10499803e3d58ae24f8dc7ed5cbf64ff44989bb6fe9cd2d9c289e5cf8c34fa56

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 01:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c80f1373d4084ae2e069efd7185909f_JaffaCakes118.html
Size

4KB
MD5

5c80f1373d4084ae2e069efd7185909f
SHA1

a4b6a866c484724f60b90b1d82c9a03d567fa67c
SHA256

10499803e3d58ae24f8dc7ed5cbf64ff44989bb6fe9cd2d9c289e5cf8c34fa56
SHA512

3c6efb7f61f1aad5fcb4cd99f4046215b506e60ff643e0f5137f8f00dc311c1cf3c974262a330414ff167faa9509d49f168171a6c76fdfc989d13ee4b722ba44
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oAEjSd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDX

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1932	msedge.exe
1932	msedge.exe
3152	msedge.exe
3152	msedge.exe
3312	identity_helper.exe
3312	identity_helper.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 388	3152	msedge.exe	82
PID 3152 wrote to memory of 388	3152	msedge.exe	82
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1728	3152	msedge.exe	83
PID 3152 wrote to memory of 1932	3152	msedge.exe	84
PID 3152 wrote to memory of 1932	3152	msedge.exe	84
PID 3152 wrote to memory of 1456	3152	msedge.exe	85
PID 3152 wrote to memory of 1456	3152	msedge.exe	85
PID 3152 wrote to memory of 1456	3152	msedge.exe	85
PID 3152 wrote to memory of 1456	3152	msedge.exe	85
PID 3152 wrote to memory of 1456	3152	msedge.exe	85
PID 3152 wrote to memory of 1456	3152	msedge.exe	85
PID 3152 wrote to memory of 1456	3152	msedge.exe	85
PID 3152 wrote to memory of 1456	3152	msedge.exe	85
PID 3152 wrote to memory of 1456	3152	msedge.exe	85
PID 3152 wrote to memory of 1456	3152	msedge.exe	85
PID 3152 wrote to memory of 1456	3152	msedge.exe	85
PID 3152 wrote to memory of 1456	3152	msedge.exe	85
PID 3152 wrote to memory of 1456	3152	msedge.exe	85
PID 3152 wrote to memory of 1456	3152	msedge.exe	85
PID 3152 wrote to memory of 1456	3152	msedge.exe	85
PID 3152 wrote to memory of 1456	3152	msedge.exe	85
PID 3152 wrote to memory of 1456	3152	msedge.exe	85
PID 3152 wrote to memory of 1456	3152	msedge.exe	85
PID 3152 wrote to memory of 1456	3152	msedge.exe	85
PID 3152 wrote to memory of 1456	3152	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5c80f1373d4084ae2e069efd7185909f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5ce246f8,0x7ffa5ce24708,0x7ffa5ce24718
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,4207527636083948197,15782321074534426226,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,4207527636083948197,15782321074534426226,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,4207527636083948197,15782321074534426226,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,4207527636083948197,15782321074534426226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,4207527636083948197,15782321074534426226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,4207527636083948197,15782321074534426226,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,4207527636083948197,15782321074534426226,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,4207527636083948197,15782321074534426226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,4207527636083948197,15782321074534426226,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,4207527636083948197,15782321074534426226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,4207527636083948197,15782321074534426226,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,4207527636083948197,15782321074534426226,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5240 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
292B

MD5
4f70522f410a0adfe9b05d316e7a57f4

SHA1
7ab174778a4320bc17a39065fd62f9c04027458b

SHA256
1b442c9bfca9902ff453dd2fd2131e2a5ff91a16ad00544d09751ee4aa58e1a5

SHA512
3675656fa8afe5a3b27043b6094ab3b93707d12755d78c4a6e50f07a1f6e520ff72129866cf9114ecbc55035bdbc5a159bdeaa494ef1dc637910942b99298aaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
57840aa7c8e28997a22b50a544fb71d6

SHA1
ba5132ea31ef4fd4b3cceed7942b9fc92b1787db

SHA256
fb5c6184066a0d2ccc49f535f569d430082696194e82353751ff873ccc03028b

SHA512
83943511903cf622ad26e813efc5463e68f2de050a270970905a54825f6d02cbeacb258f3474bd4071518db67268544ec19dfe8e2ef6fcc387acc866440fd967

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5ff65a2021c61263dba9aec6e4545a56

SHA1
46c2f5df23808a50bf9d03898d89ca3efc11d321

SHA256
99b28ec4e805cf3471e77d727452299505f2ae0be60ac3732572c4685fc4c439

SHA512
248713a9742be90399f8bc0445cfdf08c4fae3e92b0ad94e4d6fc1b0a8563094944a69949997954de0a30968a10679d444643d6fe1b80936ffa559932cf47d3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b8907b1be0d5e9066bd43418bb36ed51

SHA1
02deeec4c35bf8598261ca1905c1697db62f4505

SHA256
74e79883579941603644ab66e2ae08b6d752729bf765f41e373e5bb36e621fcd

SHA512
9ccd3a55df6ede01fc071c765c87de8558b623b4632ff2a24239c027280428126128ac32fdcfaa32b9423ea19cdb9a4c568f770c9f22f052553de1eef17263ba

Download Submit