4252cd1f98267be290e49050c54363066067d0b4871ddb67cad8f86b7799aef5

Analysis

max time kernel
145s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 10:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e2a1d4bce6073fedf3f4376a94df401_JaffaCakes118.html
Size

140KB
MD5

6e2a1d4bce6073fedf3f4376a94df401
SHA1

2980a4c4d1ba9063ec5a3071134127441024e154
SHA256

4252cd1f98267be290e49050c54363066067d0b4871ddb67cad8f86b7799aef5
SHA512

c51b93abd002134facbfe7add092364bfda6fdfce32b25d818b84c0a8f55b063336e4a4f05c54464fcd906b634ae7a9731144ed89a739b9cfff6bb2475382ff5
SSDEEP

3072:0qUGGQ4pn575yfkMY+BES09JXAnyrZalI+YQ:05/5IsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2856	msedge.exe
2856	msedge.exe
2196	msedge.exe
2196	msedge.exe
3852	identity_helper.exe
3852	identity_helper.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 1132	2196	msedge.exe	83
PID 2196 wrote to memory of 1132	2196	msedge.exe	83
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 1156	2196	msedge.exe	84
PID 2196 wrote to memory of 2856	2196	msedge.exe	85
PID 2196 wrote to memory of 2856	2196	msedge.exe	85
PID 2196 wrote to memory of 1008	2196	msedge.exe	86
PID 2196 wrote to memory of 1008	2196	msedge.exe	86
PID 2196 wrote to memory of 1008	2196	msedge.exe	86
PID 2196 wrote to memory of 1008	2196	msedge.exe	86
PID 2196 wrote to memory of 1008	2196	msedge.exe	86
PID 2196 wrote to memory of 1008	2196	msedge.exe	86
PID 2196 wrote to memory of 1008	2196	msedge.exe	86
PID 2196 wrote to memory of 1008	2196	msedge.exe	86
PID 2196 wrote to memory of 1008	2196	msedge.exe	86
PID 2196 wrote to memory of 1008	2196	msedge.exe	86
PID 2196 wrote to memory of 1008	2196	msedge.exe	86
PID 2196 wrote to memory of 1008	2196	msedge.exe	86
PID 2196 wrote to memory of 1008	2196	msedge.exe	86
PID 2196 wrote to memory of 1008	2196	msedge.exe	86
PID 2196 wrote to memory of 1008	2196	msedge.exe	86
PID 2196 wrote to memory of 1008	2196	msedge.exe	86
PID 2196 wrote to memory of 1008	2196	msedge.exe	86
PID 2196 wrote to memory of 1008	2196	msedge.exe	86
PID 2196 wrote to memory of 1008	2196	msedge.exe	86
PID 2196 wrote to memory of 1008	2196	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6e2a1d4bce6073fedf3f4376a94df401_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb42bf46f8,0x7ffb42bf4708,0x7ffb42bf4718
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,2890484034248992419,4948204918178732913,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,2890484034248992419,4948204918178732913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,2890484034248992419,4948204918178732913,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2890484034248992419,4948204918178732913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2890484034248992419,4948204918178732913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,2890484034248992419,4948204918178732913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,2890484034248992419,4948204918178732913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2890484034248992419,4948204918178732913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2890484034248992419,4948204918178732913,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2890484034248992419,4948204918178732913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2890484034248992419,4948204918178732913,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,2890484034248992419,4948204918178732913,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4952 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
61e8e13e5454e88410e41d531d1c71d9

SHA1
c0170fccc437658227749c5faa60a58a2a3384f2

SHA256
b5df123b106944222652a55aef025b1af09a399dcf5afc3d55b43d1490360830

SHA512
83b994ac454097abdf88275a7c0aa4e1443d131e7cb4fee63430b85e1737fb2b640d65a0f0b87e0a1a057c226c10c2816fee97a392d4c730a2c963a1be173465

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b1af47ec28e6b1d8344628929e92c5dd

SHA1
b510ddb74113be9a9ca3ab9b0e8e13068dff3dfe

SHA256
6a1f3ff9a10554ad5eb3f071fd18c3d596466d1352e5988ed5a68b987af91ad5

SHA512
5c6c648b140d6c1d6133c034b9183d628cb2b9c03af4da304252f14ac2d119745c16379fd7419dc24f4ccc62f505b0aa0a0963779c1df7048ab6c1af72da0f91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3ef13ed576c57c33eb2483445cc3a39d

SHA1
9b791d8acaecf9be6a983ca2f66a8ed33512666b

SHA256
7035cb37234193eb7cfee195855755625bebff831febc1811d5b83278d77bc8d

SHA512
0c5aaa77f643602afee8a3f6fdddc2c2ac5f6dee27d55b19fac81e6b059fb2a9000b426eeff6f685bb71be39fe45339e846bbbb58cad2ead90097bfbb1df9d66

Download Submit