e703ebf8f6d6ee6585a6fad32604bf5657b301c02c42ac0738b38476ea789727

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 23:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ab3152c860d718baeb432ee5c00f851_JaffaCakes118.html
Size

37KB
MD5

0ab3152c860d718baeb432ee5c00f851
SHA1

f15c1ed0ea3599948d1a179eea3fa57112c99d84
SHA256

e703ebf8f6d6ee6585a6fad32604bf5657b301c02c42ac0738b38476ea789727
SHA512

46aeffa9ce7d6264d283977689b4df3c8bfa6d8e0012eae36c1bdd6e5df885d53868c73fab4fa4c55a7ef8af62c9ee9a89814049f58f7205ad7333cdf5c34550
SSDEEP

768:a4z4hge9scwk7PrN1i7y5hYao4K48w3B1sUldbPZyxkrFuK:aEugfk73o5OdbPZyW

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3708	msedge.exe
3708	msedge.exe
3664	msedge.exe
3664	msedge.exe
5084	identity_helper.exe
5084	identity_helper.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 1660	3664	msedge.exe	84
PID 3664 wrote to memory of 1660	3664	msedge.exe	84
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 1600	3664	msedge.exe	85
PID 3664 wrote to memory of 3708	3664	msedge.exe	86
PID 3664 wrote to memory of 3708	3664	msedge.exe	86
PID 3664 wrote to memory of 1188	3664	msedge.exe	87
PID 3664 wrote to memory of 1188	3664	msedge.exe	87
PID 3664 wrote to memory of 1188	3664	msedge.exe	87
PID 3664 wrote to memory of 1188	3664	msedge.exe	87
PID 3664 wrote to memory of 1188	3664	msedge.exe	87
PID 3664 wrote to memory of 1188	3664	msedge.exe	87
PID 3664 wrote to memory of 1188	3664	msedge.exe	87
PID 3664 wrote to memory of 1188	3664	msedge.exe	87
PID 3664 wrote to memory of 1188	3664	msedge.exe	87
PID 3664 wrote to memory of 1188	3664	msedge.exe	87
PID 3664 wrote to memory of 1188	3664	msedge.exe	87
PID 3664 wrote to memory of 1188	3664	msedge.exe	87
PID 3664 wrote to memory of 1188	3664	msedge.exe	87
PID 3664 wrote to memory of 1188	3664	msedge.exe	87
PID 3664 wrote to memory of 1188	3664	msedge.exe	87
PID 3664 wrote to memory of 1188	3664	msedge.exe	87
PID 3664 wrote to memory of 1188	3664	msedge.exe	87
PID 3664 wrote to memory of 1188	3664	msedge.exe	87
PID 3664 wrote to memory of 1188	3664	msedge.exe	87
PID 3664 wrote to memory of 1188	3664	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0ab3152c860d718baeb432ee5c00f851_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7fff6d6446f8,0x7fff6d644708,0x7fff6d644718
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,13142001162151765801,14132350786301495433,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,13142001162151765801,14132350786301495433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,13142001162151765801,14132350786301495433,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13142001162151765801,14132350786301495433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13142001162151765801,14132350786301495433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,13142001162151765801,14132350786301495433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,13142001162151765801,14132350786301495433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13142001162151765801,14132350786301495433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13142001162151765801,14132350786301495433,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13142001162151765801,14132350786301495433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13142001162151765801,14132350786301495433,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,13142001162151765801,14132350786301495433,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c237a55b779417cba77e7d32a0daf169

SHA1
b1fcb2e02e5fcfa83603183d78b7b4983bad3f79

SHA256
4a2c9f2ee022e32781534a1fe602b65811ff20eac228f11a57e8f93a35da0c6f

SHA512
97a1c4c505b08c53c0d9a4a9ecfc55750b3928f68fc8cfb89a396cc3cca06db9c5f0af0116a3ac4653cdd1a85fecbe870d91add01cdb82a2e3063f5d06836a16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e027a05a-f58f-46ff-89cc-0a3f0b8acce4.tmp

Filesize
6KB

MD5
4d83ed7ef46b002e167b151c4f3e1325

SHA1
e56b74c63ca3cc679c49f52f3cae6e87d1be0a2b

SHA256
2591f9e502fd79ada89f1158c7a07ad8ac6ac3fcedc992beae7a06a258465148

SHA512
804a22a689bd1d99c60e516125d8035935c882cbe2c605ac34a48f810e34f484c7963844a7559705fce48ac90e2770827178e62a58adb1ca4311566e3012510c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
90664b783ce12cd31c3e64e97542251f

SHA1
a8ea0432293d529d209ac05f5b8c786c1e2a8f45

SHA256
d75397cd8d06226e14983f0cb8ad4858821a3de1b76450c25e0e7413d8583c89

SHA512
035d5b61641143fe04a81b7eeee4ac577672f8c7c9c60b3cedc8d41b0c49913359a48577f6f34865ec5825d6edfc39abb806bb63920c6af01e0e17df2c208ccb

Download Submit