7e1e7ebb6e934cb13873039924bc80da5cfa85bd9b4f31a239623ebfac936d11

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 12:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

46416922e505d7f85dc6a9f9230bc060_JaffaCakes118.html
Size

35KB
MD5

46416922e505d7f85dc6a9f9230bc060
SHA1

9bfbdf43375d2059879b8f29090e0f1fb7fb99b5
SHA256

7e1e7ebb6e934cb13873039924bc80da5cfa85bd9b4f31a239623ebfac936d11
SHA512

6fbf4c11953e3885f9fbecd4a3368fce615c3fb0a53d5df778f047f199e3c97e8449362972ebbc1a51131f7b9dda3027a1a775b6de93074000c2a7e055248e18
SSDEEP

768:xSFQW81D4RA+vEOjz6rdG2Gil54RZfPGnf3Gu34a8i6781DdRA4vEOjq6h8aRlRY:EFQW81D4RA+vEOjz6raAhIaLC81DdRAF

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1428	msedge.exe
1428	msedge.exe
2184	msedge.exe
2184	msedge.exe
2436	identity_helper.exe
2436	identity_helper.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 1168	2184	msedge.exe	81
PID 2184 wrote to memory of 1168	2184	msedge.exe	81
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1952	2184	msedge.exe	82
PID 2184 wrote to memory of 1428	2184	msedge.exe	83
PID 2184 wrote to memory of 1428	2184	msedge.exe	83
PID 2184 wrote to memory of 2656	2184	msedge.exe	84
PID 2184 wrote to memory of 2656	2184	msedge.exe	84
PID 2184 wrote to memory of 2656	2184	msedge.exe	84
PID 2184 wrote to memory of 2656	2184	msedge.exe	84
PID 2184 wrote to memory of 2656	2184	msedge.exe	84
PID 2184 wrote to memory of 2656	2184	msedge.exe	84
PID 2184 wrote to memory of 2656	2184	msedge.exe	84
PID 2184 wrote to memory of 2656	2184	msedge.exe	84
PID 2184 wrote to memory of 2656	2184	msedge.exe	84
PID 2184 wrote to memory of 2656	2184	msedge.exe	84
PID 2184 wrote to memory of 2656	2184	msedge.exe	84
PID 2184 wrote to memory of 2656	2184	msedge.exe	84
PID 2184 wrote to memory of 2656	2184	msedge.exe	84
PID 2184 wrote to memory of 2656	2184	msedge.exe	84
PID 2184 wrote to memory of 2656	2184	msedge.exe	84
PID 2184 wrote to memory of 2656	2184	msedge.exe	84
PID 2184 wrote to memory of 2656	2184	msedge.exe	84
PID 2184 wrote to memory of 2656	2184	msedge.exe	84
PID 2184 wrote to memory of 2656	2184	msedge.exe	84
PID 2184 wrote to memory of 2656	2184	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\46416922e505d7f85dc6a9f9230bc060_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe986b46f8,0x7ffe986b4708,0x7ffe986b4718
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,2158352417456393203,16995270435441136508,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,2158352417456393203,16995270435441136508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,2158352417456393203,16995270435441136508,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2158352417456393203,16995270435441136508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2158352417456393203,16995270435441136508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,2158352417456393203,16995270435441136508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,2158352417456393203,16995270435441136508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2158352417456393203,16995270435441136508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2032 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2158352417456393203,16995270435441136508,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2158352417456393203,16995270435441136508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2158352417456393203,16995270435441136508,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,2158352417456393203,16995270435441136508,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
572B

MD5
35a27a6bd6393a941907aeb8a5febb7d

SHA1
e0d45142c736ea94756712317379869506c14afc

SHA256
9c2035bdffd340cb5f6a36767b04f1c151419548cebdc49058a575810a84f54b

SHA512
76a28a2a65ec2ef414db8d93486fc49150c6918624fe8f7e336b260ea37eb4b91f5338933c1bf98c29c8e19d19b50154f5a54b1b66c59b0b71656e068ff5754a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e751c4731ba914c78545d7bd5a48d58a

SHA1
ff6e502c2f752478f28392ceba10f653cf38bc26

SHA256
153c71ec455d32d9f7c6c9edd82b267ea73010cd1282ed35a040c7ca573eaab0

SHA512
7ceb5bc1092e0281659a8727985e550071b638ac123c966d60cd7ac00c0c873ecebb44326e36c83d6210717c412d56023fb8460dc5dc46ae6c682a5466b68d82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b286a17ccf71ce7a390c23d2a52bf02a

SHA1
78b3b4036f854a3163acc0c4ef1b20fb780b8760

SHA256
cfc2654a2d003009ca32604abedb906d762b32c559f58590849ac31bc54771b7

SHA512
0ad9b67c7423f21a40add2a48c95a5ac4c8aa21122e04cbb5f99728408d0700f92fb0f52bff68ed0ada4ecbe50b084553a5795eca75cdb9602195220511722d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d72954b827b9f8f8a59cb08bf098294b

SHA1
feb59b907491f1d05a83c9af21724d213baf35c9

SHA256
56423bc90dae19d359e85f26f902372edfb12c9162fa358ed05b781b6d568819

SHA512
68715821a9622383432df2532d55acd5595f076a5e68f1313aeb48bf0fe0f13a1fee9bcecaf735d86104948a9df0cc9b0e3c1ff4023911b3b2693d3ac9afe035

Download Submit