c819048f13c145fe19bc756cd4043c5ccf9bd25a61d9146fde602e24d8e5f104

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 10:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

398b13b9959f53a5eb15d32936328391_JaffaCakes118.html
Size

33KB
MD5

398b13b9959f53a5eb15d32936328391
SHA1

11d9027b32aa3cce34a1a0c2ff51a3df586b51d4
SHA256

c819048f13c145fe19bc756cd4043c5ccf9bd25a61d9146fde602e24d8e5f104
SHA512

6c83180ee7347457be36627373449b64db12d8d6c971f9c6ad89ea888cd47cee7108cceb561bf251dd01802b1b6b22448eee47b6817c668ce3f4064430a97f0a
SSDEEP

768:UbtKPvypgiLu0eILo9SiL4vb/6FXz29v4d4R/U:73yppLu0eI0SiL4z/6FXt4RM

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3496	msedge.exe
3496	msedge.exe
3940	msedge.exe
3940	msedge.exe
220	identity_helper.exe
220	identity_helper.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 2000	3940	msedge.exe	83
PID 3940 wrote to memory of 2000	3940	msedge.exe	83
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 2296	3940	msedge.exe	84
PID 3940 wrote to memory of 3496	3940	msedge.exe	85
PID 3940 wrote to memory of 3496	3940	msedge.exe	85
PID 3940 wrote to memory of 928	3940	msedge.exe	86
PID 3940 wrote to memory of 928	3940	msedge.exe	86
PID 3940 wrote to memory of 928	3940	msedge.exe	86
PID 3940 wrote to memory of 928	3940	msedge.exe	86
PID 3940 wrote to memory of 928	3940	msedge.exe	86
PID 3940 wrote to memory of 928	3940	msedge.exe	86
PID 3940 wrote to memory of 928	3940	msedge.exe	86
PID 3940 wrote to memory of 928	3940	msedge.exe	86
PID 3940 wrote to memory of 928	3940	msedge.exe	86
PID 3940 wrote to memory of 928	3940	msedge.exe	86
PID 3940 wrote to memory of 928	3940	msedge.exe	86
PID 3940 wrote to memory of 928	3940	msedge.exe	86
PID 3940 wrote to memory of 928	3940	msedge.exe	86
PID 3940 wrote to memory of 928	3940	msedge.exe	86
PID 3940 wrote to memory of 928	3940	msedge.exe	86
PID 3940 wrote to memory of 928	3940	msedge.exe	86
PID 3940 wrote to memory of 928	3940	msedge.exe	86
PID 3940 wrote to memory of 928	3940	msedge.exe	86
PID 3940 wrote to memory of 928	3940	msedge.exe	86
PID 3940 wrote to memory of 928	3940	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\398b13b9959f53a5eb15d32936328391_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff2ca46f8,0x7ffff2ca4708,0x7ffff2ca4718
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,16728789023676206126,14749853019732077665,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,16728789023676206126,14749853019732077665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,16728789023676206126,14749853019732077665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16728789023676206126,14749853019732077665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16728789023676206126,14749853019732077665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,16728789023676206126,14749853019732077665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,16728789023676206126,14749853019732077665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16728789023676206126,14749853019732077665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16728789023676206126,14749853019732077665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16728789023676206126,14749853019732077665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16728789023676206126,14749853019732077665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,16728789023676206126,14749853019732077665,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4984 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e0412f70c33564b641cce0ad01719bf1

SHA1
3efd0676651067b7c0045f81b69302daef7d51a6

SHA256
0a83719525fd70239e876e6fc944713298fd56c3441f77d2c3b3bef66baf5f79

SHA512
a7fb568296b0bc4328a2d312ed08d3cd5065921ba0dcb216a48959dc5d7ad6615e12b5e985fc95c0597949527520228aa9bc186dc4ea872d5fb109ea887a0674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
37ac6ae2e8afc1189c5d26fd9ebdbdfc

SHA1
f4f1e9bcabcb10cdbfeb88968a72b6c76e582c01

SHA256
d7a119c8a5319b3b2c31e86eb964522de6a21e82ae0d2e2891f5011ca0445345

SHA512
c88ad88c6ab1be9c5bab596b1635661a9d9a0aa1d638b43d06a8b7e91620b293236cb78b96011714fe0ff7d1f3699a0a4750e90b626c4c508f9ee4a7e4e33468

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a59952082c8b3b6ea7642c345f4bff33

SHA1
f3ef1c2ea91c425cee0967a9f726b3c8608b6bc6

SHA256
19880bec579f35c4835159ec81fabbc30e82ba878a9b0b3f24f14e54fc271c30

SHA512
91337cb4ea4249a0ba4cf7f5475a86c07f46dfc2e769cc4520c6be3e0e98560acf81f68a407034181aca29f7b233de6aa11578c7257e7350c73c30cbf907414e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a35157aab3b0a6da5219aec54516d0b6

SHA1
4b5fc3523950f913254673430855aa9d79d586b2

SHA256
39e560d88970ee5c34628ca90c17f5652de5b42ce93d391bd8699df53993b7f1

SHA512
c29f8fb2e3d08e2494ec61c1ec219e2815e2646623ddd95cee53596c139673975a50988ae85723dca53de250e18f186573e149d251a7733e3d81206cc6b43821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
39967ca681a3904d2b7620a50fbbdc68

SHA1
0cedd84317ed2bf1f015be210ffb38326d56a5a0

SHA256
32ca9084f5ca0d73a274e6ae4f40b3e1c78507163fa78ac57bc4baba4c339f45

SHA512
ac327d30077d05f7ea6bc3e2291eb0f7a2d7039fd375cafeb803d1656651bbb3d70de7494e9c84062d2b33d070000303387d4174144c63b542bda46c53a74680

Download Submit