97e8d44305cf66a6fbb66cb7ba38a5fd54d9c047f25c06aa26412940b32a6c40

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 14:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

637903f1d81b90269f20fbeafadee932_JaffaCakes118.html
Size

12KB
MD5

637903f1d81b90269f20fbeafadee932
SHA1

876897050e78d693e451c20a6630cb7a70ace525
SHA256

97e8d44305cf66a6fbb66cb7ba38a5fd54d9c047f25c06aa26412940b32a6c40
SHA512

9bac3f5690ff7e647610ee11c432ef688dcdb77e9c5b73026a2c65ca2cc0df54367ccfaef41e5af89b9fcd1c632e3d52d66adbf1f519796327a4e3bcc1c8dd2a
SSDEEP

384:xM/hF/GkjPDLmx44RocXu6GHnXdRoiHisXJOFNNYrVOFQbF2ixxspUkKveegSY:xMoocrwndWFRVFMTq

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4124	msedge.exe
4124	msedge.exe
2660	msedge.exe
2660	msedge.exe
3248	identity_helper.exe
3248	identity_helper.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe
2548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 1020	2660	msedge.exe	84
PID 2660 wrote to memory of 1020	2660	msedge.exe	84
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 3272	2660	msedge.exe	85
PID 2660 wrote to memory of 4124	2660	msedge.exe	86
PID 2660 wrote to memory of 4124	2660	msedge.exe	86
PID 2660 wrote to memory of 4080	2660	msedge.exe	87
PID 2660 wrote to memory of 4080	2660	msedge.exe	87
PID 2660 wrote to memory of 4080	2660	msedge.exe	87
PID 2660 wrote to memory of 4080	2660	msedge.exe	87
PID 2660 wrote to memory of 4080	2660	msedge.exe	87
PID 2660 wrote to memory of 4080	2660	msedge.exe	87
PID 2660 wrote to memory of 4080	2660	msedge.exe	87
PID 2660 wrote to memory of 4080	2660	msedge.exe	87
PID 2660 wrote to memory of 4080	2660	msedge.exe	87
PID 2660 wrote to memory of 4080	2660	msedge.exe	87
PID 2660 wrote to memory of 4080	2660	msedge.exe	87
PID 2660 wrote to memory of 4080	2660	msedge.exe	87
PID 2660 wrote to memory of 4080	2660	msedge.exe	87
PID 2660 wrote to memory of 4080	2660	msedge.exe	87
PID 2660 wrote to memory of 4080	2660	msedge.exe	87
PID 2660 wrote to memory of 4080	2660	msedge.exe	87
PID 2660 wrote to memory of 4080	2660	msedge.exe	87
PID 2660 wrote to memory of 4080	2660	msedge.exe	87
PID 2660 wrote to memory of 4080	2660	msedge.exe	87
PID 2660 wrote to memory of 4080	2660	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\637903f1d81b90269f20fbeafadee932_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb7e7b46f8,0x7ffb7e7b4708,0x7ffb7e7b4718
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,18394308095149267322,1789311151912207711,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,18394308095149267322,1789311151912207711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,18394308095149267322,1789311151912207711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,18394308095149267322,1789311151912207711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,18394308095149267322,1789311151912207711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3104 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,18394308095149267322,1789311151912207711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,18394308095149267322,1789311151912207711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,18394308095149267322,1789311151912207711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,18394308095149267322,1789311151912207711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,18394308095149267322,1789311151912207711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,18394308095149267322,1789311151912207711,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,18394308095149267322,1789311151912207711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,18394308095149267322,1789311151912207711,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,18394308095149267322,1789311151912207711,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3440 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
75c9f57baeefeecd6c184627de951c1e

SHA1
52e0468e13cbfc9f15fc62cc27ce14367a996cff

SHA256
648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f

SHA512
c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
10fa19df148444a77ceec60cabd2ce21

SHA1
685b599c497668166ede4945d8885d204fd8d70f

SHA256
c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b

SHA512
3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
846B

MD5
7efcfa0be1fa9b2dc26327d09dee60e3

SHA1
7477e9d79e2423ca00bb8222843026569fd511d6

SHA256
0106e3e699bf6835bc4391b7040dda22c3d291195c722ceb93e48647206ee70d

SHA512
d08d2c4fabc1dbf6f22b12ac30d140d56f9dbd245de0a8b02b4cddeac1af4aadce9dae22bdc31ee12584f8880620c502147a2d09661397d29d1c45169a30a8f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8bd0e897dd1899f23125d330f12d2085

SHA1
3580179b1ee29d337860844030d0e60d9c3f7910

SHA256
0ff7db8f17b1d2ac3556e9f55c72c3ac833ab6b89fd86de1a21576c9a3f442a5

SHA512
eab9e4ef2eea8ef5d67d3804e2809a89725fd4d857399dd9cf0083d62fc1c023ac920c212395bc234bf915372953f23baecc20a73f658d262544f3b1f721fae0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
77d866f86c5a1ab280ddf989cd0bf5b5

SHA1
c6bd08421c6453e0cc93f260aa614668d8cf6e05

SHA256
e9df66b889fada30f1e7ecb23405219d9c762547f9e1164a136f354799f16e73

SHA512
4a214b1337a3c965af9cba1caa493081393375a18389387c7caedc3bf67e8e010c332ad2789bd39166ad3131b6e2cce1a215b10cce57376876b36b98a0282172

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
248cd92a3bc4000ad88590337538481c

SHA1
f364d6b5c326e620bced7e379354029b1b2ad226

SHA256
d9947a3d24ff35688e36f37a03fd39763933a7d6dd678fb4c3f2720ab5b14983

SHA512
48a32b3305fcc39e67777fe42d010f7886765338f60458ed3a9513f5bb27e01359f4a05a182899bf7b109ea773efbeed04e441d5ecc2a01e1010dd4a5ede0cb6

Download Submit