0dda2482c0d02a70f6e0bfcc71b1420b6981acdb246b81e755f5b17c7b1e728a

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 21:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68b0b51507d72946a21beb61af39b498_JaffaCakes118.html
Size

654KB
MD5

68b0b51507d72946a21beb61af39b498
SHA1

76e1f5fae6db12060ab01b8ff60ed3768ced6555
SHA256

0dda2482c0d02a70f6e0bfcc71b1420b6981acdb246b81e755f5b17c7b1e728a
SHA512

d120089b62c25f2ad623264061d3e0c94542682340a1f35be183564524bd808d98467cce9fbcd2f3e9a802a0af2f4fc959d70773734529983e6ad43cea7457b6
SSDEEP

3072:4OGFfnsZNxgxIaDZcneNd38shanZKwR0MQFgg2LEyvD++4dVIOH5pazQ/RbwnAot:4OS/qmMB3ElHltnv8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

4952 msedge.exe
4952 msedge.exe
4284 msedge.exe
4284 msedge.exe
1076 msedge.exe
1076 msedge.exe
1076 msedge.exe
1076 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

msedge.exe

pid process

4284 msedge.exe
4284 msedge.exe
4284 msedge.exe
4284 msedge.exe
4284 msedge.exe

pid	process
4952	msedge.exe
4952	msedge.exe
4284	msedge.exe
4284	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4284 wrote to memory of 668	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 668	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 3104	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 4952	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 4952	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 1604	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 1604	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 1604	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 1604	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 1604	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 1604	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 1604	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 1604	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 1604	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 1604	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 1604	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 1604	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 1604	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 1604	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 1604	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 1604	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 1604	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 1604	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 1604	4284	msedge.exe	msedge.exe
PID 4284 wrote to memory of 1604	4284	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68b0b51507d72946a21beb61af39b498_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb923946f8,0x7ffb92394708,0x7ffb92394718
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,14960342049440129387,9510853251471930325,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,14960342049440129387,9510853251471930325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2588 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,14960342049440129387,9510853251471930325,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14960342049440129387,9510853251471930325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14960342049440129387,9510853251471930325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14960342049440129387,9510853251471930325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14960342049440129387,9510853251471930325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14960342049440129387,9510853251471930325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,14960342049440129387,9510853251471930325,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
6018baf65762725149e9132a98d99ae5

SHA1
2613a73dd6329ad0597b7973efb5fd861a0603b7

SHA256
713faa42901aef40c6610e5b00683aa46a7e3141a3e87c322c006c49dc0ab995

SHA512
f00abd27754eabd28f200d38013a8642c5ec5adf0af54c127e9ea80584f9e43bb184f93bb8a6c41dfc35ba48226ac33a651278e84b2925eea5333c6c4a724c41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b57483f904886484860bba7d740f18f1

SHA1
cca4756201b30d4f8c44b2703b8430588f8e65c5

SHA256
fb1e29f074a9008116c69185fd772c40d7a38e04cc33c945f1d2835a17ee6406

SHA512
72ba90adbabe98f5c21c1cb3c5fb8851f8af12ead83ee1d1a415ade28ad03b9034c1c848c3c727a06e88db311521cce3dfca995ff82951b34057eee205d54b8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8b79be6a85a8d251a8d34850a454a29d

SHA1
eeb1bec51b0af9b89dc3e16f7fc955184d980e56

SHA256
d29194d31466365f836c1dacff5c0fcea3781974b9efa41d1961af2cb4def6fc

SHA512
ee1940fb913f8455a1bed0daede9296afd19026d08f0101450d17c72373f680edd862cf5d45097c20e1d8f60da10d74ce610412213d551bb22c8752ee8c65778

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
41af1c8d21bb1fd6b764de1874e0622d

SHA1
6b7e7e21c23f3e29240b9d4e1dee96781d156ca2

SHA256
55dcaf2d52488ce70734ca118141cf2fbe17d6d4d75057443c70a8e5085bd98e

SHA512
bd72907eb2a1741d1274227b77203a13ac88a4c15430f802400232b2bfec872cfdc62998b81c9e9abf7be8234847ff5b17b9cf62d5457e4f1d1d51cbb99c163a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
744f2851113070b747315c573fcaf9e7

SHA1
4f7092825d366650e14c0952b8438d1c259f1ff2

SHA256
e9c7ad57bb1a55183cfa144388c636f37e15b667e58016c0c22904248527c353

SHA512
86c9c0e82d566113c01b1e627e8f3d7e71a0e58edc4069b655eae272a1cf8dc122f37453f41d28cc5378f52e3b336bd51296d8b477aeff1f37982689182360d5

Download Submit
\??\pipe\LOCAL\crashpad_4284_VWXKSLQRWIZOTIAH

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit