b8a81502ae500dae366726bc3c81ed8cd617a866d25cad51deaccb38e27449e7

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 20:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c093a7f7ced660edbd0ea0fdf5b3582_JaffaCakes118.html
Size

17KB
MD5

3c093a7f7ced660edbd0ea0fdf5b3582
SHA1

1f5e9cd767f081c8c3cbe27e3fd777bdc9052aad
SHA256

b8a81502ae500dae366726bc3c81ed8cd617a866d25cad51deaccb38e27449e7
SHA512

0fb06b6d4f7989021321845b44973d20e762db3280a486b6fa15cc8c75c3cf547d0442d88a621efdfddf8ffbffd02a5ca09fc83f16afd008ebd1da939d8b0518
SSDEEP

192:SIwrrTTCQiOQTTxHoFXpndJugLFJALlOlbvuDHwsXP0fmpbXRmkUM+4hvT:SIuCJxHsZndJtJA06DHwUs2bXsd4hvT

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
2360	msedge.exe
2360	msedge.exe
2444	identity_helper.exe
2444	identity_helper.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 5024	2360	msedge.exe	82
PID 2360 wrote to memory of 5024	2360	msedge.exe	82
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 4144	2360	msedge.exe	83
PID 2360 wrote to memory of 3240	2360	msedge.exe	84
PID 2360 wrote to memory of 3240	2360	msedge.exe	84
PID 2360 wrote to memory of 3016	2360	msedge.exe	85
PID 2360 wrote to memory of 3016	2360	msedge.exe	85
PID 2360 wrote to memory of 3016	2360	msedge.exe	85
PID 2360 wrote to memory of 3016	2360	msedge.exe	85
PID 2360 wrote to memory of 3016	2360	msedge.exe	85
PID 2360 wrote to memory of 3016	2360	msedge.exe	85
PID 2360 wrote to memory of 3016	2360	msedge.exe	85
PID 2360 wrote to memory of 3016	2360	msedge.exe	85
PID 2360 wrote to memory of 3016	2360	msedge.exe	85
PID 2360 wrote to memory of 3016	2360	msedge.exe	85
PID 2360 wrote to memory of 3016	2360	msedge.exe	85
PID 2360 wrote to memory of 3016	2360	msedge.exe	85
PID 2360 wrote to memory of 3016	2360	msedge.exe	85
PID 2360 wrote to memory of 3016	2360	msedge.exe	85
PID 2360 wrote to memory of 3016	2360	msedge.exe	85
PID 2360 wrote to memory of 3016	2360	msedge.exe	85
PID 2360 wrote to memory of 3016	2360	msedge.exe	85
PID 2360 wrote to memory of 3016	2360	msedge.exe	85
PID 2360 wrote to memory of 3016	2360	msedge.exe	85
PID 2360 wrote to memory of 3016	2360	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3c093a7f7ced660edbd0ea0fdf5b3582_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9278146f8,0x7ff927814708,0x7ff927814718
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,8020307863142975826,14043823497445396245,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,8020307863142975826,14043823497445396245,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,8020307863142975826,14043823497445396245,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8020307863142975826,14043823497445396245,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8020307863142975826,14043823497445396245,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,8020307863142975826,14043823497445396245,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,8020307863142975826,14043823497445396245,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8020307863142975826,14043823497445396245,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8020307863142975826,14043823497445396245,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8020307863142975826,14043823497445396245,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8020307863142975826,14043823497445396245,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,8020307863142975826,14043823497445396245,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5392 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
e06e8c3fda6fee314c2622895936e956

SHA1
165f906dd4dda97f9432ea9f834398ebceb4a4a0

SHA256
3415b4cded871d06e1a0bc74d7dad43b040a9f7633d093156ea46565084fba2c

SHA512
27605d09d94dffc862880a3e8ce5770d29ecb4102b09120d30d2d7df06028f480a96610ce754ed7a24d579b1b1b39819a1f0e65d8c255b5bb7225025025f54b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
344B

MD5
18836e68152c6c8d7c9f998061bd66d3

SHA1
c270d41d9a540db66940c92cc94146dea1731708

SHA256
679a1e0e0d1f14421d3ee86fbd267933d44af7ae7fee931ee4584409fb62d44f

SHA512
9e4a2d4b60a0c615296dcae2bdd7e922ddb390431b56007d562960719303e49d1a04efae9ed0b1cbac24a5b2ebeeb2ee0a41477034a61e786df95dd41dee202a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
260c2f58b3c403560b1faf32485e1c74

SHA1
af8bbdbe259e2da45d64d1e1c7c751cec3353fd3

SHA256
5c3eaaf98fa932fb6638b306bcf2753912aa5f762d25cf4e570dc00f3c979676

SHA512
94738483dcf4ae2b23f240d49ab07b17de7ad440ee4244c59c4809e0c17ebbe94e2905064265f74e3fa9b8683df0d50b1c4ae4fefeea27f31746aa75aaa2db35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bdadf28dd152876d338ef3f894ff47fe

SHA1
c3dd4ee30e5012894eddaa8f9615b789d8e2a775

SHA256
4f9a78e3a311afc11b45154ca24299470cf94d81691e1975ba8199043a94417f

SHA512
353af5a67c27d0c58f07c639da4a66643728760e78ea5290c56eeaa68affb780ab7957454d408db808cd3b1c22a59a2ed9e17622434a2bd505471973a2e4265e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c9f20720e2e87625406ef55f6bc8766f

SHA1
95e23fddeada58bdec864993528ef1ba4419f8ed

SHA256
ac84694c43bb4c91c8ef7ec7eb9fcdbdd04c59af09d1c5d9e748a0b6beaefdef

SHA512
1a8cf2e5b448aa11d23fb84c609533667ffbec39316056fabae12e0dedd2fd1e2655e529dde42b4a666278a1ea3e5102d0e971dd3ef14fd16780e9e09e055042

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4b3e9e0baa2a745ce222847ec9c7dd7e

SHA1
30730257619a5f18301fc5cb0caa9d71cc35d078

SHA256
c00202aef4c015baa367a2a003873f31a607e19adf3becc7abb9a1753c65932f

SHA512
265e1b525f5ef82f2298a366d1fcb30723cf0b8b8d6ca3980777e38feb73ef9fc6a9e835ac466197c4f9617a8cf2452864be4c6d2ede8b9190b4e464c4832b06

Download Submit