f8708280e518e24d44052a54e4340e2605bdf847aa994cbc38e3fb0568b6d444

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 06:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7117c7c8491334389a7d70c8fa728067_JaffaCakes118.html
Size

96KB
MD5

7117c7c8491334389a7d70c8fa728067
SHA1

7e93e20b28fe88c4bc813c95d44b0658bf8d1d8d
SHA256

f8708280e518e24d44052a54e4340e2605bdf847aa994cbc38e3fb0568b6d444
SHA512

9a2821b397cb81df93cf8587fbb7ad106f6c3eeb0c86b4c85c670d5e95ff30b71b3665482a954a99dabe3b2ac92673230b8c1045a7b4c49bb80c00b33878eb7c
SSDEEP

3072:dF7k0xeZhm0rgfFepkTzlwukYCmgbpY9tUCw:dF7k0QZhm0rrvD

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
208	msedge.exe
208	msedge.exe
868	identity_helper.exe
868	identity_helper.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 224	208	msedge.exe	83
PID 208 wrote to memory of 224	208	msedge.exe	83
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 5116	208	msedge.exe	84
PID 208 wrote to memory of 4268	208	msedge.exe	85
PID 208 wrote to memory of 4268	208	msedge.exe	85
PID 208 wrote to memory of 960	208	msedge.exe	86
PID 208 wrote to memory of 960	208	msedge.exe	86
PID 208 wrote to memory of 960	208	msedge.exe	86
PID 208 wrote to memory of 960	208	msedge.exe	86
PID 208 wrote to memory of 960	208	msedge.exe	86
PID 208 wrote to memory of 960	208	msedge.exe	86
PID 208 wrote to memory of 960	208	msedge.exe	86
PID 208 wrote to memory of 960	208	msedge.exe	86
PID 208 wrote to memory of 960	208	msedge.exe	86
PID 208 wrote to memory of 960	208	msedge.exe	86
PID 208 wrote to memory of 960	208	msedge.exe	86
PID 208 wrote to memory of 960	208	msedge.exe	86
PID 208 wrote to memory of 960	208	msedge.exe	86
PID 208 wrote to memory of 960	208	msedge.exe	86
PID 208 wrote to memory of 960	208	msedge.exe	86
PID 208 wrote to memory of 960	208	msedge.exe	86
PID 208 wrote to memory of 960	208	msedge.exe	86
PID 208 wrote to memory of 960	208	msedge.exe	86
PID 208 wrote to memory of 960	208	msedge.exe	86
PID 208 wrote to memory of 960	208	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7117c7c8491334389a7d70c8fa728067_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed41746f8,0x7ffed4174708,0x7ffed4174718
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,7738069762724918361,8720274063750912508,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,7738069762724918361,8720274063750912508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,7738069762724918361,8720274063750912508,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7738069762724918361,8720274063750912508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7738069762724918361,8720274063750912508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7738069762724918361,8720274063750912508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,7738069762724918361,8720274063750912508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1844 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,7738069762724918361,8720274063750912508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7738069762724918361,8720274063750912508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7738069762724918361,8720274063750912508,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7738069762724918361,8720274063750912508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7738069762724918361,8720274063750912508,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,7738069762724918361,8720274063750912508,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4848 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
94b5fbe87e7f5b6fdcaba316904f0c98

SHA1
92fb1e3e2340bdebfbb67e99a7d67653bf834b25

SHA256
ff2c5775fc859a07a53a02e382d77da8ca1912f8e488228be569dc3cba132ac0

SHA512
637339141aeee3ff1abdb5860a53d7dcc54de002a65f536efe24ebd7c2dc7202e7b107e4eedcef2da155aa8cdd50f42abe0fb8c94a7196ca44ee33ec714c1d1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ebd057970209bf06bc0bbe9810416825

SHA1
a17868156bb858c2c47a17246a05eb8646a40bb2

SHA256
a892686a88c490a94ecee1b9577b0011b763a628d1ea883233cd1168375be6b8

SHA512
463625649036713c6823521b502b0a7d8c1209da16eb404dc21432f81c4e90550dae667064d04cda84a2d16a412528e309224fa8b6358194c756285d7696ed15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a5e39698cd64bb5b7dd3a21521716d30

SHA1
e4baa7646a5bf5b476095ed1ddd51a20e6e1dd6b

SHA256
33023e6ac2d0344cef4e7798e0ed0d3621f8c8ba9679fac53f1e574bfa32eed1

SHA512
deb4c98223d1153a760a5456d4b1128ae93e9cba6705c04a573dc969534740af2352cb8c42acd51038025f59d3e1f793208ade7d9197dda9318d829d0dbefe07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
584aaa94bc5ae18a9e41ee981054ed54

SHA1
eb8429483217e76b98aac6aa3799607abd56ba53

SHA256
3e147640be8f23f11da358c9fd9aa9ff9ade2442b1d6049be46a872da48d65cc

SHA512
f20fce835d74f729d75fa8aec3cebec134517c2d8594b743c1b3cd98563b96114dcd20c7e9451354769b83c9b8aa3e2628ae972958be2a2e685db2fba68f9b77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cb2db6f788e1e1ade1817090162bd99a

SHA1
6fa1af850721549c3b1423fbff5b13c7c42607b4

SHA256
6c272f93a3596e46eae4ceac305a828b015e74d84f0309e3fd18e13430d93539

SHA512
399a6b2e44322055bf493ccd6f41113128be9efca2addd51ff2d46e6f437414dea76c211a85014a571e3d7266d86ad3eb9becde84bd23a4f7ab57f413e3265f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
806de16483534881e5db9fb209734ed9

SHA1
cf53912becd5f6b6f58558428ebbba7c0ca59f60

SHA256
66a8a26987270d7654aecad9e7a93c35355e4074e00eb366f3739124fb4eb6e3

SHA512
92219745e49019696dffbe9307704acd56648c19b642754994e337e959b051e1255b4ee830df818b48c526fe08068bfd1ed4f0075e0a6ce1bfcfda4ec7cd77a4

Download Submit