1aebe900b35a08d298641853fc53e0df70340ded0ef2577f7234d33e6eca52af

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 19:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5117b582f8885a44df6219df75ae1ff7_JaffaCakes118.html
Size

443KB
MD5

5117b582f8885a44df6219df75ae1ff7
SHA1

2afb1132c4fef158dd986651a2181b4474c89212
SHA256

1aebe900b35a08d298641853fc53e0df70340ded0ef2577f7234d33e6eca52af
SHA512

4ce57f5434d30b9ad59c00abeeb90ebbe2067b8c51ca6b59c128d75f3e43fe7f76b63fecc84cbd0a3458524e3cf0d91de9dec43f917f6a9530e983530f6e41c2
SSDEEP

12288:1luu8ZPFEUaJxodkrYJzDupVfusbbO1c/hl:LKP2px

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe
1920	msedge.exe
1920	msedge.exe
3684	identity_helper.exe
3684	identity_helper.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 1400	1920	msedge.exe	83
PID 1920 wrote to memory of 1400	1920	msedge.exe	83
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 4884	1920	msedge.exe	84
PID 1920 wrote to memory of 3792	1920	msedge.exe	85
PID 1920 wrote to memory of 3792	1920	msedge.exe	85
PID 1920 wrote to memory of 2968	1920	msedge.exe	86
PID 1920 wrote to memory of 2968	1920	msedge.exe	86
PID 1920 wrote to memory of 2968	1920	msedge.exe	86
PID 1920 wrote to memory of 2968	1920	msedge.exe	86
PID 1920 wrote to memory of 2968	1920	msedge.exe	86
PID 1920 wrote to memory of 2968	1920	msedge.exe	86
PID 1920 wrote to memory of 2968	1920	msedge.exe	86
PID 1920 wrote to memory of 2968	1920	msedge.exe	86
PID 1920 wrote to memory of 2968	1920	msedge.exe	86
PID 1920 wrote to memory of 2968	1920	msedge.exe	86
PID 1920 wrote to memory of 2968	1920	msedge.exe	86
PID 1920 wrote to memory of 2968	1920	msedge.exe	86
PID 1920 wrote to memory of 2968	1920	msedge.exe	86
PID 1920 wrote to memory of 2968	1920	msedge.exe	86
PID 1920 wrote to memory of 2968	1920	msedge.exe	86
PID 1920 wrote to memory of 2968	1920	msedge.exe	86
PID 1920 wrote to memory of 2968	1920	msedge.exe	86
PID 1920 wrote to memory of 2968	1920	msedge.exe	86
PID 1920 wrote to memory of 2968	1920	msedge.exe	86
PID 1920 wrote to memory of 2968	1920	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5117b582f8885a44df6219df75ae1ff7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef99446f8,0x7ffef9944708,0x7ffef9944718
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6897225396659501994,695261612038293182,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,6897225396659501994,695261612038293182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,6897225396659501994,695261612038293182,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6897225396659501994,695261612038293182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6897225396659501994,695261612038293182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6897225396659501994,695261612038293182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6897225396659501994,695261612038293182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6897225396659501994,695261612038293182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6897225396659501994,695261612038293182,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6897225396659501994,695261612038293182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6897225396659501994,695261612038293182,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6897225396659501994,695261612038293182,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3bbf532a-b9e5-48ef-905a-30a28e5f0c07.tmp

Filesize
326B

MD5
1aac375b60827b9859d42965b9701704

SHA1
9147ba7c2472942aadc3808fa6e108fd02db0161

SHA256
4458d711bd3329b93eef1f32fd1d8dc86b204d0dc4d25e298c84a9d4029f4645

SHA512
f1252f9318554833230d72fea3a846693f025c5c75b4bca736f092c0106348c86f37c6bca3085fc8dcb4eaf74baeda59952e415f255820d70a8764030b2795d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9cc141f9-6a14-416b-a4e1-d156183c6238.tmp

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c27c842efcf3e406616bd6b50255b06b

SHA1
17091d50d1133498c444dfafdc8e54218694de55

SHA256
e2ae986d788ff6b7dd4d82fd5d6d2732f44439608fda75d1aac9897b34b35920

SHA512
c2df2ba47e6596dad51316f450d53f5a25ebc319e17ed18d5c524e2ac5a201752598529301043d6f67dd08fd697c46a25d0099bbaaec2774dd1ba8f8814b5de2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
29ad1f23d6d997ca4bdc8eb1e18bb7d5

SHA1
f72551011c090c0dc827b00ae893458803859e3a

SHA256
ead84fcd2192a6574f9ee427e84014b7d22450ccb23875f12a974d58936b216a

SHA512
560bfac45bb8feb058ec6e0a06f1e596d29398afed7a55243654c1c3680d52e8df3244b2572e1b449ba91a23a374d05be03bb9c2fb4bea6fc9d0a61e7782aada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
76612f937ef39f1ee5d6640a2a5095e8

SHA1
3f73493d6fffbcb10945d3613b12e75ba8f70ce3

SHA256
249125ba2cd808ea29417c6fba9aaa0add0d4383c22f1fb609e414ae543565fa

SHA512
1dbe32824a9506caf777faba30aca9fea56b384421627bcde894a022912a3b8275203e59ddf761c744ee0f1a52fbd5c86eb7d0d21f8a133f173156233d39e39d

Download Submit