cfcfc18946234209276958eb3ab1eff6168e8f2d0c5a26a3c239050969205ee9

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b619047536e71a76097199eea47f550_JaffaCakes118.html
Size

64KB
MD5

5b619047536e71a76097199eea47f550
SHA1

4bc1aab9f85670af91e10a6c930573c4aa6afdca
SHA256

cfcfc18946234209276958eb3ab1eff6168e8f2d0c5a26a3c239050969205ee9
SHA512

a59c3661e632e85356ad46c6772de30a6430bdd55889609a26a53ae4978ba2592c550f9ab9c75ba2074d028e717a948f4850f38252327396ee2507b3daa13b61
SSDEEP

768:u1hHUr+5Nu1a+z361O7iOR11br5VS0RwjhQa9j9p4BSLp1qJDS+vftvkz6:u1HNuQ+zK1O7iOR1oXxj9o

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3196	msedge.exe
3196	msedge.exe
384	msedge.exe
384	msedge.exe
4176	identity_helper.exe
4176	identity_helper.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 5028	384	msedge.exe	82
PID 384 wrote to memory of 5028	384	msedge.exe	82
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 980	384	msedge.exe	83
PID 384 wrote to memory of 3196	384	msedge.exe	84
PID 384 wrote to memory of 3196	384	msedge.exe	84
PID 384 wrote to memory of 5012	384	msedge.exe	85
PID 384 wrote to memory of 5012	384	msedge.exe	85
PID 384 wrote to memory of 5012	384	msedge.exe	85
PID 384 wrote to memory of 5012	384	msedge.exe	85
PID 384 wrote to memory of 5012	384	msedge.exe	85
PID 384 wrote to memory of 5012	384	msedge.exe	85
PID 384 wrote to memory of 5012	384	msedge.exe	85
PID 384 wrote to memory of 5012	384	msedge.exe	85
PID 384 wrote to memory of 5012	384	msedge.exe	85
PID 384 wrote to memory of 5012	384	msedge.exe	85
PID 384 wrote to memory of 5012	384	msedge.exe	85
PID 384 wrote to memory of 5012	384	msedge.exe	85
PID 384 wrote to memory of 5012	384	msedge.exe	85
PID 384 wrote to memory of 5012	384	msedge.exe	85
PID 384 wrote to memory of 5012	384	msedge.exe	85
PID 384 wrote to memory of 5012	384	msedge.exe	85
PID 384 wrote to memory of 5012	384	msedge.exe	85
PID 384 wrote to memory of 5012	384	msedge.exe	85
PID 384 wrote to memory of 5012	384	msedge.exe	85
PID 384 wrote to memory of 5012	384	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5b619047536e71a76097199eea47f550_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef94246f8,0x7ffef9424708,0x7ffef9424718
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,3936095320197926078,9913101350130287203,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,3936095320197926078,9913101350130287203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,3936095320197926078,9913101350130287203,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3936095320197926078,9913101350130287203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3936095320197926078,9913101350130287203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,3936095320197926078,9913101350130287203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,3936095320197926078,9913101350130287203,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3936095320197926078,9913101350130287203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3936095320197926078,9913101350130287203,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3936095320197926078,9913101350130287203,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3936095320197926078,9913101350130287203,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,3936095320197926078,9913101350130287203,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3004 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
751B

MD5
17ea30f35a29e65b31463e7f96847ef0

SHA1
4c8832287f2fdb1223783c9f1246a5cb6efd0606

SHA256
7a8d709805b846cfc14849bcfaf618aafdb8750e49721c4bdc21b212767fe583

SHA512
2fa845b282110040ecaaa1456c82e8ec22bbb8d63cf548e35aa8288447b536159237fcb034018a42fa2a0c124217c629e621d8f7c16623527492766f0432d880

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
966db7499ee5900ef737413a2ac18841

SHA1
cb3eaefddff904d1a9a0aee879eee21176d358d1

SHA256
5bea313053e57b6bcf6cee439e5c0fab09554908ab93bbc3d3b00cff267dfb3f

SHA512
4a49ad2c9dc0376c999a049fc12491f7195ac5d116ad969fd3b9c5cf23ffb70b243147b47304ed5bc95bc82369e813f62f4b0c826759a49ddbd3c68422b99bb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
37fc4aa2181921c91f33c2fb33d9a5fb

SHA1
204f42c58d4908d2db2341eb09802687531341a0

SHA256
d4b360640fd69399db8307f2c152f75c0ca006d58372a1749794fbda36d16828

SHA512
394f157ad79dabd0020bec441458e6074cbe3423201fedf675ce764bec3742666844183bd630cdcad3196ae335df3a8f9ad3b25af2d6f31921c0f6dff82c3245

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
927c22c87673fa2513f113c8eefe4f0d

SHA1
1b7475f2cdce9311b97927693737739869c20644

SHA256
6aa7495c732013a08c6a38421d9ff54ca0f3a045590d56b331e74784c37a2ffd

SHA512
1fa0f97e93580a0f30c0da80ee9f31e1fa75545aef358c19027a026bd09044e638a3f43d823e91c544d9cce13eac25672abe05058c0cdad67ad0477545ecaef0

Download Submit