d72756e9fa0c25cc3d6af886fe5a59a3c712badabfbf6f7be4f22d75d0f7080f

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 04:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

497a7d5dfde1358d92a31bf01f277bac_JaffaCakes118.html
Size

38KB
MD5

497a7d5dfde1358d92a31bf01f277bac
SHA1

c3df5749679b2ac4b2a8d9cd023f5f604e7a20f1
SHA256

d72756e9fa0c25cc3d6af886fe5a59a3c712badabfbf6f7be4f22d75d0f7080f
SHA512

d2ca480e3affda21493bb88960261ed447b2556304b7a1eacd8092b547a43f980e70a6072fc89ef64a9882201f69764b01edba09d569cc1a15a3f0b0375fe7a0
SSDEEP

768:gFobf1bVunb2vbyHCLE/F9bQDEPYwvoGe201JU4JxYAX2Vct4P:gFoZpunSmHCLETcDEPYwvYEWZG+KP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
1892	msedge.exe
1892	msedge.exe
4904	identity_helper.exe
4904	identity_helper.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 1984	1892	msedge.exe	83
PID 1892 wrote to memory of 1984	1892	msedge.exe	83
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 1256	1892	msedge.exe	84
PID 1892 wrote to memory of 4180	1892	msedge.exe	85
PID 1892 wrote to memory of 4180	1892	msedge.exe	85
PID 1892 wrote to memory of 4824	1892	msedge.exe	86
PID 1892 wrote to memory of 4824	1892	msedge.exe	86
PID 1892 wrote to memory of 4824	1892	msedge.exe	86
PID 1892 wrote to memory of 4824	1892	msedge.exe	86
PID 1892 wrote to memory of 4824	1892	msedge.exe	86
PID 1892 wrote to memory of 4824	1892	msedge.exe	86
PID 1892 wrote to memory of 4824	1892	msedge.exe	86
PID 1892 wrote to memory of 4824	1892	msedge.exe	86
PID 1892 wrote to memory of 4824	1892	msedge.exe	86
PID 1892 wrote to memory of 4824	1892	msedge.exe	86
PID 1892 wrote to memory of 4824	1892	msedge.exe	86
PID 1892 wrote to memory of 4824	1892	msedge.exe	86
PID 1892 wrote to memory of 4824	1892	msedge.exe	86
PID 1892 wrote to memory of 4824	1892	msedge.exe	86
PID 1892 wrote to memory of 4824	1892	msedge.exe	86
PID 1892 wrote to memory of 4824	1892	msedge.exe	86
PID 1892 wrote to memory of 4824	1892	msedge.exe	86
PID 1892 wrote to memory of 4824	1892	msedge.exe	86
PID 1892 wrote to memory of 4824	1892	msedge.exe	86
PID 1892 wrote to memory of 4824	1892	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\497a7d5dfde1358d92a31bf01f277bac_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe40aa46f8,0x7ffe40aa4708,0x7ffe40aa4718
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,1651151498529190745,7451432431692752777,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,1651151498529190745,7451432431692752777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,1651151498529190745,7451432431692752777,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1651151498529190745,7451432431692752777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1651151498529190745,7451432431692752777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1651151498529190745,7451432431692752777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,1651151498529190745,7451432431692752777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,1651151498529190745,7451432431692752777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1651151498529190745,7451432431692752777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1651151498529190745,7451432431692752777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1651151498529190745,7451432431692752777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1651151498529190745,7451432431692752777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,1651151498529190745,7451432431692752777,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\779d0265-e89b-40fb-b3db-18d42258f3c9.tmp

Filesize
11KB

MD5
71308d7286e0bb6bf96329ae405d3deb

SHA1
92ea499f24d4e14bbc24490b79a9b2e179bafde6

SHA256
326041d1285d633128cef89c8800abcd4df1a6027553ee05f911dff9fe11ab16

SHA512
de0fa7467dab243f6c635b796decfab6b429bf07c1c2f5e886b11cea5b398a8a94161f314ba8e17e5b74d63892ff186e9468e9c5709e840a21e52d48864e371a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
7ed13c1789f2e9da2b155a947eacb0a0

SHA1
373ac801f17a5ab237063d05ad782fe42be16834

SHA256
7222ac6f3df0941e3ad6c478d8fef47d21fa4e3d37db9716987cfd931c23afde

SHA512
cf1ce5f0b0dfa262960829736193a0fc79d6bfefbc9a768f7562a906d24352a1d05cc1f9334b6c6f7248dafe1fec5126c2f881ea195871d592f6b041c416cf41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
03a1c9778b52f83883c7177e782a22d1

SHA1
c704d2adad802f4132a4424022a73f57f30abc11

SHA256
db9c99e5b40f2efbd37950c07914b0a587041496990d9b0e2f99f86b1fb302ef

SHA512
bb24d4fceff9303f24303a86cd4b202c020f18174e98e2ae45e948665ded9ae9b9633cc866c8d0067dd6f23c5481952a719a484f288f8d6c60483cb2fe61d17a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
29a695dd4011544366d881ad4fe23dc0

SHA1
ac4ac719a1e88b312c78e2d1a1d95dedc187dd3e

SHA256
53122526f48ec50e7a32a56841bdf994362e03997ac3e510854064793ad882df

SHA512
189f6ed8c1af90e46b7fc2bdc2823db1118689895632f6a52d92e4d2e55878d786133cb37b6d195802806cd624b6b0e9b730a1f2cf586153b1a78668cb266207

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dbaf126c2e3d0281a78eadbc20fe90d3

SHA1
1109708f0036a60023365275d5f1fb2db329536c

SHA256
263c0c4f25304d51a8374926a5f67550acda5125dde0245abe436edc9abba927

SHA512
30192a24bc7ee48aa4635b761ae61e956713b99670c4afa1c8d2379bf983c7c7232f87818d3be51c7a381373b44431139d677235cff52a320c951eabb26306e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit