1a79a4a33cb8d1708f59fd16a2fa39ed1a5687a2591124612cf5cbd3f10e647d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 11:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7567d7b899c7f355139dda4201ac9510_JaffaCakes118.html
Size

32KB
MD5

7567d7b899c7f355139dda4201ac9510
SHA1

b251057c5b9d0ec1b8451ecb58166b26c38252f1
SHA256

1a79a4a33cb8d1708f59fd16a2fa39ed1a5687a2591124612cf5cbd3f10e647d
SHA512

65e0abf454e1eaeb8c0855951494d195b1eded972cada11c5ed8910634c9d954547824cef1d72469a8e6e07687303a448f76932c3c4cb0012a0ea6876a222127
SSDEEP

384:dVCoIblj6wcoATuDSSsQod9/bJcXi35c8Hy9nEu76abYadt6F1HvC4ixgorDB5eA:BJHy9nEob36mrd5+4

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3044	msedge.exe
3044	msedge.exe
4684	msedge.exe
4684	msedge.exe
3224	identity_helper.exe
3224	identity_helper.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 1192	4684	msedge.exe	83
PID 4684 wrote to memory of 1192	4684	msedge.exe	83
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 1464	4684	msedge.exe	84
PID 4684 wrote to memory of 3044	4684	msedge.exe	85
PID 4684 wrote to memory of 3044	4684	msedge.exe	85
PID 4684 wrote to memory of 924	4684	msedge.exe	86
PID 4684 wrote to memory of 924	4684	msedge.exe	86
PID 4684 wrote to memory of 924	4684	msedge.exe	86
PID 4684 wrote to memory of 924	4684	msedge.exe	86
PID 4684 wrote to memory of 924	4684	msedge.exe	86
PID 4684 wrote to memory of 924	4684	msedge.exe	86
PID 4684 wrote to memory of 924	4684	msedge.exe	86
PID 4684 wrote to memory of 924	4684	msedge.exe	86
PID 4684 wrote to memory of 924	4684	msedge.exe	86
PID 4684 wrote to memory of 924	4684	msedge.exe	86
PID 4684 wrote to memory of 924	4684	msedge.exe	86
PID 4684 wrote to memory of 924	4684	msedge.exe	86
PID 4684 wrote to memory of 924	4684	msedge.exe	86
PID 4684 wrote to memory of 924	4684	msedge.exe	86
PID 4684 wrote to memory of 924	4684	msedge.exe	86
PID 4684 wrote to memory of 924	4684	msedge.exe	86
PID 4684 wrote to memory of 924	4684	msedge.exe	86
PID 4684 wrote to memory of 924	4684	msedge.exe	86
PID 4684 wrote to memory of 924	4684	msedge.exe	86
PID 4684 wrote to memory of 924	4684	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7567d7b899c7f355139dda4201ac9510_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffca1246f8,0x7fffca124708,0x7fffca124718
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,9238369902932665920,9259759308799707782,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,9238369902932665920,9259759308799707782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1468 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,9238369902932665920,9259759308799707782,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9238369902932665920,9259759308799707782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9238369902932665920,9259759308799707782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,9238369902932665920,9259759308799707782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,9238369902932665920,9259759308799707782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9238369902932665920,9259759308799707782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9238369902932665920,9259759308799707782,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2080 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9238369902932665920,9259759308799707782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9238369902932665920,9259759308799707782,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,9238369902932665920,9259759308799707782,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6040 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
468B

MD5
845edc1fd1dfe54a228aa006dab45f59

SHA1
0f5fe2187e6cebd5d8dd558bb393402abc60288f

SHA256
7fcf14998bb93c47ff1a1cfe7f9f64a56b23f725cfe1a4442d937bcc980d63e0

SHA512
eaa4855ae54c1028e81d68355ba0f7fa3fa36f07c70c84bf27a7782eaba06d729549bd565358bc758678ff40eacd9cd2a02c09d0d6856e1fe19cce7798383943

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dc3d5b003f6063da3d1c802340d5942a

SHA1
cef8d8a9b7d12d5fb0dffe5947c90dc8f1954bfd

SHA256
c28346eaf7b00a2e4b9c1b02c5b22c4ca1fce0bf6fee0167e4f0cd874e2db74b

SHA512
bf5f4fa922e10a1cdc81ba76cecdae0eceafcc86ad37e2f16dda8b292439895765e2e74f5cef13ce597f58f121afc7336867636c2a285ab9d1f113635eac30b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c8d4fca54c3cffff7297127729f63d0f

SHA1
f7170326463cdab189c796e26171b6cd2b063be2

SHA256
cb0ff920d3d5506a867b6e5f08daa2d96569bcc6b0f5426acb0f2ec5c68afb4c

SHA512
9c547c4da6dc51220d160a7d6a6d30e7a06fce2e8ff5345057f705d698dc2996c1fd280d44e7ba941f63637b494fcf41d754420fcb9cd2abefa07415647aabf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c5fb6b27f50345b32660b991a61c0625

SHA1
8101382a32a5e9e9c5ce3d3ee0ac83d5bf56e5e5

SHA256
d4e9f3105c9891fa1c4a08ca6a7474f5f5637eca99406ecc1d0093f75db407ad

SHA512
5824d7e1302437a44e4a2ecb0291e03b4bdf2eb6d940da36464fef10586cf034a4c1854c0c917d243b7839f71df87a37d49e5584b42694d6843e1db33248ebd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ebfa8b6e-f18d-4a0b-9a2a-6291dce10240.tmp

Filesize
11KB

MD5
b765089efb316fc7b65603382fa6fb56

SHA1
cc65d68089522b08b28f93b45f78eaa59a4a8e40

SHA256
a015565f1c92f3d8a88e7780982bbc7924777ce0277450de35a213bcadf82de2

SHA512
450cc72c9b5fa156f75c489805a3a941ebdc1c9e14d8c8f9239dc0bf23ceab0d5fb469a971e86a4d34f61ff6de270adceb7a184908fdabdfb30f3d139fb3183d

Download Submit