a943330fb3d9261ea11a8463ec8eaa9c26b68d447d23bb71ec82442404310df5

Analysis

max time kernel
145s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 01:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

229c45292b4c2ba7b7a3c48583d00375_JaffaCakes118.html
Size

217KB
MD5

229c45292b4c2ba7b7a3c48583d00375
SHA1

faa3e23d59fe90acdf5cdd0b83f5596e55d05a44
SHA256

a943330fb3d9261ea11a8463ec8eaa9c26b68d447d23bb71ec82442404310df5
SHA512

527f7b380e0c28e9a339433c6b84b2ddd7399a7864674d801f09e4ffa4ab78fe5411a87747a7081202ee4382154bb6f4da10d5eb257d545561ef06449fa7fac9
SSDEEP

3072:StddTrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJq:Stv3z9VxLY7iAVLTBQJlq

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1204	msedge.exe
1204	msedge.exe
116	msedge.exe
116	msedge.exe
3012	identity_helper.exe
3012	identity_helper.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 808	116	msedge.exe	85
PID 116 wrote to memory of 808	116	msedge.exe	85
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 2860	116	msedge.exe	86
PID 116 wrote to memory of 1204	116	msedge.exe	87
PID 116 wrote to memory of 1204	116	msedge.exe	87
PID 116 wrote to memory of 3716	116	msedge.exe	88
PID 116 wrote to memory of 3716	116	msedge.exe	88
PID 116 wrote to memory of 3716	116	msedge.exe	88
PID 116 wrote to memory of 3716	116	msedge.exe	88
PID 116 wrote to memory of 3716	116	msedge.exe	88
PID 116 wrote to memory of 3716	116	msedge.exe	88
PID 116 wrote to memory of 3716	116	msedge.exe	88
PID 116 wrote to memory of 3716	116	msedge.exe	88
PID 116 wrote to memory of 3716	116	msedge.exe	88
PID 116 wrote to memory of 3716	116	msedge.exe	88
PID 116 wrote to memory of 3716	116	msedge.exe	88
PID 116 wrote to memory of 3716	116	msedge.exe	88
PID 116 wrote to memory of 3716	116	msedge.exe	88
PID 116 wrote to memory of 3716	116	msedge.exe	88
PID 116 wrote to memory of 3716	116	msedge.exe	88
PID 116 wrote to memory of 3716	116	msedge.exe	88
PID 116 wrote to memory of 3716	116	msedge.exe	88
PID 116 wrote to memory of 3716	116	msedge.exe	88
PID 116 wrote to memory of 3716	116	msedge.exe	88
PID 116 wrote to memory of 3716	116	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\229c45292b4c2ba7b7a3c48583d00375_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffee9846f8,0x7fffee984708,0x7fffee984718
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,8589321676124343842,13268067596753777909,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,8589321676124343842,13268067596753777909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,8589321676124343842,13268067596753777909,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8589321676124343842,13268067596753777909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8589321676124343842,13268067596753777909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,8589321676124343842,13268067596753777909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,8589321676124343842,13268067596753777909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8589321676124343842,13268067596753777909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8589321676124343842,13268067596753777909,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8589321676124343842,13268067596753777909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8589321676124343842,13268067596753777909,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,8589321676124343842,13268067596753777909,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62c02dda2bf22d702a9b3a1c547c5f6a

SHA1
8f42966df96bd2e8c1f6b31b37c9a19beb6394d6

SHA256
cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b

SHA512
a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
179761101e8898c8bb26d4567e30ef6a

SHA1
ab8cfc52bcee1a944cefccf556cd8446e9004272

SHA256
c5f0553c9458749e82fe36199ea47699c0ed3baf92e173039475a42a043777d6

SHA512
2422e3802d8f26debeb63a9b16639818060b9f3894aac2096ca8aedcad6a68afc9161798d3a8a2221ff0b90afd313c4c2d95c34fe91bc11a29108544e87bd9b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cca828a9619f37d6f3f9fe9c439461ed

SHA1
d771dd1f99a3c9dd764fd49f223403082360975d

SHA256
356d5f389be43ff1d65e153d21122cbc1eb77f29beb356df46be94d817cdc27c

SHA512
2803aee5160085499033916f9d6c669feb782566a0401d6b2d96300e9e88c370a66158970045e4f7b56ba03d0683da2db950feab55f438a1a2fb338fa5be3371

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3f5394daea4a8c91c7bab949435d2848

SHA1
b66a75af71fe79c1adc1a22e001a0f7f7f10ce97

SHA256
477fe0c6ae5f1b31c5aff0212fa69e3dd879bb0b81f1ee63971d253d55aa8112

SHA512
ba2a59d669e50f793239890ca6693fb30c8b284edfd61a2c54f474137b5cbc195cf3f441d5fb4def9114b422d5548dd364e9da9962f7ee5bfe0fe1f07cd8aa36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4fb1ce2f330bab4e5a262dd64c6f6f17

SHA1
9d978ada082e7dfad88bee4c73c8e3052fd87a2d

SHA256
943a048331daf6d33cdc36e0d01f68ae86295cb80f7611508620567775efa3dd

SHA512
9ff82448cbd6086584fd8f328d4caae65ed53547f660628618fb993a3c6aacf0e8658c08f60a8a586302fd42c491183096021f97e21ee63bfe90daf65d7df100

Download Submit