e1e3aec00840456f53d8ebe99520701e5d1db9108d9b977bad2e59f7e9dd0d86

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 02:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

61c1d8a52fde975089c1036eede92837_JaffaCakes118.html
Size

15KB
MD5

61c1d8a52fde975089c1036eede92837
SHA1

bc7a281eb892033ad7ec5d0a565f50aeaf211499
SHA256

e1e3aec00840456f53d8ebe99520701e5d1db9108d9b977bad2e59f7e9dd0d86
SHA512

59516a992085a99bc50c9567854cda20c754dbe879243f24e4bda6ff9d5e1f4bb45a237103f7fc5749125d666a8b77100b81a518e45697e27302de867f7ecbef
SSDEEP

192:P2sOPGqom88LsCHBXUI6Iunn79hdmOY/VZaeKmt+p8GLcD:P2Cm88LsCHx29mO2VZzKbp8i2

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
468	msedge.exe
468	msedge.exe
4536	identity_helper.exe
4536	identity_helper.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 392	468	msedge.exe	83
PID 468 wrote to memory of 392	468	msedge.exe	83
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 1296	468	msedge.exe	84
PID 468 wrote to memory of 4832	468	msedge.exe	85
PID 468 wrote to memory of 4832	468	msedge.exe	85
PID 468 wrote to memory of 1972	468	msedge.exe	86
PID 468 wrote to memory of 1972	468	msedge.exe	86
PID 468 wrote to memory of 1972	468	msedge.exe	86
PID 468 wrote to memory of 1972	468	msedge.exe	86
PID 468 wrote to memory of 1972	468	msedge.exe	86
PID 468 wrote to memory of 1972	468	msedge.exe	86
PID 468 wrote to memory of 1972	468	msedge.exe	86
PID 468 wrote to memory of 1972	468	msedge.exe	86
PID 468 wrote to memory of 1972	468	msedge.exe	86
PID 468 wrote to memory of 1972	468	msedge.exe	86
PID 468 wrote to memory of 1972	468	msedge.exe	86
PID 468 wrote to memory of 1972	468	msedge.exe	86
PID 468 wrote to memory of 1972	468	msedge.exe	86
PID 468 wrote to memory of 1972	468	msedge.exe	86
PID 468 wrote to memory of 1972	468	msedge.exe	86
PID 468 wrote to memory of 1972	468	msedge.exe	86
PID 468 wrote to memory of 1972	468	msedge.exe	86
PID 468 wrote to memory of 1972	468	msedge.exe	86
PID 468 wrote to memory of 1972	468	msedge.exe	86
PID 468 wrote to memory of 1972	468	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\61c1d8a52fde975089c1036eede92837_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8c1346f8,0x7ffd8c134708,0x7ffd8c134718
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,13350248837577965266,18329777145293915809,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,13350248837577965266,18329777145293915809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,13350248837577965266,18329777145293915809,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13350248837577965266,18329777145293915809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13350248837577965266,18329777145293915809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,13350248837577965266,18329777145293915809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,13350248837577965266,18329777145293915809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13350248837577965266,18329777145293915809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13350248837577965266,18329777145293915809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13350248837577965266,18329777145293915809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13350248837577965266,18329777145293915809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,13350248837577965266,18329777145293915809,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4976 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
cb537b8bb185f82b13b470e6e82a218c

SHA1
a12641f8dd7ce792ef59e5700d493a41c7f54b20

SHA256
3d4fa97355939fdc7fd82426ca0a6e859a9d761b00f4dfda464e83a6765daee7

SHA512
7d0fcb22ef099675f9a383d092df844124919e2e00b37619e46c599389a7ef7b967e53ea3e93818f8f08d76c0f5a33db500d9cac16dd2c47a1c6be7defbe5c49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\245580e4-38d7-457e-95dd-2725cd2135d7.tmp

Filesize
6KB

MD5
52d57847291772c9bca26a38e252aa88

SHA1
f441f56ae9c6baf63cfdfa09a94a91cc78eb75f2

SHA256
63e594b46801c36f8b1a4c7fff9b2a63c262e5b4ee902f30093ee795fc12992c

SHA512
427008e54a382174b9b133153b2921c8369ef5e613f182b527fe61ed9cfd69b1d7851e74ffeaedf7f780ce66723d1429d4c05fb5cabb00ca918b60a3faa5ea5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
954B

MD5
ab231802fcfc93ddbfe61f2d97c7d990

SHA1
6336fcaf2090327e420d6b0be59446883b03c486

SHA256
8d58202a3ed00ea22efc04fd5f650366cd268543c8539a3ae1969d591734b163

SHA512
7aa9ce030b12f4e2b2123673795e4dcc057e3ad446ddb82d95e75528dfbab5bf33f546f29a8dd2b9b5e4e7f9837a0451073106fa9bd8fa8b975e6574e38956f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8da3fb7ea6e73ac8ef49003510340310

SHA1
07f684f08c8ef92f11f97c07fd9092801d9c35f4

SHA256
5abaf8c06d6af2c2f3deed2d66da3ee21ce3a272ecc78f7d483a91ed563521ab

SHA512
bf7f056fa9fd7b3f1883e0271f7dfa0b897760f1a8f8f91ddbd79c0d0aecfb211a208eec13c58f1c71a3626f8953d2b983874e5bd2fb951a5755694211131aee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cf401f2bd0f8afa13d5aeda7dee2b6da

SHA1
a181fb83a218cc13e7400a97267d183d521159d8

SHA256
3c38187b7122f1675d443d3ac6863964f3576da57c839771c2f52d2a6fbebff8

SHA512
dcd5b87697764f4a0fb9c104b1c813bd271c943fc95a936bbcecccd479ebd2e130eafedbf0b61b7e4c89792b9aea3a97f8295d10d70940b91859dd4936f88630

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b0e24cb8ffda0eb33134a20ec7993e89

SHA1
f8db37b563058795b038eba562cdf81ce8965e40

SHA256
da2740ae412c71e44c813c9ede248acafecec2545afc094fc758a91e776c249f

SHA512
d2146d9aa6f71f5e6a21c6b481a9f8fb07369383b14ea21007f44dc7f5907afca035e16e39bf66d27cfefaaf34ec0d9dc8062fc8a92fbc6bb5344716dee8fd27

Download Submit