2e1b2da06e6ea7ac127a80e4a22b5662553ab0ee498f52bca99d5ddaf46efe85

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-04-2024 10:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e252b2f50346627f36d88be6103d6471_JaffaCakes118.html
Size

3.5MB
MD5

e252b2f50346627f36d88be6103d6471
SHA1

405bc93982f32445c4f24c56df72d8ba6cd9553d
SHA256

2e1b2da06e6ea7ac127a80e4a22b5662553ab0ee498f52bca99d5ddaf46efe85
SHA512

a7718f2cb442f21ae20851755704dd5fe8a2e41b0676d8e1382e4e537feaa5bdc37b3d20df52f672635e860adaf520d5404c240e098a41cc49af0aa9d2d87eec
SSDEEP

12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NSx:jvpjte4tT64x

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
464	msedge.exe
464	msedge.exe
4396	identity_helper.exe
4396	identity_helper.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 4984	464	msedge.exe	85
PID 464 wrote to memory of 4984	464	msedge.exe	85
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 1128	464	msedge.exe	86
PID 464 wrote to memory of 4572	464	msedge.exe	87
PID 464 wrote to memory of 4572	464	msedge.exe	87
PID 464 wrote to memory of 4856	464	msedge.exe	88
PID 464 wrote to memory of 4856	464	msedge.exe	88
PID 464 wrote to memory of 4856	464	msedge.exe	88
PID 464 wrote to memory of 4856	464	msedge.exe	88
PID 464 wrote to memory of 4856	464	msedge.exe	88
PID 464 wrote to memory of 4856	464	msedge.exe	88
PID 464 wrote to memory of 4856	464	msedge.exe	88
PID 464 wrote to memory of 4856	464	msedge.exe	88
PID 464 wrote to memory of 4856	464	msedge.exe	88
PID 464 wrote to memory of 4856	464	msedge.exe	88
PID 464 wrote to memory of 4856	464	msedge.exe	88
PID 464 wrote to memory of 4856	464	msedge.exe	88
PID 464 wrote to memory of 4856	464	msedge.exe	88
PID 464 wrote to memory of 4856	464	msedge.exe	88
PID 464 wrote to memory of 4856	464	msedge.exe	88
PID 464 wrote to memory of 4856	464	msedge.exe	88
PID 464 wrote to memory of 4856	464	msedge.exe	88
PID 464 wrote to memory of 4856	464	msedge.exe	88
PID 464 wrote to memory of 4856	464	msedge.exe	88
PID 464 wrote to memory of 4856	464	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e252b2f50346627f36d88be6103d6471_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd3a0e46f8,0x7ffd3a0e4708,0x7ffd3a0e4718
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,2612312954584835241,12223187969073763011,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,2612312954584835241,12223187969073763011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,2612312954584835241,12223187969073763011,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2612312954584835241,12223187969073763011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2612312954584835241,12223187969073763011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,2612312954584835241,12223187969073763011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,2612312954584835241,12223187969073763011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2612312954584835241,12223187969073763011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2612312954584835241,12223187969073763011,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2612312954584835241,12223187969073763011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2612312954584835241,12223187969073763011,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,2612312954584835241,12223187969073763011,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3820 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
981B

MD5
a9cfb29e09bc7caef94a42b785d549c1

SHA1
25a87e5eaf4c0b0b3a58cf77ee9f3d753fc81bb1

SHA256
00a5247132278b1215cf12427301bf22a258e330b1e0b9c56bb317e528ac4022

SHA512
cbd2d9a9866486c8e1491da78bf2ad73f76cc6ce4f19f845475123703fc7a9fa27f9aaee3432e3fdf4b54309076987fd603858b5d38cd834d542ec786c488a79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
15455522bee2c7d79f0fb50626b816be

SHA1
8725f567d258b177a1e8bcf3553e245722e520ec

SHA256
868c83ba37d0501668ba42f28f4c59a845037f39b695872deba6ebf0db6f6884

SHA512
5a6a652da12d416cdbfd64a86ea76a98c2f2bd916e755e8ca00c11bc156a963a709edb6b7539e1cfa92a7fc26db084c74b2dd7180fc76c3865b93c2d8892328e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b1dfe4b5eb884898772165102b189b25

SHA1
41c087fb3fc4c4f2afc21c11125dd1dbacb52422

SHA256
efc4a35aabc4ab5031363117d1f9068e7956125b36107fae793515c006d0aee6

SHA512
94b3f52b864acfd95394afa6597b57b7413cb2a2c7d770ce54b4dedbd29f63e9c73c84f6e37ec846928220391811d3a544d53252caa5c66acc31c3d1e124ca82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
518c3cffd40936b3cb405e68920f8c5d

SHA1
06c36a03504238780c44b8c8b188519610c75917

SHA256
172269b564aaa2d1e58fe173cb0fa60b74dfdd4d30028f94549c6a50be644a4e

SHA512
8584a79a88970a4bdee2fa312633c1427207c3691c507f7c46c3676d9d20b9c8693f77e65dc0090abdeed6d4a0715bb4d875049fde5a0c51d39548da0636b336

Download Submit