0060a9b886e587e50bf54d457b2dc12e6423d44d5d8c03ffc4d374a67b3d795d

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 17:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

680472edb41e7fb6f423b7810c2fb632_JaffaCakes118.html
Size

61KB
MD5

680472edb41e7fb6f423b7810c2fb632
SHA1

c667d8410cc002f550535794ad089dff9bc77ca5
SHA256

0060a9b886e587e50bf54d457b2dc12e6423d44d5d8c03ffc4d374a67b3d795d
SHA512

9efc8542ba1b73ae924cdd8e875d87ddb929415b141417a448e4a64d39afd3a8293892438d3215da32dc527ef056c652ae04af9b0f91f0e250c18062a61f4537
SSDEEP

768:ZJVKOpy7hgV4EgG0UQSmw1y8Jt50By6sRXRAMiQSmw1y8Jt5ex4NTTtlG29rMJK:ZGkya4ECps2ntlzh

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2204	msedge.exe
2204	msedge.exe
3216	msedge.exe
3216	msedge.exe
3544	identity_helper.exe
3544	identity_helper.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 548	3216	msedge.exe	82
PID 3216 wrote to memory of 548	3216	msedge.exe	82
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 3752	3216	msedge.exe	83
PID 3216 wrote to memory of 2204	3216	msedge.exe	84
PID 3216 wrote to memory of 2204	3216	msedge.exe	84
PID 3216 wrote to memory of 1936	3216	msedge.exe	85
PID 3216 wrote to memory of 1936	3216	msedge.exe	85
PID 3216 wrote to memory of 1936	3216	msedge.exe	85
PID 3216 wrote to memory of 1936	3216	msedge.exe	85
PID 3216 wrote to memory of 1936	3216	msedge.exe	85
PID 3216 wrote to memory of 1936	3216	msedge.exe	85
PID 3216 wrote to memory of 1936	3216	msedge.exe	85
PID 3216 wrote to memory of 1936	3216	msedge.exe	85
PID 3216 wrote to memory of 1936	3216	msedge.exe	85
PID 3216 wrote to memory of 1936	3216	msedge.exe	85
PID 3216 wrote to memory of 1936	3216	msedge.exe	85
PID 3216 wrote to memory of 1936	3216	msedge.exe	85
PID 3216 wrote to memory of 1936	3216	msedge.exe	85
PID 3216 wrote to memory of 1936	3216	msedge.exe	85
PID 3216 wrote to memory of 1936	3216	msedge.exe	85
PID 3216 wrote to memory of 1936	3216	msedge.exe	85
PID 3216 wrote to memory of 1936	3216	msedge.exe	85
PID 3216 wrote to memory of 1936	3216	msedge.exe	85
PID 3216 wrote to memory of 1936	3216	msedge.exe	85
PID 3216 wrote to memory of 1936	3216	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\680472edb41e7fb6f423b7810c2fb632_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9303d46f8,0x7ff9303d4708,0x7ff9303d4718
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,696918645795824882,18314839689023972345,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,696918645795824882,18314839689023972345,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,696918645795824882,18314839689023972345,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,696918645795824882,18314839689023972345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,696918645795824882,18314839689023972345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,696918645795824882,18314839689023972345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,696918645795824882,18314839689023972345,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,696918645795824882,18314839689023972345,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,696918645795824882,18314839689023972345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,696918645795824882,18314839689023972345,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,696918645795824882,18314839689023972345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,696918645795824882,18314839689023972345,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,696918645795824882,18314839689023972345,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
045f179510d23eb6cf3c636daa32f86b

SHA1
ce388e29e667426e1045d84677f7dce21f829d6a

SHA256
83b0fe50daa0bdb745dca2a11c06fb73e7128805c32626bc9be6c9faba614e89

SHA512
294a417ce5aa647bd4b37ced767e9cfec6d67c2a6cfd11c85dc38e5e8607520f6c21144eef8c18b769346d80f83194ae07d5a40bc422a8575057af31665e0fc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4667ab0fc27837d8feca50f89b1b9ce4

SHA1
f27a4c5a2dabe20ca82a0c134346ef9a21795db5

SHA256
86e2fde9f76d3c6f7f57bc84e52effe18596ad7aecd14e2210c7414007d24099

SHA512
873bee211814081452de53579f6bd8b2c739f2a915a85ac61a289f0da053d6ca69580467b3407a544de677159baef37b0c4f0b9af3bb89552f491a7a031d69a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4c64507e9ff922d2be8615d1c7d62968

SHA1
aa5d845dca43c54f3578ee0363ec2e53a8206010

SHA256
8a05123368fc0a9ac7c65eb45738fa26e2f16fdb938234f64e78439be4c71035

SHA512
55b7ff9d29c050dddb7f42d79bfd8e6dec306248f45c19e84e13d3d53ec88711620dd0824d627f7d6518e2d3e8bde7e0608a222df310e55b857473452340e144

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
941bfeb78eca68f4e6207a9bd8169ac8

SHA1
b2ba0218ba45cfecb8eb18aed392f9cb45c4006d

SHA256
1382a75e98fa785a13dbcc60c75f5fcdc6bade9594a9246e1f3e646fb621a70d

SHA512
924d404582e0f3452f5e9ac73f4ed4b00b9791f29128a12da974b2d6b6d546cfe3687061fe24c037092cf093db3e5339530170665b799c9322c4651c3e7255c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
78f702df4323f45c788ebdbe3165fdee

SHA1
2a88ab67824bebc4b4a55c53f85fe6554f150bba

SHA256
6be05bad4101756697bf3a5d5d5461d2e67d79e1224a7b789fe8eb2ade369a58

SHA512
04556a5c1d4ec71849b2b25e3c880d293cc2eec05256d273c04e34b96a166e4e5dbe09638ee66b1570a0c586131b33155a8bcf5f48a59373f662960b6664906d

Download Submit