cde51cb79c21ba47f924bb1ebeede8882800f0853dafa192565c2a45553a961d

Analysis

max time kernel
139s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

806ba722e2b2e29fd47285f24f23f711_JaffaCakes118.html
Size

39KB
MD5

806ba722e2b2e29fd47285f24f23f711
SHA1

e0e5151a8d0bdc1881551f4c89a2c238994e2c0a
SHA256

cde51cb79c21ba47f924bb1ebeede8882800f0853dafa192565c2a45553a961d
SHA512

3035719c75d265457616c460f55ab2685fc93bcdb554a980d0ec802078d898f740f674e2094b2f104c1fcd182b67c7ebf420625bd3c8cf93fbe3f2513ca1b012
SSDEEP

768:dB8mHp1YB6CShAkrmG+ZAZ5aHbJUdOEtn8vVV:dB8mHp1YB5SGk6G+ZAZ5aHbJUdOEtn8X

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
4804	msedge.exe
4804	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
3136	identity_helper.exe
3136	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 3492	4804	msedge.exe	83
PID 4804 wrote to memory of 3492	4804	msedge.exe	83
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 1284	4804	msedge.exe	84
PID 4804 wrote to memory of 3020	4804	msedge.exe	85
PID 4804 wrote to memory of 3020	4804	msedge.exe	85
PID 4804 wrote to memory of 1356	4804	msedge.exe	86
PID 4804 wrote to memory of 1356	4804	msedge.exe	86
PID 4804 wrote to memory of 1356	4804	msedge.exe	86
PID 4804 wrote to memory of 1356	4804	msedge.exe	86
PID 4804 wrote to memory of 1356	4804	msedge.exe	86
PID 4804 wrote to memory of 1356	4804	msedge.exe	86
PID 4804 wrote to memory of 1356	4804	msedge.exe	86
PID 4804 wrote to memory of 1356	4804	msedge.exe	86
PID 4804 wrote to memory of 1356	4804	msedge.exe	86
PID 4804 wrote to memory of 1356	4804	msedge.exe	86
PID 4804 wrote to memory of 1356	4804	msedge.exe	86
PID 4804 wrote to memory of 1356	4804	msedge.exe	86
PID 4804 wrote to memory of 1356	4804	msedge.exe	86
PID 4804 wrote to memory of 1356	4804	msedge.exe	86
PID 4804 wrote to memory of 1356	4804	msedge.exe	86
PID 4804 wrote to memory of 1356	4804	msedge.exe	86
PID 4804 wrote to memory of 1356	4804	msedge.exe	86
PID 4804 wrote to memory of 1356	4804	msedge.exe	86
PID 4804 wrote to memory of 1356	4804	msedge.exe	86
PID 4804 wrote to memory of 1356	4804	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\806ba722e2b2e29fd47285f24f23f711_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa6af646f8,0x7ffa6af64708,0x7ffa6af64718
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,14195527474752051495,16253501035653567006,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2248,14195527474752051495,16253501035653567006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2248,14195527474752051495,16253501035653567006,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,14195527474752051495,16253501035653567006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,14195527474752051495,16253501035653567006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,14195527474752051495,16253501035653567006,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3772 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,14195527474752051495,16253501035653567006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1324 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,14195527474752051495,16253501035653567006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1324 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,14195527474752051495,16253501035653567006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,14195527474752051495,16253501035653567006,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,14195527474752051495,16253501035653567006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,14195527474752051495,16253501035653567006,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:3160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\44f83125-b6ec-4473-a914-bc4c0b9a260e.tmp

Filesize
5KB

MD5
3fff78d8b9fffa6fba7e0b32422c7980

SHA1
b294085e6d150ea32598e7ac3630667bb7d69f81

SHA256
f054a4f77325b655f9e90a6df898ad11e2fac1fa1c3441a641f267c4b61813ac

SHA512
0a674bc9f5775d744070e21fca31e9af80e015415864718fa40f350a7716aa35003c1bdfbf49fb0c76972e99aae96f782a80569b2fe808571aed95e39a14460b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d4261771cb4b0c6ebc51f2d7997c1dc0

SHA1
9368b64592bfaedbc460285aabd77895ee9a26f6

SHA256
6e743b4ae752f53c285d802bd70bf810535d55beba9331d1a67105253cf89994

SHA512
42ac1c55f111576d6d2c031eaa9ab4814b35bfc7a3443bf46d799cb950aa776b09a7793a7013722fa285c7dfaa70e01af3cca337c2906fdaa3f7097baa12dd3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a7f11214d992cbad83f359f4df3400b8

SHA1
b17a14e1519eebd2bf953f5ea2ebcec53adea262

SHA256
19c65a8157839cd47c20d7c6e6fdd1e91a73f1c31ee9488358db71febd813415

SHA512
9d9fae802b7a455eaedf7ae4a35cf5f9b9e671b1277786d98bd528a3ab2451c9477bf022fc67d7e0840b2708b206e1e2bdb06350437d0985eb95a8a8bcf5a1df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
53d350cef579aae5da36cbd5d8df06a1

SHA1
bba2e6f3d99057ae15ede54d03949ff1fc11eec6

SHA256
911478bae499b5f7ac759ced117b9b8632dc334f0db528f5d8c4484575187b52

SHA512
7eebc4e925d68379332cf3a056aa365817e8d2b3feff5771463861fdc64f2f58f6f5d812765848a39cb2b6212fc2ba21ba0f79d79db7a275b30a514a8b5fd630

Download Submit