a108cd35bad8d09a3662ddfea3f4aed493c3a94d8d3fc1da039ddda4d94676eb

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51566d89a4085d852794ff79203aad2e_JaffaCakes118.html
Size

157KB
MD5

51566d89a4085d852794ff79203aad2e
SHA1

35a619e83a4b7eac9f3c37f2a95906b7b8d2463e
SHA256

a108cd35bad8d09a3662ddfea3f4aed493c3a94d8d3fc1da039ddda4d94676eb
SHA512

e220438530a8510e668905c203a3461b8d35207ed11c4def6a51681793e2d283368b8f941228c37dd1ea3d01a606f4388f7dd8dd5af9ea4d33e7adfd10409d99
SSDEEP

3072:i/8dnxqUZyfkMY+BES09JXAnyrZalI+YQ:i6gU8sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
544	msedge.exe
544	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
208	identity_helper.exe
208	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 3928	544	msedge.exe	82
PID 544 wrote to memory of 3928	544	msedge.exe	82
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 2944	544	msedge.exe	83
PID 544 wrote to memory of 1492	544	msedge.exe	84
PID 544 wrote to memory of 1492	544	msedge.exe	84
PID 544 wrote to memory of 1300	544	msedge.exe	85
PID 544 wrote to memory of 1300	544	msedge.exe	85
PID 544 wrote to memory of 1300	544	msedge.exe	85
PID 544 wrote to memory of 1300	544	msedge.exe	85
PID 544 wrote to memory of 1300	544	msedge.exe	85
PID 544 wrote to memory of 1300	544	msedge.exe	85
PID 544 wrote to memory of 1300	544	msedge.exe	85
PID 544 wrote to memory of 1300	544	msedge.exe	85
PID 544 wrote to memory of 1300	544	msedge.exe	85
PID 544 wrote to memory of 1300	544	msedge.exe	85
PID 544 wrote to memory of 1300	544	msedge.exe	85
PID 544 wrote to memory of 1300	544	msedge.exe	85
PID 544 wrote to memory of 1300	544	msedge.exe	85
PID 544 wrote to memory of 1300	544	msedge.exe	85
PID 544 wrote to memory of 1300	544	msedge.exe	85
PID 544 wrote to memory of 1300	544	msedge.exe	85
PID 544 wrote to memory of 1300	544	msedge.exe	85
PID 544 wrote to memory of 1300	544	msedge.exe	85
PID 544 wrote to memory of 1300	544	msedge.exe	85
PID 544 wrote to memory of 1300	544	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\51566d89a4085d852794ff79203aad2e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9904646f8,0x7ff990464708,0x7ff990464718
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,5590431803900249245,11763659802082010951,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,5590431803900249245,11763659802082010951,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,5590431803900249245,11763659802082010951,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:8
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5590431803900249245,11763659802082010951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5590431803900249245,11763659802082010951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,5590431803900249245,11763659802082010951,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,5590431803900249245,11763659802082010951,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,5590431803900249245,11763659802082010951,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5590431803900249245,11763659802082010951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5590431803900249245,11763659802082010951,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5590431803900249245,11763659802082010951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5590431803900249245,11763659802082010951,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:2816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
77c7929c64022d3a6fa9c90f47f1eaca

SHA1
983885e235eeaaa42f81b5891bb78048dcd15b10

SHA256
a8fb1b651df2e86a49641c6af08d45035d58dad805361323fb8b8926accf47e4

SHA512
c65eab4f822618d7444828509c80b66dc685d9415eaf6694fdf3bca3cef9c0d6152d0f0bf587bc7fa9fe1494e22be7442ddb38837777b0875aa3874fc70bda3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b39149ac-d603-42c3-809d-00739a383b91.tmp

Filesize
6KB

MD5
616800e53d2a02b50d71f7007e091d33

SHA1
611648b6224c324dbc9b5f1431c32d74315eb225

SHA256
a1690b59bbec598150283aa0fdba90d62698d85b9a72bbedc583b34813e36d56

SHA512
57f9a28241eda31cf25b1e0088f5b70308c4bb777b029bdf81504dc85e9895a25ac90f21440c8face3a7085658aa37d4fe3a1f92bb95bf700451221e38c71d3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e4c334517072f8913fd9e2f27a8936a6

SHA1
839a3962744e6c75509ec0cb85a14e4f0140ae2e

SHA256
742c44c8bd5b13b29a695eba51f04c3e8c51faa2ac7abaacff04a06a4ba39fea

SHA512
92708f723db8a5f828050c19bfefb0be1647b94133e1b8b8ecdfcec291c68e4b6c9c8bdd0adcbb56a9f3ae1833123a5a319ba9813ea7dd3d75dbdc1aa31a24f8

Download Submit