217c55c341272b8453cc1569578e13cc99d06a236720657e0b9a23968e8d360d

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 06:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2de73707796ac904070abe45df278775_JaffaCakes118.html
Size

211KB
MD5

2de73707796ac904070abe45df278775
SHA1

92c220c3f9e525fdeca633388fb910af879381c8
SHA256

217c55c341272b8453cc1569578e13cc99d06a236720657e0b9a23968e8d360d
SHA512

e62762d0c18782cf07b0fdee2d4b56f9c554cdac8ec1c553a5ad13a9d809e4862a68b464da1c1a37417de70445b67ca62464ceff17457d4cedee2e0afdbb7d61
SSDEEP

6144:/FtYYhjZY2XkSUl+AsMPZeXREVhiaizDQO3u:dtYYhy2Xx1AsMPZeXREVhiaizDQO3u

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3272	msedge.exe
3272	msedge.exe
704	msedge.exe
704	msedge.exe
3352	identity_helper.exe
3352	identity_helper.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 704 wrote to memory of 4804	704	msedge.exe	85
PID 704 wrote to memory of 4804	704	msedge.exe	85
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 2784	704	msedge.exe	86
PID 704 wrote to memory of 3272	704	msedge.exe	87
PID 704 wrote to memory of 3272	704	msedge.exe	87
PID 704 wrote to memory of 5024	704	msedge.exe	88
PID 704 wrote to memory of 5024	704	msedge.exe	88
PID 704 wrote to memory of 5024	704	msedge.exe	88
PID 704 wrote to memory of 5024	704	msedge.exe	88
PID 704 wrote to memory of 5024	704	msedge.exe	88
PID 704 wrote to memory of 5024	704	msedge.exe	88
PID 704 wrote to memory of 5024	704	msedge.exe	88
PID 704 wrote to memory of 5024	704	msedge.exe	88
PID 704 wrote to memory of 5024	704	msedge.exe	88
PID 704 wrote to memory of 5024	704	msedge.exe	88
PID 704 wrote to memory of 5024	704	msedge.exe	88
PID 704 wrote to memory of 5024	704	msedge.exe	88
PID 704 wrote to memory of 5024	704	msedge.exe	88
PID 704 wrote to memory of 5024	704	msedge.exe	88
PID 704 wrote to memory of 5024	704	msedge.exe	88
PID 704 wrote to memory of 5024	704	msedge.exe	88
PID 704 wrote to memory of 5024	704	msedge.exe	88
PID 704 wrote to memory of 5024	704	msedge.exe	88
PID 704 wrote to memory of 5024	704	msedge.exe	88
PID 704 wrote to memory of 5024	704	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2de73707796ac904070abe45df278775_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd5e5c46f8,0x7ffd5e5c4708,0x7ffd5e5c4718
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,11523819745325599538,12729362231453814988,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,11523819745325599538,12729362231453814988,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2708 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,11523819745325599538,12729362231453814988,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11523819745325599538,12729362231453814988,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11523819745325599538,12729362231453814988,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11523819745325599538,12729362231453814988,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,11523819745325599538,12729362231453814988,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,11523819745325599538,12729362231453814988,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11523819745325599538,12729362231453814988,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11523819745325599538,12729362231453814988,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11523819745325599538,12729362231453814988,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11523819745325599538,12729362231453814988,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,11523819745325599538,12729362231453814988,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
399B

MD5
4ec9fb261aaac96d82616a8fb5757ef1

SHA1
aaa9b9b09d81c5cf74e89d8299a46023e133b35a

SHA256
d1970a489379cd8455e7f5581378434dbe8cbdd31ce98a6c4274fd6a5f10874f

SHA512
c0759032f8cad88518dc7f01dfd3dcc0f293f98dced3d95c85e30b7bebf0ae7060aa98971c0407ed50653a7ad411f97859e583037a82fea9bf45e1657930a07b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7f6acb310e569d8982467bb0575a15c7

SHA1
18ad7a1fb7f504bed76584df358834e773751bdd

SHA256
edfbe4eb6e48264c641676bc5d7819434ff73365b26d4feb7424eb84d1962da6

SHA512
c389e8f0da0181013420c3fc0422d4bbbd0bb6bacf46cca7d42e486b6cd0dd293c9c08828b7c91571c7a17a0c72b88be0277a1cdd210576ba1f7aa076da1bd56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
718e6966dfa50146dbaa928ef1f8463c

SHA1
aa51a35d3294e77c4397539320bc1952a278ae8a

SHA256
0cc52e1dee109dda16ff389eb43d0925fe7d80f3170dd38b4e0a7ea6d35e2b32

SHA512
5c0ceb8918e44eada1602f53bef24234d05103500f553a493883d4cdd99409ab373b28d109c227a3b4ac831278b2f181550a9e33490611f4c44c3593adf70d74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a261adc241175874b7a69d8c22e99d07

SHA1
688da8cda1d537c6bfcbe764b9338e43d12ec1ab

SHA256
575d9d92e8a6b2a173c173c3295db822ea76260074173687707738a1c96e6a7e

SHA512
f43882f293f2c0d8376ae5bdfb9538611cd309b6b5c371738693157959eabcf531b0df4975ecef675fcf798e08b5bffca409aa6defe6624bc4e8ca6d30c27a23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1c3e2826985e490f101dbb01ff02bd38

SHA1
0749a886ba363d1c2bfa6108946a528c06eca74b

SHA256
c62ff8a6469c8f298aa6ce9c17072ffa18928e06b5505550e940c6860efea9a9

SHA512
57f45d7086158e4b9c60c13eb87c2103f679aea361a78957c49d4c56163243c85cb02fb25562aa4b68e9cc6653cd0d53a21ceec378c3c22909ea629acb2266a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584169.TMP

Filesize
1KB

MD5
81ae9914829de5685dfb090448bdf67a

SHA1
b5c362e13c584c9045f0bdf591b85e04cc0bcab0

SHA256
4cdfb5f73656bca30977fa9951e59dcde16f84345be1ba7eeb240ad50187d44b

SHA512
5556e46ded5a1fde52a35b4503cdcc2985828eee2539e009a8d2d45ff13a682212c3f85c4a2e03d1dc4161e6b93e5eb5af7b3eb0c1af39f29d07d042bf0265db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4e2f8e2cd20b8c609b25ffa4b2e9b739

SHA1
65d2b9823b77e1ea7419bbb5e60a96b62cfb03c2

SHA256
962c923efaa7b8ae39ccdf4a33d49c69c696671a95b521c466c50b2a9d77807e

SHA512
c9938d911290a3ec5438bfc1b5e1172027dfedc4b679bcc59920bd5d1ece0da2a05c4d2c1e19aae4a1b37c2ad369845c36c8a2dbe13e97d586c2af15d144874f

Download Submit