f00d06a24ad8844537c9681c0e2f76d39ab3311af5b41572c362c2991207e2c3

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 03:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70b40f853096700dce8824773b4fb93f_JaffaCakes118.html
Size

49KB
MD5

70b40f853096700dce8824773b4fb93f
SHA1

7363bdb86c2282049da7bd2cf38ca4c83b26c100
SHA256

f00d06a24ad8844537c9681c0e2f76d39ab3311af5b41572c362c2991207e2c3
SHA512

58ba0d20487566097cfe87fd333b24f89defec156438f34e32d8226a63412a46e08383afb0a64c10f61302c2c463557fba64433d32797c4b99a584ed98e9b40c
SSDEEP

1536:6pJy6IgDZAZ9q//oHApFQez8kvjnxedvd:6pJy671O9qwH4OS8CxI

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3948	msedge.exe
3948	msedge.exe
2664	msedge.exe
2664	msedge.exe
4668	identity_helper.exe
4668	identity_helper.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 1056	2664	msedge.exe	82
PID 2664 wrote to memory of 1056	2664	msedge.exe	82
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 4448	2664	msedge.exe	83
PID 2664 wrote to memory of 3948	2664	msedge.exe	84
PID 2664 wrote to memory of 3948	2664	msedge.exe	84
PID 2664 wrote to memory of 3628	2664	msedge.exe	85
PID 2664 wrote to memory of 3628	2664	msedge.exe	85
PID 2664 wrote to memory of 3628	2664	msedge.exe	85
PID 2664 wrote to memory of 3628	2664	msedge.exe	85
PID 2664 wrote to memory of 3628	2664	msedge.exe	85
PID 2664 wrote to memory of 3628	2664	msedge.exe	85
PID 2664 wrote to memory of 3628	2664	msedge.exe	85
PID 2664 wrote to memory of 3628	2664	msedge.exe	85
PID 2664 wrote to memory of 3628	2664	msedge.exe	85
PID 2664 wrote to memory of 3628	2664	msedge.exe	85
PID 2664 wrote to memory of 3628	2664	msedge.exe	85
PID 2664 wrote to memory of 3628	2664	msedge.exe	85
PID 2664 wrote to memory of 3628	2664	msedge.exe	85
PID 2664 wrote to memory of 3628	2664	msedge.exe	85
PID 2664 wrote to memory of 3628	2664	msedge.exe	85
PID 2664 wrote to memory of 3628	2664	msedge.exe	85
PID 2664 wrote to memory of 3628	2664	msedge.exe	85
PID 2664 wrote to memory of 3628	2664	msedge.exe	85
PID 2664 wrote to memory of 3628	2664	msedge.exe	85
PID 2664 wrote to memory of 3628	2664	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\70b40f853096700dce8824773b4fb93f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff92b3a46f8,0x7ff92b3a4708,0x7ff92b3a4718
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,10669140568979176185,9435208455989246326,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,10669140568979176185,9435208455989246326,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,10669140568979176185,9435208455989246326,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10669140568979176185,9435208455989246326,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10669140568979176185,9435208455989246326,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10669140568979176185,9435208455989246326,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,10669140568979176185,9435208455989246326,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,10669140568979176185,9435208455989246326,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10669140568979176185,9435208455989246326,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10669140568979176185,9435208455989246326,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10669140568979176185,9435208455989246326,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10669140568979176185,9435208455989246326,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,10669140568979176185,9435208455989246326,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
7a27373302dd6a7844f7364fb4a1fe7a

SHA1
8e068573f2547333d7f9c0d27082cffe0f6e3fac

SHA256
cf622ddb6dbbce59d114ca69ece6d33b10686c3d623e72f5f0674cd3117adfaf

SHA512
8a719c7446426a35e91a65506fcf692b11badd5379e2dfad4b8b9c86b882ee741c419e86e198fe71a851c49a2f6790c2172cb291ba0a342f357e71512be54d0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
419B

MD5
4d91752df7bd3279a570d1d64e62e168

SHA1
fcfdd8d7967e47a58d1ec6e24cc5cfde73642894

SHA256
a1565f82bd0631aedf154fa1eeeb41d46e6c3adee0bba291089eaa4b124398a8

SHA512
19d65efd3987559180ed1bcd2471f4ed492924604ffae75e4bac4b20931cd44f09413cbfaff951b158335f95f5fe76f92aebe0eaa448aa91345df8a0da3983af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
886b319c167e5ebef87459a4f90119ee

SHA1
703feebef93c169bc01a9189d77f266730b9badc

SHA256
698d854aa882c134b690f1958d6cbd947165eb5bc4bbd2644e86253a17eb8f37

SHA512
9cdbae7f925011f15a546fd0f6ab0d3e7d93e2ea24bad3e11f2424c6e2844694ced36c6879457f201039f575b051d151fe0ffd7e7b22919b85fa92b0545ce7d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fbb62b142d226f2cd719fb6ba80d5580

SHA1
d4a64ebae911d266c7b89e0bde83d3513342ed55

SHA256
7fe4a5475cd54a2e3e18eb894cd3604acc4fde80c99832c04cd5c477eb9eac64

SHA512
edb2e533b8f671c6c495a608005256347c719a4ad1483b9d77b9d39ee7ec4b32daf591a09ca5d64a204fda4c4efbb24e4227a08d5c88fa56bc78aeaf5db49ace

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6f339de662ab9a0edc78bc1fa86e3dab

SHA1
d6978ce309d7689caaa455ec160614b145f38572

SHA256
644a752e82970484ac4bd2492ff6f10105cc9e5fd7f045cca9317a4ae8eb0c5c

SHA512
5b1573aa292adbe0056dba957054e15dc28aaa380dea7ff6e631526d88bbc13e0e4235465b1b8f87bd27ef991f3cb1baefebb824fa9c9f0bb8fac6e27b15d852

Download Submit