2d65b3ff890d00f972ce89e929e762005a1306abbce60d2631cacbbcfeb35a8d

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e01bc4ef990e5166cfd18c40d0afac6_JaffaCakes118.html
Size

64KB
MD5

7e01bc4ef990e5166cfd18c40d0afac6
SHA1

ed01784d7f9a58877e4b6cbf8292e41224f14ebf
SHA256

2d65b3ff890d00f972ce89e929e762005a1306abbce60d2631cacbbcfeb35a8d
SHA512

8cba5547150ec665bdd9e401612eed7f64528e998c6317433f8f1e2045eb5dd163e9298fa82a2379e6bf439f3edd431e3752c6ab3a185adcee4624d677bba52a
SSDEEP

768:+R1hYFAcTt7GLJeT2/FeE+3AINdTnFFnEjzZ/:+R12AcZ7GLkQeE+3xNdTnF0zx

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
656	msedge.exe
656	msedge.exe
2596	msedge.exe
2596	msedge.exe
4512	identity_helper.exe
4512	identity_helper.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 4268	2596	msedge.exe	81
PID 2596 wrote to memory of 4268	2596	msedge.exe	81
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 1792	2596	msedge.exe	82
PID 2596 wrote to memory of 656	2596	msedge.exe	83
PID 2596 wrote to memory of 656	2596	msedge.exe	83
PID 2596 wrote to memory of 404	2596	msedge.exe	84
PID 2596 wrote to memory of 404	2596	msedge.exe	84
PID 2596 wrote to memory of 404	2596	msedge.exe	84
PID 2596 wrote to memory of 404	2596	msedge.exe	84
PID 2596 wrote to memory of 404	2596	msedge.exe	84
PID 2596 wrote to memory of 404	2596	msedge.exe	84
PID 2596 wrote to memory of 404	2596	msedge.exe	84
PID 2596 wrote to memory of 404	2596	msedge.exe	84
PID 2596 wrote to memory of 404	2596	msedge.exe	84
PID 2596 wrote to memory of 404	2596	msedge.exe	84
PID 2596 wrote to memory of 404	2596	msedge.exe	84
PID 2596 wrote to memory of 404	2596	msedge.exe	84
PID 2596 wrote to memory of 404	2596	msedge.exe	84
PID 2596 wrote to memory of 404	2596	msedge.exe	84
PID 2596 wrote to memory of 404	2596	msedge.exe	84
PID 2596 wrote to memory of 404	2596	msedge.exe	84
PID 2596 wrote to memory of 404	2596	msedge.exe	84
PID 2596 wrote to memory of 404	2596	msedge.exe	84
PID 2596 wrote to memory of 404	2596	msedge.exe	84
PID 2596 wrote to memory of 404	2596	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7e01bc4ef990e5166cfd18c40d0afac6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8eb9146f8,0x7ff8eb914708,0x7ff8eb914718
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,9018758299014100029,12305535554734629131,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,9018758299014100029,12305535554734629131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,9018758299014100029,12305535554734629131,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9018758299014100029,12305535554734629131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9018758299014100029,12305535554734629131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9018758299014100029,12305535554734629131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,9018758299014100029,12305535554734629131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,9018758299014100029,12305535554734629131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9018758299014100029,12305535554734629131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9018758299014100029,12305535554734629131,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9018758299014100029,12305535554734629131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9018758299014100029,12305535554734629131,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,9018758299014100029,12305535554734629131,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
c4a1c2bb995efda032b6ced3f452f460

SHA1
9412c5b6997b53527b416b2745b580bde0a327e6

SHA256
711e65595e8f7f78928b74d53881ca07ce22d2ca365e15242dd2bb2c374031cc

SHA512
06b5660cc12fc3f5ab008f83526639cb41aed27a5b881edfa91d21391809407fbf8ee298c158f893309a1642f2da880b1989c414fdeb395497f207271ba71c65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
30ee2114ef3647f1d67f9aabc00df797

SHA1
e7924b9403ce4ee27c2d662dfec0cacac744f05f

SHA256
6997f51da430e586efe9021c936812c4417fef0b8d313531293151fc412f74e2

SHA512
be24308819ebdd56ce6ce094321277456ef6b8177b0a4201d4345230c6ee815f6b6d7ace2c76432869a32c2ad6c76ce255b0109022d0c6f4e442d6aeafdb3ffc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
eedf702bef75abc8989e17fee2950955

SHA1
447048ee4fba859c72f7c01166ebcf55a4387352

SHA256
83ec6bf04ecb1c3dda16dee2996f6eface83064efb583cfa7fba040832544c1b

SHA512
0644c533280b60186f0218871d72931d6dfda74da021dd42d87a3d031ae5fda43a029a4aa753886b98b93af41dfb6ffa5d0b122b721ff1a646228bdddf75b86b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2a888e3f2e8309df348fb009485b347b

SHA1
4f87568fddad52b6afeefa7631019d8f84008adc

SHA256
7922001bb21a12a0060943986972b2b6abbb0cb92938fef6719a5b800318f563

SHA512
6e28d4bca8a3fe59841b2a19d306dda7e40bcb09187f1910d30908e6bdc1f3f67fd3139499b8cb214e5c0d78fd9361e036c210fac8d843d29f1f9bef23563026

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
37fa4babd5a4267ebc8bc134abdfc41a

SHA1
be2ef39b099ea174bd88e6c762dc82bec47b12c1

SHA256
2c7dfc7d5e9a4a468d9274decf525922d65ddf86550379353175a7bb4b1159b5

SHA512
2a57b3994fa41f34a064965bfa5f5ac7b9975068bc8edc59512a0edc6188f92b3d4b4f71f03e940a322ecc4fdfbd4f0f7c69a2e4252233acd62167e603e5290e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
396c4d13567395ed6019204e54c643f4

SHA1
2551503a6127c1be6a21b8113f6d2594a25e1a05

SHA256
51ba855bd6b62f16c03ba6aeadfc0700b0e2a9ebd1f89448b8fc8f8f295420f3

SHA512
4691b0a82d1c7fbf9651a8a7c61f1b87ad6afd856983abb5022256f09dbaa2799ba67d518d2ce95d6340d086df31018039ba26126f7873b6b206345a6bbed779

Download Submit