1416 wrote to memory of 3008	1416	msedge.exe	87
PID 1416 wrote to memory of 3008	1416	msedge.exe	87
PID 1416 wrote to memory of 3008	1416	msedge.exe	87
PID 1416 wrote to memory of 3008	1416	msedge.exe	87
PID 1416 wrote to memory of 3008	1416	msedge.exe	87
PID 1416 wrote to memory of 3008	1416	msedge.exe	87
PID 1416 wrote to memory of 3008	1416	msedge.exe	87
PID 1416 wrote to memory of 3008	1416	msedge.exe	87
PID 1416 wrote to memory of 3008	1416	msedge.exe	87
PID 1416 wrote to memory of 3008	1416	msedge.exe	87
PID 1416 wrote to memory of 3008	1416	msedge.exe	87
PID 1416 wrote to memory of 3008	1416	msedge.exe	87
PID 1416 wrote to memory of 3008	1416	msedge.exe	87
PID 1416 wrote to memory of 3008	1416	msedge.exe	87
PID 1416 wrote to memory of 3008	1416	msedge.exe	87
PID 1416 wrote to memory of 3008	1416	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5e58826f94adef329cbfea9e3e6232e4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84ab746f8,0x7ff84ab74708,0x7ff84ab74718
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,2491891246077180493,13450380826496412254,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,2491891246077180493,13450380826496412254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,2491891246077180493,13450380826496412254,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2491891246077180493,13450380826496412254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2491891246077180493,13450380826496412254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2491891246077180493,13450380826496412254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,2491891246077180493,13450380826496412254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,2491891246077180493,13450380826496412254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2491891246077180493,13450380826496412254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2491891246077180493,13450380826496412254,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2491891246077180493,13450380826496412254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2491891246077180493,13450380826496412254,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,2491891246077180493,13450380826496412254,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4868 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaaad45aced1889a90a8aa4c39f92659

SHA1
5c0130d9e8d1a64c97924090d9a5258b8a31b83c

SHA256
5e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b

SHA512
0db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3ee50fb26a9d3f096c47ff8696c24321

SHA1
a8c83e798d2a8b31fec0820560525e80dfa4fe66

SHA256
d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f

SHA512
479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\950507ab-a4f1-4504-a8e7-1bdcbdd0a848.tmp

Filesize
37B

MD5
661760f65468e15dd28c1fd21fb55e6d

SHA1
207638003735c9b113b1f47bb043cdcdbf4b0b5f

SHA256
0a5f22651f8fe6179e924a10a444b7c394c56e1ed6015d3fc336198252984c0e

SHA512
6454c5f69a2d7d7f0df4f066f539561c365bb6b14c466f282a99bf1116b72d757bef0bf03a0e0c68a7538a02a993fc070c52133ca2162c8496017053194f441c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
257B

MD5
6edca6da5130c768f823ef28a90027d1

SHA1
70c6026009dfb8a6ed66186cab6537f5b799bf46

SHA256
100f6f57c8f5a39979ac120d5d5c56dee06d56a20d7e59e848ca97dc648178d2

SHA512
399ac03a157db8117467c7e1204b58f17ca00543824f18f372c8550b8a007e1c17825af2e95e0666f27db25a3c2b842892cf86a711bfc545f6c7b5015999ef03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
495d03b0dfacb034ce0c1e4b584b602c

SHA1
63ea4d9dd154c881dc3328b51f7460b30107fd4c

SHA256
c8971791ad59515d0869df7626de3af50dcc714cbbca7792f24836dc1ca58ce7

SHA512
d1f0e8ff10c5c787a585e8586dae171d2e318de2c6dbc01f7eb096efcf2cc1aeaa7e3d7e93bbf7f1dcc8dddeb6029773aeafaf080f107381f3678d6cdcb2d2d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e0af753cae7ed7de6a917fbf7ff996dd

SHA1
c55c9bc06a67fcc3474d165e68656d263b65a1ca

SHA256
650b1027dc1f2ea5050f2e36db1f6f430c96e9d25dd4ea2b7f6b9fe5858c526f

SHA512
bf4160c15374493f4bce25743fbf530ad5a09665bb3445e9228a07860a176da570291a926fc4715f4774596ee6c84d8f52bf51892d0869822eced349ce4b2290

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e74f1d9822a0b1edb642ac8b2f0ac743

SHA1
69f44aa9ae24e4718e3e77214eddbd3d9619092d

SHA256
60e046bc547c07ad31dfd07fca6372af3184fa6fff9a93e722437dcdaf8bee0e

SHA512
bb07a812b522d46adfe85f204e257ae340aa009d05953abed1085e3f3cc760460b939d8ccb915e87a53514fcbf57c091d283085fb5120c3f2933a1bd0d6a1d45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
43b85854bfd37e52738d0416463137e2

SHA1
80428c98a27b0a5c5a2b8e5682de51c1db681b56

SHA256
3fb9fbc5931589f3716d738e4b5b4d09f5ee20473dc5cb83ab30d6786ba01493

SHA512
37287c06a96a01e84c0cb2c83407d4ab78b7b105f845281eabbd03b05f2f4e91aa255ce790edbf414e3027af0a300d12141138d86838e69576b728fb496a591c

Download Submit