b45b167bac9c04781b060c321b72e3f26c21eff07c15531f82f553cc2e6ccd9f

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 03:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

493555d8efc88306acfa04b240ddf6fe_JaffaCakes118.html
Size

15KB
MD5

493555d8efc88306acfa04b240ddf6fe
SHA1

d330e6c776bbbd7d5cba7eaacaa56eea417d0f60
SHA256

b45b167bac9c04781b060c321b72e3f26c21eff07c15531f82f553cc2e6ccd9f
SHA512

9831121f3b0bec4578734fd31e310291a95362fbb0fee6bc9faef6338d219a7b4a8c4051c675bd5b57f1874d22da3a070cd16603586e734e5e177c5c5e372092
SSDEEP

384:G709JbUZDUDqlfQYVeoh4K208Hi9zcee1ikTPM9wH:m09JAZA+lJeoh4K20rlcee1VTPM9wH

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4324	msedge.exe
4324	msedge.exe
2260	msedge.exe
2260	msedge.exe
3796	identity_helper.exe
3796	identity_helper.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 4764	2260	msedge.exe	82
PID 2260 wrote to memory of 4764	2260	msedge.exe	82
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 3280	2260	msedge.exe	83
PID 2260 wrote to memory of 4324	2260	msedge.exe	84
PID 2260 wrote to memory of 4324	2260	msedge.exe	84
PID 2260 wrote to memory of 2560	2260	msedge.exe	85
PID 2260 wrote to memory of 2560	2260	msedge.exe	85
PID 2260 wrote to memory of 2560	2260	msedge.exe	85
PID 2260 wrote to memory of 2560	2260	msedge.exe	85
PID 2260 wrote to memory of 2560	2260	msedge.exe	85
PID 2260 wrote to memory of 2560	2260	msedge.exe	85
PID 2260 wrote to memory of 2560	2260	msedge.exe	85
PID 2260 wrote to memory of 2560	2260	msedge.exe	85
PID 2260 wrote to memory of 2560	2260	msedge.exe	85
PID 2260 wrote to memory of 2560	2260	msedge.exe	85
PID 2260 wrote to memory of 2560	2260	msedge.exe	85
PID 2260 wrote to memory of 2560	2260	msedge.exe	85
PID 2260 wrote to memory of 2560	2260	msedge.exe	85
PID 2260 wrote to memory of 2560	2260	msedge.exe	85
PID 2260 wrote to memory of 2560	2260	msedge.exe	85
PID 2260 wrote to memory of 2560	2260	msedge.exe	85
PID 2260 wrote to memory of 2560	2260	msedge.exe	85
PID 2260 wrote to memory of 2560	2260	msedge.exe	85
PID 2260 wrote to memory of 2560	2260	msedge.exe	85
PID 2260 wrote to memory of 2560	2260	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\493555d8efc88306acfa04b240ddf6fe_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff95ffe46f8,0x7ff95ffe4708,0x7ff95ffe4718
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,15505819593909810892,9673280043276253978,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,15505819593909810892,9673280043276253978,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,15505819593909810892,9673280043276253978,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15505819593909810892,9673280043276253978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15505819593909810892,9673280043276253978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15505819593909810892,9673280043276253978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,15505819593909810892,9673280043276253978,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,15505819593909810892,9673280043276253978,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15505819593909810892,9673280043276253978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15505819593909810892,9673280043276253978,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15505819593909810892,9673280043276253978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15505819593909810892,9673280043276253978,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,15505819593909810892,9673280043276253978,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4752 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
8dbcdba7fce593249947f5cdd799033d

SHA1
e8575ffb261cc83827796bfb70c91782793a3ac5

SHA256
29f1a32ec3efe986afd6768ccde734614821ffc6d7848e5d16dfaadc3b78e121

SHA512
e39a489c833c164d663f54cf2faaf81397d27c6173c69830346e489b9f28bab21afbb2713621d779a54a9923689946af4ef030cf7de0a68b14c014a80002aa40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
487cbf0217ed4d618ef0411dd6a92308

SHA1
58fcf8e13d24c03a374f71b21778518a57a10fc1

SHA256
92facbb6b9827800c9417bc8eba52aa8fb37017c0d8faadbb4c3c13447f49786

SHA512
74b3b905f95840b63b9ed4a3446157bb33604714bc27703f5404d1b67cdb5c328718e6750739fa7598f6d2d7bf9dac693792da7a41451183af2e7b881b544f03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7a2b15c0fc79276a216d43a8015ea30d

SHA1
88858e9abea5728edc4e684cd39edfbe4e51dd34

SHA256
aa381f9e0f68cc2202e4b44d0d2624a93a1f23a45b9261141ea8599bd4b1a423

SHA512
5c6fe43f606a1cd43dd0751311bdd429065422ed8cb7c0d852ee3837ea8f063b7616a7d21c9e32fa03b324596f2881bef1814f0415b715c130903a2b94010461

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
071af8c6bbbdc56ddf42017489749d40

SHA1
6460c60b2f9543b830b68a1a07108c4228018e2f

SHA256
c597681b507782069271f1f5d7fc4924e24701d8b08dbca58350579a64c5c10e

SHA512
74ac4c9d5cbffa0345db6139256875b2067b19d82d913cc5e89202a61a563c7dd047c8f73aeaa9b44a1916d0d7f03902ead3c1b6331c12cce25d1ab459537db2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
db057d362b7d6a552a92e8973962380e

SHA1
a214e39bea46e9b71a9c041da2bb369ee089627e

SHA256
baf1222149da7ad189081d1c293544bba2064fc9bade004e5c82991f62bc8685

SHA512
48dc949ff49cf70a3cfe05dd491c707a2d32a9604d524bef9757f70df3812fb1c10cfb2b212fa3f7d82e50633d4dcca1518c14bb9a683bc97f057d92ff6839e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5241a4b38142fc22e7b9ab93786a546c

SHA1
c4f219f8c622ca25e96b0c1ee0c615e806a4fcd2

SHA256
93d50aafcc1f4f4b728965158d3a506a4277006a09df3f9bd3f0957ea97498e2

SHA512
85e039f07d4c013f11c2936b10b807cff4726178bd3d741fa5856d31e3257b3d31526c7f028dd36016642bf73468d7d6c57739cec63423fe392b683d1dc6de2d

Download Submit