1ba1630f0b1574e8bba2c632f4e4331e789f4226fb2349f1246f5d2774fb5980

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 08:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62b3a6eb45fad65dce3419022b589135_JaffaCakes118.html
Size

55KB
MD5

62b3a6eb45fad65dce3419022b589135
SHA1

8e79a75c557852c3965467894e30293782707409
SHA256

1ba1630f0b1574e8bba2c632f4e4331e789f4226fb2349f1246f5d2774fb5980
SHA512

be40b6a6ec6b14c2403f6afc4724e16c5cf46ecbe6222d07b4ff5e292f057fa260f40ca49b32212dd7f6556ca500f68db3099fbc6039b92bf10267a6932b4b98
SSDEEP

1536:nLVaUZcq2qZqkqTqlzRqTqMqLqyqlN6qhqMq3q+ql7FqCqhqcqNqlXdqoq/qqq7y:nLz/3pE

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
3884	msedge.exe
3884	msedge.exe
1976	identity_helper.exe
1976	identity_helper.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 3452	3884	msedge.exe	82
PID 3884 wrote to memory of 3452	3884	msedge.exe	82
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4524	3884	msedge.exe	83
PID 3884 wrote to memory of 4752	3884	msedge.exe	84
PID 3884 wrote to memory of 4752	3884	msedge.exe	84
PID 3884 wrote to memory of 1964	3884	msedge.exe	85
PID 3884 wrote to memory of 1964	3884	msedge.exe	85
PID 3884 wrote to memory of 1964	3884	msedge.exe	85
PID 3884 wrote to memory of 1964	3884	msedge.exe	85
PID 3884 wrote to memory of 1964	3884	msedge.exe	85
PID 3884 wrote to memory of 1964	3884	msedge.exe	85
PID 3884 wrote to memory of 1964	3884	msedge.exe	85
PID 3884 wrote to memory of 1964	3884	msedge.exe	85
PID 3884 wrote to memory of 1964	3884	msedge.exe	85
PID 3884 wrote to memory of 1964	3884	msedge.exe	85
PID 3884 wrote to memory of 1964	3884	msedge.exe	85
PID 3884 wrote to memory of 1964	3884	msedge.exe	85
PID 3884 wrote to memory of 1964	3884	msedge.exe	85
PID 3884 wrote to memory of 1964	3884	msedge.exe	85
PID 3884 wrote to memory of 1964	3884	msedge.exe	85
PID 3884 wrote to memory of 1964	3884	msedge.exe	85
PID 3884 wrote to memory of 1964	3884	msedge.exe	85
PID 3884 wrote to memory of 1964	3884	msedge.exe	85
PID 3884 wrote to memory of 1964	3884	msedge.exe	85
PID 3884 wrote to memory of 1964	3884	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\62b3a6eb45fad65dce3419022b589135_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa37e46f8,0x7ffaa37e4708,0x7ffaa37e4718
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,5230068533059302327,3459975177283182467,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,5230068533059302327,3459975177283182467,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,5230068533059302327,3459975177283182467,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5230068533059302327,3459975177283182467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5230068533059302327,3459975177283182467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5230068533059302327,3459975177283182467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,5230068533059302327,3459975177283182467,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,5230068533059302327,3459975177283182467,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5230068533059302327,3459975177283182467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5230068533059302327,3459975177283182467,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5230068533059302327,3459975177283182467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5230068533059302327,3459975177283182467,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,5230068533059302327,3459975177283182467,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
5ee97e0fb0477df2394c568c59365c75

SHA1
a5075a045a80a7af8e58d95e8f00cf1bfbb1215f

SHA256
69535edc4337bf2a4f638bee8d3aa3c16924393434ec7a773fafa16e32810a87

SHA512
824f9e260152ed47488b3f8e2aac30ea9d5539a9e88cc3dfd8d30bd7dd4c1cdcf1ba3421235436110f4be07bf6adb7823bb4d4a722964fc4009a4b0042b20e4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
63830e7305fc7b0f5436401bfcc47c82

SHA1
56e16338dd7ecab7c763fe1d734e045bd3f601ca

SHA256
da2dd91da267e36c004f45f3db3b9c337d7c218cf011753ca7df6b4d1e223288

SHA512
3f0173720939f9245c14d0b5df541392a71d98893aa1e18784068deb028c4601bb82974a14e0a1fa9b0796c453c79c92e28595db16f97537470f3a8248156417

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
aefd44f052d72915cf4131a1a017f43e

SHA1
c26157b375eba7246623b0d0a463fb1b2f9130f2

SHA256
17ea80e5bf63a8e58f380c40091ad431a66191e0fec173c99c4a3210f197d48c

SHA512
865e2cb9ef9d2051724d5f377aaa4a1d88d76ca3f092899d4ac6886dd619f56743c49f5e2c471b628d2f11d526df9d7154e656541ec3a6a0461711a76c6b84a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0b2f4eb028902a8a8525612ae83364b6

SHA1
1df502d6353c2135dea1b65a3ddb4fe2438c907b

SHA256
1603797bf3a2948ae06459f19b02ea2c7860c0f23eeda9666683a86f80cc91c5

SHA512
1fc5618e84f44b21bc057025d1676a1db81fd54d4150ed100928b8ac0450edb24ff54fc615d3948a83f536b8d6fad93c5f67abc452da98e68d78f7f429bc44d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
000b3fdd5c9b6ff5568c21bf6bca3b23

SHA1
2a2ad26281f3285a2ffbf56bbbf3cb65ca90573a

SHA256
fb1ea807b5f9e1e470bc2064a33d9ab8c0a661dfab0df726542037c89af7e9dc

SHA512
6781b354826b756f0d65ac1b679c3451f9dbd598bd05dc6b42f4efb759ad2376fd82392d6c16ad9f0b2c380842379188cc9acee0cbcd7b46c32e82e6639aa706

Download Submit