714c562f856715f55a6c7f3aac2b8efa7b406f217338f11efff5b08446b07460

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2024 00:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7edc57f5f126ffc81b34068ed399e996_JaffaCakes118.html
Size

18KB
MD5

7edc57f5f126ffc81b34068ed399e996
SHA1

7e4b5d15f48dc83af0efdbc12bf49ca03f0c952e
SHA256

714c562f856715f55a6c7f3aac2b8efa7b406f217338f11efff5b08446b07460
SHA512

f6fe759fe40db2ccf77e361b42f6ce141fabbd01b8bf8a8f97e4e21084cc4ac16e6fe61a0ec01bb0f9b0341e39cd6eb2b1f02e46cd42ccd66a1413d0ae70342e
SSDEEP

192:9K/ypUhTNiq8LTgE9d3v+knIMsyjQ3XCh9neMlUx9V6cxjb79DXS7iFaiC:4/yoTNixLXfW+Q3CWp55i7iMiC

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3912	msedge.exe
3912	msedge.exe
1440	msedge.exe
1440	msedge.exe
2432	identity_helper.exe
2432	identity_helper.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 3848	1440	msedge.exe	82
PID 1440 wrote to memory of 3848	1440	msedge.exe	82
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 2444	1440	msedge.exe	83
PID 1440 wrote to memory of 3912	1440	msedge.exe	84
PID 1440 wrote to memory of 3912	1440	msedge.exe	84
PID 1440 wrote to memory of 1828	1440	msedge.exe	85
PID 1440 wrote to memory of 1828	1440	msedge.exe	85
PID 1440 wrote to memory of 1828	1440	msedge.exe	85
PID 1440 wrote to memory of 1828	1440	msedge.exe	85
PID 1440 wrote to memory of 1828	1440	msedge.exe	85
PID 1440 wrote to memory of 1828	1440	msedge.exe	85
PID 1440 wrote to memory of 1828	1440	msedge.exe	85
PID 1440 wrote to memory of 1828	1440	msedge.exe	85
PID 1440 wrote to memory of 1828	1440	msedge.exe	85
PID 1440 wrote to memory of 1828	1440	msedge.exe	85
PID 1440 wrote to memory of 1828	1440	msedge.exe	85
PID 1440 wrote to memory of 1828	1440	msedge.exe	85
PID 1440 wrote to memory of 1828	1440	msedge.exe	85
PID 1440 wrote to memory of 1828	1440	msedge.exe	85
PID 1440 wrote to memory of 1828	1440	msedge.exe	85
PID 1440 wrote to memory of 1828	1440	msedge.exe	85
PID 1440 wrote to memory of 1828	1440	msedge.exe	85
PID 1440 wrote to memory of 1828	1440	msedge.exe	85
PID 1440 wrote to memory of 1828	1440	msedge.exe	85
PID 1440 wrote to memory of 1828	1440	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7edc57f5f126ffc81b34068ed399e996_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb884446f8,0x7ffb88444708,0x7ffb88444718
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,11515000379802782129,15492552366127806507,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,11515000379802782129,15492552366127806507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,11515000379802782129,15492552366127806507,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11515000379802782129,15492552366127806507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11515000379802782129,15492552366127806507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11515000379802782129,15492552366127806507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,11515000379802782129,15492552366127806507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,11515000379802782129,15492552366127806507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11515000379802782129,15492552366127806507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11515000379802782129,15492552366127806507,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11515000379802782129,15492552366127806507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,11515000379802782129,15492552366127806507,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,11515000379802782129,15492552366127806507,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5100 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c0dab2e0e655b50755bc3046a0af3eb4

SHA1
3f4ca3964f9b8c49efcedb9acf6b4a6cd348f3c7

SHA256
9a1bc6c2ad22514d2269176b6a0ff852bd206405d096ec238676768b075f2cae

SHA512
396593e08c431551cbd6a3982dd26995e32057bba2a3c417d4bc18acef787a271435482059fd227c9032b82af55ae680df554fc681dd8c3edbf8a1b54a7dbf96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
023854612266d4f9ef2c949b8cf89977

SHA1
fe67776599ad86e9e9b7207555b1a3089d12254a

SHA256
935f6983fe5991d9cf84aa9999be904c0d06277057e9b5d45d390f9d8c1fd2f1

SHA512
ce0f7fec68d23666216290b6f00f2538e9721c0348e19b58dfa4c9382c0a26407d262eb3d202117d51c2c84c141cfb4f83afd54864c9f6d0319856fbf21fd7e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
19291b724445453a5b99edf8de2a8653

SHA1
879bae80758b89481d4c299360a3f5bd5706cf32

SHA256
4c9eaa0312937d31715972c7022cd55dfc86d6968659666b07cb865347e598e9

SHA512
6c72505433de603f862f414935cd8e8d6660908969faba2cdc7b1033873e215dd0540453ba66b1a40f5ee07099df3b475677dab04dbf60df1c25802ce06d5093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bb2d7d07-cc3a-4989-954f-0d7bf90b7646.tmp

Filesize
6KB

MD5
d2297e810b4e8881c80c9f8bef08826f

SHA1
e06674cf7c443a6db892372b9fd9ee00cc94198f

SHA256
295baa2e67ad08418e46f92832157c7e801f3eccfc5e166f7934d20dab39b32b

SHA512
6044e949891205277e184a4bc89c2743afc018f340da193cd9e0328bef4a5fda091638d29c7b51d3a86bade4d32fb4e1d711185e2d92ee3a2504dd81cb89f5c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
211e36720ad35ed4dbb72823b3f1c073

SHA1
ce4d69b25896d418b372c5a6b2aaf27b526b2f09

SHA256
aaa2b3fdfea2d629fe9e8e61783f58d5d747c15e66a1a43fcf53ee8ca64a7259

SHA512
d41874429b1b7aa8ec34ee48367e2ae23d102ec40d7fdb125dd514f366baf8fe2b8dd1c0e0b1c4e6d0b28a59b8f3ec5f712a584c00ead12a5ff3ac95ae0e8971

Download Submit