a4f675e0773b028e4672f527c554c70f31f3c905ca63faa4a586d934603f795d

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 22:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

14b1e5987350f25156e7d46c6381210d_JaffaCakes118.html
Size

68KB
MD5

14b1e5987350f25156e7d46c6381210d
SHA1

6082554165b12385c609f59cf2841b2ec49ebe01
SHA256

a4f675e0773b028e4672f527c554c70f31f3c905ca63faa4a586d934603f795d
SHA512

8a6d8d898f953d7b99795ae02e3151e783d6e16cbb181ebff76b66ca4cd6c26bbb687ab6436586c357fc9b00f8d03321b8d03f21260685c19c3b2347661d30bd
SSDEEP

768:+gOriWNcaSoagGzq2OqmGY/ZbYsemZ6OFj986fQv0rZxL31pDwNWisy59E2S7k:p/lq2a/ZHe3OFj986dnLMW09b

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1376	msedge.exe
1376	msedge.exe
2348	msedge.exe
2348	msedge.exe
2000	identity_helper.exe
2000	identity_helper.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 3100	2348	msedge.exe	85
PID 2348 wrote to memory of 3100	2348	msedge.exe	85
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 700	2348	msedge.exe	86
PID 2348 wrote to memory of 1376	2348	msedge.exe	87
PID 2348 wrote to memory of 1376	2348	msedge.exe	87
PID 2348 wrote to memory of 2412	2348	msedge.exe	88
PID 2348 wrote to memory of 2412	2348	msedge.exe	88
PID 2348 wrote to memory of 2412	2348	msedge.exe	88
PID 2348 wrote to memory of 2412	2348	msedge.exe	88
PID 2348 wrote to memory of 2412	2348	msedge.exe	88
PID 2348 wrote to memory of 2412	2348	msedge.exe	88
PID 2348 wrote to memory of 2412	2348	msedge.exe	88
PID 2348 wrote to memory of 2412	2348	msedge.exe	88
PID 2348 wrote to memory of 2412	2348	msedge.exe	88
PID 2348 wrote to memory of 2412	2348	msedge.exe	88
PID 2348 wrote to memory of 2412	2348	msedge.exe	88
PID 2348 wrote to memory of 2412	2348	msedge.exe	88
PID 2348 wrote to memory of 2412	2348	msedge.exe	88
PID 2348 wrote to memory of 2412	2348	msedge.exe	88
PID 2348 wrote to memory of 2412	2348	msedge.exe	88
PID 2348 wrote to memory of 2412	2348	msedge.exe	88
PID 2348 wrote to memory of 2412	2348	msedge.exe	88
PID 2348 wrote to memory of 2412	2348	msedge.exe	88
PID 2348 wrote to memory of 2412	2348	msedge.exe	88
PID 2348 wrote to memory of 2412	2348	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\14b1e5987350f25156e7d46c6381210d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa90e246f8,0x7ffa90e24708,0x7ffa90e24718
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,227442097348503522,4793369189886878269,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,227442097348503522,4793369189886878269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2560 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,227442097348503522,4793369189886878269,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,227442097348503522,4793369189886878269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,227442097348503522,4793369189886878269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,227442097348503522,4793369189886878269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,227442097348503522,4793369189886878269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3084 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,227442097348503522,4793369189886878269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,227442097348503522,4793369189886878269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,227442097348503522,4793369189886878269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,227442097348503522,4793369189886878269,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,227442097348503522,4793369189886878269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,227442097348503522,4793369189886878269,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,227442097348503522,4793369189886878269,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4980 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
97e45b6b8987d07c1df164cc5b61322e

SHA1
ede3dc4d90a9a293bd8d871df98b307bd5c9194b

SHA256
de6fa83303bc30f2ea93c39395d5bc6dc3b4ee1c761e5ea53a8ad0e4d272d191

SHA512
9a7b793ec3db5fbae9b9f5cc59445e7002bb7237f50241d3e18bc869ab451eddee2202754b4a6e54698dafae8cb940e592f6e8c9fdda6c505a7ffe5181c3b6fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
42ae1e61f428d73e142416c62196f2ac

SHA1
5d31ae7fb7c48473e3c4958c1ced70c94ae21e93

SHA256
7e8cbb9577c657b4fc28b73f92e6fd606b3a0cb3b286dad152822dd96b5a2aec

SHA512
d762c5ea13ebf94a11fbdd6d539f2fdedef69b6fb9cc525c18489ff40bb72d39a6f8ce8030398ba3d50283de26ac7eb71fb33764383bca63040d5188152cdd8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
28dfb1fa40d187cc00137ef332fa45c4

SHA1
327b4836f453be7525f8d448c25c14aa7934ac56

SHA256
5b1a8088a03e4ce791c334e642f0103ab0eb9cb5f1afb68c4958073e333cb4e6

SHA512
e05915368a740787b9082530db1f75e689f3d7c398bd3200861e19ac43916beda321361b2fbd8eaaab6632d09c066797bba13ea292c2d493e24579a3433db493

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
164bd364a849797e6bc4829f944ce044

SHA1
2482dd8f33cbff5e69e424daf3b98b1fafd9597e

SHA256
5f0e963d47b65ef8003ad4f47a6bd33c9977c9e38300bdedb2b321ff71e965d5

SHA512
92f6c2f455af789aca74b07751b5c8338171a281cceb0341589d2cac2e61adbbebb8d25a40bac8ca7bf076bab91aa6faeaa6e5a63441ea50328db27e653d053b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a9dab85ac4c7db34a697ee513bf42277

SHA1
331d701ec4a97fbd636e3ac0e50797d36c56c7b0

SHA256
745955514fb9967ff635160df16f7e910ad43feda10cf89f7ae6c32888a7e68a

SHA512
692f4e6a5914ea08d4cdba46b0f9ce42ff00cc9928fc9ba51e2ff60aa3109918951c340c64e76723e1bdcb5e73aef6b55af9429a12241dea42a683ea1d9ffaec

Download Submit