771e2f3a92dc3a070b765c27124d9d78dd8d0f3df759025bf4c7aa324559e552

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 01:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1128b6f642c467fef80da9af40069448_JaffaCakes118.html
Size

29KB
MD5

1128b6f642c467fef80da9af40069448
SHA1

34e5fa0b9bbda47e9daf9890f3f65b2d3d118e05
SHA256

771e2f3a92dc3a070b765c27124d9d78dd8d0f3df759025bf4c7aa324559e552
SHA512

d019c3e0f270617c881076b31c65eac44f363600208f586c5dde3bfbb8abc15b9e140582ef9b4674d57c2f94d13ccb5af908e96a77335c44280ef39911bdb3da
SSDEEP

384:4h9iy2CfzWuBMtJ2rJvYOxDWespG/IJK+xw/TjeEuSO2yaT45qlh7TXuC3457yfw:Xy2iWuCuJH+xw/XeE1145ATxg8HMJ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
4608	msedge.exe
4608	msedge.exe
3348	identity_helper.exe
3348	identity_helper.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 3636	4608	msedge.exe	83
PID 4608 wrote to memory of 3636	4608	msedge.exe	83
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 2992	4608	msedge.exe	84
PID 4608 wrote to memory of 5032	4608	msedge.exe	85
PID 4608 wrote to memory of 5032	4608	msedge.exe	85
PID 4608 wrote to memory of 4904	4608	msedge.exe	86
PID 4608 wrote to memory of 4904	4608	msedge.exe	86
PID 4608 wrote to memory of 4904	4608	msedge.exe	86
PID 4608 wrote to memory of 4904	4608	msedge.exe	86
PID 4608 wrote to memory of 4904	4608	msedge.exe	86
PID 4608 wrote to memory of 4904	4608	msedge.exe	86
PID 4608 wrote to memory of 4904	4608	msedge.exe	86
PID 4608 wrote to memory of 4904	4608	msedge.exe	86
PID 4608 wrote to memory of 4904	4608	msedge.exe	86
PID 4608 wrote to memory of 4904	4608	msedge.exe	86
PID 4608 wrote to memory of 4904	4608	msedge.exe	86
PID 4608 wrote to memory of 4904	4608	msedge.exe	86
PID 4608 wrote to memory of 4904	4608	msedge.exe	86
PID 4608 wrote to memory of 4904	4608	msedge.exe	86
PID 4608 wrote to memory of 4904	4608	msedge.exe	86
PID 4608 wrote to memory of 4904	4608	msedge.exe	86
PID 4608 wrote to memory of 4904	4608	msedge.exe	86
PID 4608 wrote to memory of 4904	4608	msedge.exe	86
PID 4608 wrote to memory of 4904	4608	msedge.exe	86
PID 4608 wrote to memory of 4904	4608	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1128b6f642c467fef80da9af40069448_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc966f46f8,0x7ffc966f4708,0x7ffc966f4718
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,14368787189198753837,14168511806889309600,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,14368787189198753837,14168511806889309600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,14368787189198753837,14168511806889309600,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14368787189198753837,14168511806889309600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14368787189198753837,14168511806889309600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14368787189198753837,14168511806889309600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14368787189198753837,14168511806889309600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,14368787189198753837,14168511806889309600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,14368787189198753837,14168511806889309600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14368787189198753837,14168511806889309600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14368787189198753837,14168511806889309600,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14368787189198753837,14168511806889309600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14368787189198753837,14168511806889309600,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,14368787189198753837,14168511806889309600,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1868 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
a2178e50a5a3d4bc869c4c3b1029bb4b

SHA1
c75d7b94133e745a7f288bdd5a3d71d142790840

SHA256
e6265050d46fbb932c578251f36c215a16a180cb96d63b1a862d979f0c6a8d91

SHA512
ab812b321507f0826113912a26066371552c98d0d0d5e672118a9d59027e43dbca850a617587198b85148f8aac9330f41da2e14b3017da08463ce176bad29ff0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
071fc027b6deaf77861c3b7fbf0db925

SHA1
81dcb00d7774026f13c8b07a79f2cfa896cf0657

SHA256
65b812fb8762cc395b9dcb90f26cd91d0521982c8a81a4d93c80373bbad91b66

SHA512
4ee5f5dc58f478fa9d59306ee59dc2800f7ede864f96919222cc44203094f0593e1d85b3617d87f74a0c6b81765b2a8fe0b5045505a22665de3df4c690c3ba92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e7eb4cfe70b85dbda2ed1e04003cb682

SHA1
ed69858b09881f32222bec6d89e2e707fe8ca0ac

SHA256
06087080f1b3138eaebd5d539c2a695b7ecdf11cdf55bf28bbd7bac12b156374

SHA512
9f83bbbb4945cdc57f2a3a451475d5046d386db4cb35dbb284473e5e0e77e8a5b834d187b27086dd87415a4d5ebeb03271d5e38e04355a02e84bd9c5430cbf0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3976bfcd3b2ce5571ef796f2b4e16d1b

SHA1
81ac153dd56f23906e3862f003f0b0588dc51d38

SHA256
05b03fa186ad36c2150382fc1a431884c1249d9f3552e86b017dde276c911150

SHA512
01a39c11c7df2154c7f303f8fe0a9a1ee46165b2111c5ba986743600d4971ddcc925574fddfeb9b0c4a3fff7d5287ce1f8211ee3697954a883520762b68fa8aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a7f19e58354e12506f48a2d9a48eee99

SHA1
da0534455aec793b265550b1075d86877146ceed

SHA256
60d490cb43b4c6c2568648c38c6fec9fb3cf18515750b74227cb374e17b8d6d7

SHA512
f69949e093f807e38ca3c7a29873ae683ab6ebabcfb8bfef7eeac868b2beed144a6512e4495510911bd2786d281f2ac28c1387b3b5a0beb2a0d46fe51096e8ad

Download Submit