5be81df3ea8f1ffeec967a61894082b6819bcc123526d457591edade3f869faa

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

386e00dd96a3f0963dffd22afee5ea55_JaffaCakes118.html
Size

265KB
MD5

386e00dd96a3f0963dffd22afee5ea55
SHA1

7b192ce7bdf27f33fd5659cf91fd7d93b3402ee1
SHA256

5be81df3ea8f1ffeec967a61894082b6819bcc123526d457591edade3f869faa
SHA512

21f8fc522c572996911c926d38bb6ff517f510cd81777f0989d7289581542e936b99c942fb1dcad0666e70fb741760d547472d9054fd91b8be8858ac882ac8db
SSDEEP

1536:mgQeZjIzooYmdkpLLSSNNIIVVWWZZTTmmxx66ii99XXoobbWWaaggggiippppYYW:FZRsLJQfD3+fHqfNCA27

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
2328	msedge.exe
2328	msedge.exe
2868	identity_helper.exe
2868	identity_helper.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 3600	2328	msedge.exe	82
PID 2328 wrote to memory of 3600	2328	msedge.exe	82
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 2792	2328	msedge.exe	83
PID 2328 wrote to memory of 5104	2328	msedge.exe	84
PID 2328 wrote to memory of 5104	2328	msedge.exe	84
PID 2328 wrote to memory of 1064	2328	msedge.exe	85
PID 2328 wrote to memory of 1064	2328	msedge.exe	85
PID 2328 wrote to memory of 1064	2328	msedge.exe	85
PID 2328 wrote to memory of 1064	2328	msedge.exe	85
PID 2328 wrote to memory of 1064	2328	msedge.exe	85
PID 2328 wrote to memory of 1064	2328	msedge.exe	85
PID 2328 wrote to memory of 1064	2328	msedge.exe	85
PID 2328 wrote to memory of 1064	2328	msedge.exe	85
PID 2328 wrote to memory of 1064	2328	msedge.exe	85
PID 2328 wrote to memory of 1064	2328	msedge.exe	85
PID 2328 wrote to memory of 1064	2328	msedge.exe	85
PID 2328 wrote to memory of 1064	2328	msedge.exe	85
PID 2328 wrote to memory of 1064	2328	msedge.exe	85
PID 2328 wrote to memory of 1064	2328	msedge.exe	85
PID 2328 wrote to memory of 1064	2328	msedge.exe	85
PID 2328 wrote to memory of 1064	2328	msedge.exe	85
PID 2328 wrote to memory of 1064	2328	msedge.exe	85
PID 2328 wrote to memory of 1064	2328	msedge.exe	85
PID 2328 wrote to memory of 1064	2328	msedge.exe	85
PID 2328 wrote to memory of 1064	2328	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\386e00dd96a3f0963dffd22afee5ea55_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa05d646f8,0x7ffa05d64708,0x7ffa05d64718
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,4227970375296036267,5397509153427283906,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,4227970375296036267,5397509153427283906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,4227970375296036267,5397509153427283906,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4227970375296036267,5397509153427283906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4227970375296036267,5397509153427283906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4227970375296036267,5397509153427283906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,4227970375296036267,5397509153427283906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,4227970375296036267,5397509153427283906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4227970375296036267,5397509153427283906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4227970375296036267,5397509153427283906,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4227970375296036267,5397509153427283906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4227970375296036267,5397509153427283906,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,4227970375296036267,5397509153427283906,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5428 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
830B

MD5
79dce3335553c8cb2210309287863e56

SHA1
59d2073a207a67f33d4f1c9e0ea974af6226670b

SHA256
b4eb95326265065f5a404fdf9e0b6b8db6d638a06d2190058b0c58dcf8eb56df

SHA512
16491b7bf7548b32135f2f03faa4b107913da82f1a2eedc30996a969becac59800566732611f151c7a0f1a3a29b169124098ac9cea944067c1e544d177e7df52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5f92b45e925dff5b7f263265dc366d8e

SHA1
95ed8d1c3de198ec9a9ed628e0f90fa334bb67a8

SHA256
8ddde3c8b7d0c2f6bb2c3bfac7b3384863345ff0b36c5367ab62faff7cddf3c7

SHA512
c8643a1c7469b8e3672fca7bed2e9762e6ed62f04117db6ec3d85a4e5b4c7d7df3cc6f9d83681ad95c9dd8092284cd54eac1fb1d92f1845d013f1b78b6f51309

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
36373b0a5830878399b14deef7a2e5e3

SHA1
410030f1f0eaf4bc76637553c1dda4a26276f197

SHA256
523829c5e1386bab340a7bb84da8e5590ecebae63c3997ed7a622d077460c2b0

SHA512
ab65c111c2151cb97de11e8423e7c86ca9fb63b83c184bfc56236b744dc7d8e18a4731038c07e12f41707369001044e73300a44b546a419e531448a0976445ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4559b4022d501aa152d941badccd92c8

SHA1
de698b7f0f6ff925f9e9869e9e9c725946e0f102

SHA256
c0f7996834f2a16ffd3818d3dd360a12292b01cd98880ebc4a8cb82dc5a2b7df

SHA512
d2975b1459202862358b22ef7bce19d0ce787559cc4c8559bdf11dc1959fc7c804212befe3379995fa1131086993e3dd7fe98e4152aadd1a224d7cba345be62f

Download Submit