e92ae26466a3d27d3c6a68f9b892908577484eead0d2530c78e3e96446e3073e

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31-05-2024 22:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

888c9870a408774cbb9fe07559783231_JaffaCakes118.html
Size

41KB
MD5

888c9870a408774cbb9fe07559783231
SHA1

0afea93dc10c55158f04e59ccb49b925b5fb5df1
SHA256

e92ae26466a3d27d3c6a68f9b892908577484eead0d2530c78e3e96446e3073e
SHA512

d1653bd99aae820e35e9459e19bc88e003494ab1406c12b5ed60051a7a9300f8416f4f836978e86f842972eb93aecaa6a3066796d09ae84abe50b2387310b5d9
SSDEEP

384:YM4xfBdZZilw0A4JmRDspVwQ/vqFG3uhCXxBleffSeKZXB4ron4n4L34UNyahAKW:xyi38FNr

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
780	msedge.exe
780	msedge.exe
2816	msedge.exe
2816	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 1820	2816	msedge.exe	82
PID 2816 wrote to memory of 1820	2816	msedge.exe	82
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 1472	2816	msedge.exe	83
PID 2816 wrote to memory of 780	2816	msedge.exe	84
PID 2816 wrote to memory of 780	2816	msedge.exe	84
PID 2816 wrote to memory of 2708	2816	msedge.exe	85
PID 2816 wrote to memory of 2708	2816	msedge.exe	85
PID 2816 wrote to memory of 2708	2816	msedge.exe	85
PID 2816 wrote to memory of 2708	2816	msedge.exe	85
PID 2816 wrote to memory of 2708	2816	msedge.exe	85
PID 2816 wrote to memory of 2708	2816	msedge.exe	85
PID 2816 wrote to memory of 2708	2816	msedge.exe	85
PID 2816 wrote to memory of 2708	2816	msedge.exe	85
PID 2816 wrote to memory of 2708	2816	msedge.exe	85
PID 2816 wrote to memory of 2708	2816	msedge.exe	85
PID 2816 wrote to memory of 2708	2816	msedge.exe	85
PID 2816 wrote to memory of 2708	2816	msedge.exe	85
PID 2816 wrote to memory of 2708	2816	msedge.exe	85
PID 2816 wrote to memory of 2708	2816	msedge.exe	85
PID 2816 wrote to memory of 2708	2816	msedge.exe	85
PID 2816 wrote to memory of 2708	2816	msedge.exe	85
PID 2816 wrote to memory of 2708	2816	msedge.exe	85
PID 2816 wrote to memory of 2708	2816	msedge.exe	85
PID 2816 wrote to memory of 2708	2816	msedge.exe	85
PID 2816 wrote to memory of 2708	2816	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\888c9870a408774cbb9fe07559783231_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffcc77946f8,0x7ffcc7794708,0x7ffcc7794718
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1615877260674702851,1956870483493510996,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,1615877260674702851,1956870483493510996,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,1615877260674702851,1956870483493510996,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1615877260674702851,1956870483493510996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1615877260674702851,1956870483493510996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1615877260674702851,1956870483493510996,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3036 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1615877260674702851,1956870483493510996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1692 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1615877260674702851,1956870483493510996,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1740 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,1615877260674702851,1956870483493510996,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:1804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\70ea5b9e-e1d1-4b3c-a7f2-f98214deffd9.tmp

Filesize
10KB

MD5
c76caabc1e340e88157da7f6aa8995bf

SHA1
60925727ba8c07a7560925eb250a586b2a2b5bc3

SHA256
faa0d2aa9a0b4ef3a1510560bee99bb20a20b6538f097aaf3c2823c5eeee4045

SHA512
d3d34d9b39a36f7a39babcaab7d3cb8d8651b8c4d128b6e35404ef6ac1b9a911083ad44e8e6f83300b5a0c4bdf2beb4e3a7ab3fcf40352b19360ba6d568cc6e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
150b1cb57b06fd174ca578336824998e

SHA1
8feec6b37cb80e90fa583570ca3134823f45cb98

SHA256
638fe8f1f4b4f42aeaa869ad1921d6a16b7aadec04c2faba2071f7c8922d2554

SHA512
0c1a25931de8da25bbf922ae3e44c40a756f3dbcef0038decb5bb63f7c6e9329a8d2f9e5df2a7113b9e671d20efed36fd5f87c6ec0bf94863cd4f2a239894f99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8cafcb8025ffa4392b392d255c21b098

SHA1
28eba208ca2d4773e3ed9270143a9e01976a11e4

SHA256
067b3cd462827a1c6a8672514622ef1708521cd3802e7f1ce35a70775d2744a7

SHA512
5eb0ed98d0a10e8475672b2ba62fe83eba44b60c5626c1cb0a06711c1ad9760bd6947e88cba737ac8f5fafdd7e98fd03a4e9f9d83dd152384d4029f6b11aa0e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
19a4a69a4d066cfc69c0dd0fecc692be

SHA1
e6b6d33065dac3c72fcfc1cfe9bdee860fd1a8a3

SHA256
ca0faa8eca7f836df5eee06235170d5711e9ef00835bb35d3223cc9761499e56

SHA512
760f0b2339c836fb35baec36aa78c4d23da1a4ae247d7863c19da9de43b0ac81a03ffa44f3cf6f13a3c12d1641709b93ca09e3a2f78f61c5d0f907f562f0da06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit