b1a5fdbb7c24f1b408a83267d418840fc8a4be805d2b6943784b5d1e791cb0f0

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4c25b7d8714a5e95e79fa477ca35bef5_JaffaCakes118.html
Size

31KB
MD5

4c25b7d8714a5e95e79fa477ca35bef5
SHA1

37033b6e6c8dca10538023a4996300df8992ff2e
SHA256

b1a5fdbb7c24f1b408a83267d418840fc8a4be805d2b6943784b5d1e791cb0f0
SHA512

afd1a56d19d8ca239cba44b110a374f97dc7b66168cb12572f2284507fba09ec5235ce4b8706ad938419a6b4640f22ad080bfa016e63c817a796867859f503d5
SSDEEP

768:EbX0l5cupGbDyq5GMRXGVLLRNg3UR49kFIqLLO9J3Irl62ELPEbPp+:EbX0wupueAGMZGFLRN2Q49KIqLL2

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
4444	msedge.exe
4444	msedge.exe
1624	identity_helper.exe
1624	identity_helper.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe
5524	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 4944	4444	msedge.exe	82
PID 4444 wrote to memory of 4944	4444	msedge.exe	82
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 1356	4444	msedge.exe	83
PID 4444 wrote to memory of 3980	4444	msedge.exe	84
PID 4444 wrote to memory of 3980	4444	msedge.exe	84
PID 4444 wrote to memory of 3852	4444	msedge.exe	85
PID 4444 wrote to memory of 3852	4444	msedge.exe	85
PID 4444 wrote to memory of 3852	4444	msedge.exe	85
PID 4444 wrote to memory of 3852	4444	msedge.exe	85
PID 4444 wrote to memory of 3852	4444	msedge.exe	85
PID 4444 wrote to memory of 3852	4444	msedge.exe	85
PID 4444 wrote to memory of 3852	4444	msedge.exe	85
PID 4444 wrote to memory of 3852	4444	msedge.exe	85
PID 4444 wrote to memory of 3852	4444	msedge.exe	85
PID 4444 wrote to memory of 3852	4444	msedge.exe	85
PID 4444 wrote to memory of 3852	4444	msedge.exe	85
PID 4444 wrote to memory of 3852	4444	msedge.exe	85
PID 4444 wrote to memory of 3852	4444	msedge.exe	85
PID 4444 wrote to memory of 3852	4444	msedge.exe	85
PID 4444 wrote to memory of 3852	4444	msedge.exe	85
PID 4444 wrote to memory of 3852	4444	msedge.exe	85
PID 4444 wrote to memory of 3852	4444	msedge.exe	85
PID 4444 wrote to memory of 3852	4444	msedge.exe	85
PID 4444 wrote to memory of 3852	4444	msedge.exe	85
PID 4444 wrote to memory of 3852	4444	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4c25b7d8714a5e95e79fa477ca35bef5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc53246f8,0x7ffcc5324708,0x7ffcc5324718
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,9545103687816273765,7978174194253052319,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,9545103687816273765,7978174194253052319,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,9545103687816273765,7978174194253052319,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9545103687816273765,7978174194253052319,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9545103687816273765,7978174194253052319,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9545103687816273765,7978174194253052319,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,9545103687816273765,7978174194253052319,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,9545103687816273765,7978174194253052319,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9545103687816273765,7978174194253052319,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9545103687816273765,7978174194253052319,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9545103687816273765,7978174194253052319,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9545103687816273765,7978174194253052319,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,9545103687816273765,7978174194253052319,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
a95b6d5555415f99212204e0b69d1328

SHA1
0b0cf190c53b3d091e6437365756e45b05c3b54f

SHA256
1bae985e8c4ae6218bae6bc396d2cbba7f2a9d045d3d09bf699037a8771c66c9

SHA512
86d1a3a592992fcec24271b34ef03684ab3969452c1ab9b733498be37f0878949d219c5898399bff93545dcf4412fddd6ba4d55577683425e4cbf45e5b800473

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a2cc34cfd95dce4ccbf09a8e561ce62a

SHA1
22e680c3e644b0772b50e82f74f636d4f6034b90

SHA256
81063ac8d2132f85cf3bf1d389d3cb022a0c6dca0d21ab616a225635ce65ceae

SHA512
ea8dae846b70999199332b43cf9e51e02dbd626346c2fcce881a897a1c8d2425bb6f9a5d049a996f84e9c09093dfba367b083f60d6e689991dea057c036ab8c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
94c5903b6766f2a786d3c0103cf8e02b

SHA1
3c568ae49944edb297c7733f7c3f8ead566917ef

SHA256
808bdc3a588c28f504836e918bf51a742a9140599073c8e3528ec3ad090ecde6

SHA512
ba791b94ad8d1a6a2d3e71f1a87cd5e97a11b9e4cd7aee9efae87d31f62e0552212c340bd92d914e958e75ae3ebdd5a93edee2c0fdc3a98abf8dc8b005b4d94d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
89362d2f471d8c4b841989741ad3990c

SHA1
3f203bf0f9a1b57a0d423cce1cff877da5227622

SHA256
76478d986fa837e3774c35f0b9d40bd4ffceae9938029b877b939d553076455f

SHA512
26d000ef300b80a575381152d1e2f92b1db9658f8c81e6f29c146b15099e301a894a854aa41b6bcef47f31aa1926fb9a9e37be97ef32adde1c8a3bac639bc00c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f6a8b4b7e59defa84d8aecb69ba48f81

SHA1
a745105c43dc8e40e3c0b069821441c88d70ce89

SHA256
5ac9fdbe482dc6ccc7eea21904404def7a9c82b6c03e6dd8365738b7bb2e83f1

SHA512
cc780e14c49212045e63d4cbd3117b373e0948da96237095827767df5969d48ea432febe6434de3114eb9df9a6df34561511bf84a5a310b06d37c309744524fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a3255e5a5ed1afb3876960bf0e16ae3e

SHA1
0dc842b0051db58ccb4ad3bec3e844175ba97bc0

SHA256
ffb75929270814260dfe7d8d05c1ae5ff695e6ebd5c677d6d82a3b6291d1f833

SHA512
d6bebd35636d1c59dccbf4f57653a7b60707e0f006a7f55aee7ae312b048f255cfdbbae45d41e67f80d94e4c229f28804f44381f4515b107c2bc406f33c23adb

Download Submit