7e9a3931b8c186a5ddf7e141958a9ac0d1a65a77d5ac6da5761437b72279331a

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2a5e0bfbc76d3d2368e312e3dcf5f121_JaffaCakes118.html
Size

90KB
MD5

2a5e0bfbc76d3d2368e312e3dcf5f121
SHA1

c50742618b0e3d91ead5a9d44b19ad8fb387cdc7
SHA256

7e9a3931b8c186a5ddf7e141958a9ac0d1a65a77d5ac6da5761437b72279331a
SHA512

5466bc02dcf05462c1b81fb4276a9340381a833381a3e83a0575e5f66c564aacd086284db099995a61f633c121729958ea6583c2ecdb85a5fbd93a5ad13868c9
SSDEEP

768:STmWZs5zfzEBH3jX2qba+p4WLZdD5b/XFHme:STmWqFfzEBH3jbbaNWLZjXFGe

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2892	msedge.exe
2892	msedge.exe
3252	msedge.exe
3252	msedge.exe
2664	identity_helper.exe
2664	identity_helper.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 1556	3252	msedge.exe	82
PID 3252 wrote to memory of 1556	3252	msedge.exe	82
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2164	3252	msedge.exe	84
PID 3252 wrote to memory of 2892	3252	msedge.exe	85
PID 3252 wrote to memory of 2892	3252	msedge.exe	85
PID 3252 wrote to memory of 1176	3252	msedge.exe	86
PID 3252 wrote to memory of 1176	3252	msedge.exe	86
PID 3252 wrote to memory of 1176	3252	msedge.exe	86
PID 3252 wrote to memory of 1176	3252	msedge.exe	86
PID 3252 wrote to memory of 1176	3252	msedge.exe	86
PID 3252 wrote to memory of 1176	3252	msedge.exe	86
PID 3252 wrote to memory of 1176	3252	msedge.exe	86
PID 3252 wrote to memory of 1176	3252	msedge.exe	86
PID 3252 wrote to memory of 1176	3252	msedge.exe	86
PID 3252 wrote to memory of 1176	3252	msedge.exe	86
PID 3252 wrote to memory of 1176	3252	msedge.exe	86
PID 3252 wrote to memory of 1176	3252	msedge.exe	86
PID 3252 wrote to memory of 1176	3252	msedge.exe	86
PID 3252 wrote to memory of 1176	3252	msedge.exe	86
PID 3252 wrote to memory of 1176	3252	msedge.exe	86
PID 3252 wrote to memory of 1176	3252	msedge.exe	86
PID 3252 wrote to memory of 1176	3252	msedge.exe	86
PID 3252 wrote to memory of 1176	3252	msedge.exe	86
PID 3252 wrote to memory of 1176	3252	msedge.exe	86
PID 3252 wrote to memory of 1176	3252	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2a5e0bfbc76d3d2368e312e3dcf5f121_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84b6d46f8,0x7ff84b6d4708,0x7ff84b6d4718
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,13245154987248753033,7479053591014077558,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2260,13245154987248753033,7479053591014077558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2260,13245154987248753033,7479053591014077558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,13245154987248753033,7479053591014077558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,13245154987248753033,7479053591014077558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,13245154987248753033,7479053591014077558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2260,13245154987248753033,7479053591014077558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2260,13245154987248753033,7479053591014077558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,13245154987248753033,7479053591014077558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,13245154987248753033,7479053591014077558,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,13245154987248753033,7479053591014077558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,13245154987248753033,7479053591014077558,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,13245154987248753033,7479053591014077558,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4636 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
47c206db2c316a971319faf844a35595

SHA1
ec861cbd8a63cdd7aea8d83082991c2e58d810ae

SHA256
1c6736572429b4e3cb821db4aed0f9075fbc92034a97e00e40c08bf502017b70

SHA512
d16b225b3ef390a302ad799e91e1ea7e4270bc50f9ad938e847e1c5216a65252ccb6c98d98c09cf4eaaad6bc573be0a03d699871009204a67473361eb31918ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
324B

MD5
ff17505b02d988cd94ac6b26bf718018

SHA1
69f3ba890950867b858fb4c1bface08058ddc38d

SHA256
d0718af13cae3e6a7b66a86da4da75938d0d6b84bf5f9039f812d588ab9a02d4

SHA512
c6570711fc94751163c9a7b8f9932d51b7e472e86707ad8a651f76814408b01e00a0f4710d680f9b168c510bfb527dc3106a254e0747f3254afadbfc73737984

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b6278257f2f0ec5bb4ded64030e49d6f

SHA1
ec5f0ec1fe80a5c3a13953cd586fb22106edd055

SHA256
da0528957c7792405969c50b093a0609877274890e043a171ff6a72f02777e31

SHA512
8eba15f45b23995dd9d28eee2d8e241fec9de5ebde2d0a89c33f2c8a124437bff631c03b794791c71b0ec3396fb1874c0a585389ab2c11b1ee5c991c6a50ed54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2a9f83a037698dbb39374d6de9ca88be

SHA1
aaee5c9a63bef1366b872f1797fe86b410280a57

SHA256
e3b7355f628bb6dfe2e13a5c716cde04fd0eb06a4c224ef3ada9a7b8d15881be

SHA512
b63a452545c3b410459f4df9f9e7cf469d82112cacc04714049ae22a42933e4f5f74cce0af8e60556cab8a6e1122e761e417ab77f5af2550f5ae6106b092212a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
955f41569580225924e82baf22b469f4

SHA1
cc20c7ba5334512a672b150508bd8b849b0de6d0

SHA256
dbf22eae8712b1d71defc0fa41f48c8ff10d9db7e96552a22be0993278d4e82c

SHA512
d5e789d1ad764146a235daf9555e6459f001f7f7556aab620191df49fb645b8572a4bede2a08b81a7332aa1273861bfc17720c679e0388065fc33db0c5710140

Download Submit