82be2716b47e2929382dfc412669ef695dcd621adfcea257ea9535c1cab01c69

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

500d1553a1b27270f030ad7e4b9af574_JaffaCakes118.html
Size

250KB
MD5

500d1553a1b27270f030ad7e4b9af574
SHA1

29cc347b8f749af4c7b6a757241e03dbf61949b8
SHA256

82be2716b47e2929382dfc412669ef695dcd621adfcea257ea9535c1cab01c69
SHA512

d90e27dc6da917037a1848ee169647a0d22da28ef6aa7a275f3af2b179b61eb52ec98f0792302dc003abaea2cf966b26a334415d7abfb5059448adf98f633271
SSDEEP

6144:L+POhwsNW0/SF9ALaN2eiXuBJgI+U3xWPPWnp:L+mhwsNWCSLALaN2JucI+UBWG

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
712	msedge.exe
712	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2144	identity_helper.exe
2144	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 712 wrote to memory of 764	712	msedge.exe	82
PID 712 wrote to memory of 764	712	msedge.exe	82
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 2300	712	msedge.exe	83
PID 712 wrote to memory of 436	712	msedge.exe	84
PID 712 wrote to memory of 436	712	msedge.exe	84
PID 712 wrote to memory of 4088	712	msedge.exe	85
PID 712 wrote to memory of 4088	712	msedge.exe	85
PID 712 wrote to memory of 4088	712	msedge.exe	85
PID 712 wrote to memory of 4088	712	msedge.exe	85
PID 712 wrote to memory of 4088	712	msedge.exe	85
PID 712 wrote to memory of 4088	712	msedge.exe	85
PID 712 wrote to memory of 4088	712	msedge.exe	85
PID 712 wrote to memory of 4088	712	msedge.exe	85
PID 712 wrote to memory of 4088	712	msedge.exe	85
PID 712 wrote to memory of 4088	712	msedge.exe	85
PID 712 wrote to memory of 4088	712	msedge.exe	85
PID 712 wrote to memory of 4088	712	msedge.exe	85
PID 712 wrote to memory of 4088	712	msedge.exe	85
PID 712 wrote to memory of 4088	712	msedge.exe	85
PID 712 wrote to memory of 4088	712	msedge.exe	85
PID 712 wrote to memory of 4088	712	msedge.exe	85
PID 712 wrote to memory of 4088	712	msedge.exe	85
PID 712 wrote to memory of 4088	712	msedge.exe	85
PID 712 wrote to memory of 4088	712	msedge.exe	85
PID 712 wrote to memory of 4088	712	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\500d1553a1b27270f030ad7e4b9af574_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8c3c46f8,0x7fff8c3c4708,0x7fff8c3c4718
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,17840402522823083225,14037234704305818548,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,17840402522823083225,14037234704305818548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,17840402522823083225,14037234704305818548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17840402522823083225,14037234704305818548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17840402522823083225,14037234704305818548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17840402522823083225,14037234704305818548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,17840402522823083225,14037234704305818548,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4908 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,17840402522823083225,14037234704305818548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1880 /prefetch:8
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,17840402522823083225,14037234704305818548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17840402522823083225,14037234704305818548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17840402522823083225,14037234704305818548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17840402522823083225,14037234704305818548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,17840402522823083225,14037234704305818548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:2076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
294ae22ee1d185bda2f70a8abd4d74d6

SHA1
6e93ab6b758f971818bfe3024f9d6d19f7f6a61a

SHA256
ac723f96066e5e89933c9b68c41522bf53143991794f6c3b8587504aa4a52e95

SHA512
93689c893db4db5957f90b029f6a8fcffb8b3f250de94f9e363d70fc270a4800e220f9be0b0be553c28f7700b18112aa2390d4d6dc9569e2fa95767c8c34c2d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d46e76052a3c02fea43afd2e56e66a5d

SHA1
63a5dccf50a96950c1a55aeea6f3be880b171077

SHA256
26f06aa0d38271d629f036c94533ca8d26bc66dd2be1dbf91478fc8e3c17508a

SHA512
30731e92417736c466e6527072e3fc51a548de8252b7ea6869ceecbd69467936f123cba04d78705a98d1c61bc8add340c89811f6ddb0852356a1268afce42610

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e2c3dc1dd62cd0ce1e450ea174b6382c

SHA1
2fce035ea99a6cd9598fb4d36e68e996aacb117e

SHA256
d4ea70149ddd76a6b37537b1b4dcbcb145d6267af8349dd98d04c9b277252161

SHA512
aa735109f27a6f50ac84c5498d4b1de5998971f150471d38d04d3f8c1f4c5632c2a6e642ae871a2ef83245ef5b66aa9a971418dc2032727f734b5c8ed313ebdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
67d65d313b28cf2ac1a825cfba619db9

SHA1
cbc8b032fa7aa343181a4633aa1f0ab46be1c279

SHA256
529e1868c34b921f5bddc45c564a30775c3b4ae0cc1a5b05fc9323943ec389d6

SHA512
47c86295d7f4dbea9236067083e1e45c943621fdd1aa1c846a8f437d826ed6d43d02397a30b5dcaad3037f7255af9a33f89bae99723ff64722e8eb3581fa31f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c9ceadcb7db4f69abce138ece7820c9c

SHA1
d2bd91883650622928731e5818f91e5db4f0ecb1

SHA256
00ee82aad8c4c7cf35e7956f9c47b4ae0eaf30b63ebd43d704a89a900ac0beaf

SHA512
72386786e7756c3f1a83e9a9619faf5c092109e1c8e05903a989069a66ac54a1c623a1c013df935d9adce8908945fe658a248d342eb88321666858641b1cb6e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
553d5a017ecca845c17731c10707608a

SHA1
004cc0966ba2a5a74cdffc40182f43c038ac4fe5

SHA256
0ac0fdfccf4c737c0059c1d9ee9a758a47cec932c308a81318678c11de26b5d9

SHA512
1f5406ef01ba0fac7de5b2eb08d377d9e6b32999e3a5492f5afcb05526b352f2c2c1f1491cd128f192c3e2aae55453e1e8fd04224c3b9964fac5d40c2de41fd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a7dbbcfb9941bd21e664530ade1d367e

SHA1
9848b9429fbecf3c69d484f4259d08a6457c8f83

SHA256
dbb3a957bb0bc05c24d685e0e529cab0db77d5a045fa8fa5cbfadb75f6d06a9c

SHA512
4d43667e9c00666df91e78a925a46a243a172580a90743f969efab816fda1edaa24fdea2e43d7463090f7478ffa6884a2b21d79e1af6ef9f116be9f5c1b43a02

Download Submit