a23035399be0f00bf7baaacf24afb6846169253bcf4af243e9a5d2b6d192d8be

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 12:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f215c979f82fa847ead6c292742b95b_JaffaCakes118.html
Size

108KB
MD5

2f215c979f82fa847ead6c292742b95b
SHA1

251201a785cc058b84d350c07706d53a3a70665d
SHA256

a23035399be0f00bf7baaacf24afb6846169253bcf4af243e9a5d2b6d192d8be
SHA512

43552aef5c089a23fea89c6e989846a77f104592779471f70d988db973ffa3c5be7dfd32ee3636171d0148b8f3837774848588bef06690201b3ee6f5222e6ca7
SSDEEP

3072:grI6Rp4BhULodEh0RMQCat8aNTLQV8rj7OFntLqfDYh:16sCat8aNTMioh

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
1500	msedge.exe
1500	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 1560	1500	msedge.exe	85
PID 1500 wrote to memory of 1560	1500	msedge.exe	85
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 2672	1500	msedge.exe	86
PID 1500 wrote to memory of 3372	1500	msedge.exe	87
PID 1500 wrote to memory of 3372	1500	msedge.exe	87
PID 1500 wrote to memory of 3624	1500	msedge.exe	88
PID 1500 wrote to memory of 3624	1500	msedge.exe	88
PID 1500 wrote to memory of 3624	1500	msedge.exe	88
PID 1500 wrote to memory of 3624	1500	msedge.exe	88
PID 1500 wrote to memory of 3624	1500	msedge.exe	88
PID 1500 wrote to memory of 3624	1500	msedge.exe	88
PID 1500 wrote to memory of 3624	1500	msedge.exe	88
PID 1500 wrote to memory of 3624	1500	msedge.exe	88
PID 1500 wrote to memory of 3624	1500	msedge.exe	88
PID 1500 wrote to memory of 3624	1500	msedge.exe	88
PID 1500 wrote to memory of 3624	1500	msedge.exe	88
PID 1500 wrote to memory of 3624	1500	msedge.exe	88
PID 1500 wrote to memory of 3624	1500	msedge.exe	88
PID 1500 wrote to memory of 3624	1500	msedge.exe	88
PID 1500 wrote to memory of 3624	1500	msedge.exe	88
PID 1500 wrote to memory of 3624	1500	msedge.exe	88
PID 1500 wrote to memory of 3624	1500	msedge.exe	88
PID 1500 wrote to memory of 3624	1500	msedge.exe	88
PID 1500 wrote to memory of 3624	1500	msedge.exe	88
PID 1500 wrote to memory of 3624	1500	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2f215c979f82fa847ead6c292742b95b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe4,0x108,0x7ffd6d1046f8,0x7ffd6d104708,0x7ffd6d104718
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,1385533421000144183,15573282366823375797,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,1385533421000144183,15573282366823375797,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,1385533421000144183,15573282366823375797,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1385533421000144183,15573282366823375797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1385533421000144183,15573282366823375797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1385533421000144183,15573282366823375797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,1385533421000144183,15573282366823375797,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2840 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
34b8d85b676cfc26ec052c778f64a8e6

SHA1
df4cb5ce0619328a3a24197c0812c240d6a8b3c0

SHA256
3a1f7bbe64b4f7ef8cce21669a382c4cd76d2c331c8e3f55447b33cd3a06a88e

SHA512
cb99580a02c883b37c33af6cf64577a65f9b4ed046373700340fae221c156b3be5037d611eefc87c5807a34bf0b01de2293bc3bfdd814cdd0922e9b9c86c9061

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
0a9e1e3fbd80bea76749e52b415a7f36

SHA1
96fb8fce59b4f81207f0fc5f4b6c167619839da1

SHA256
adbbf08c7e520b1506a6a7fb3e1a4c987fb4f0bc9c1682e549b1274d5ea5ea8b

SHA512
93c45fe3c3695efe996a5f4a674dc5c02e4c68195d5e81bb5ad8fcb84c25c60b490f59ed744fe1bd0947fc966375e05c9778e57b15cd9fac621d3f71c1c070f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2b41088478fa4d23dc26f641a4c8d079

SHA1
d779e020f1ce1e8e6d72c762bf9be5c636752ca6

SHA256
9f16848c92bd7f8dee43dbabd4523aab16643bbefc6db9c6969f0fbcb02b17e3

SHA512
521e79fbcff8d12e8b765071fff06a799b584480a8802aef130d387b0cb46ad9d83a5455aedead6778c3913859262fa4512846c4ea1d74e648b4b9ac4914114a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a06b364006dcab3a2d5d0e0241206715

SHA1
3804777e6633b0ce22ba493dbf1af224aa6135d2

SHA256
8b22849dc4fc5c12f8039dbb154c520a88ce9ff7a96e563c2b88510867fdf125

SHA512
a0715a1cd56ae4910fbd03c063bcbc9bc5e2b9c9794979aea53b3edc62958962b734f9c3cf7ed279ecc08bac1191767a35521601bbdb335a26ec36b03e8ebf0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
229250e4216198d9af4e4dc130415c3c

SHA1
b70946ecff1a5edae6c197da7e2ae5639dd42270

SHA256
2d3369d60c3b8dfd2030b520cacda11e0c022780ebcd43d6c67912a288303bf4

SHA512
cdb4e19443ffa6ad1f92796e25b796f9c9690ab9c87dc16f3c04a0e57d192df7e36350057269cc3388765c95d1749d0b32e8df5fadbaa52ebabbe2b347cc1463

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
26300852d8d58869e8f23f1a6edd741d

SHA1
b29243ba283a8f3e9b7802a351f5967204750166

SHA256
a21634f7c8fd8cca5b6fdcac9bfd4636b318e864764ac321af71e736ba222d20

SHA512
652ee81b74668a918c851f384550822b904f77a193c833472ef5ffba61984cc5e2b48efdb7edccd7310d1cf90b66f500d4aed794e0c5d0623edbcca5bc2cba59

Download Submit