b4bce358b62145f2e56dbf4a2ad050e3e9185374a8a9c3cadc30b94605c5c8a2

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

862df233a8e3f93b17a45d68ca2ecac0_JaffaCakes118.html
Size

30KB
MD5

862df233a8e3f93b17a45d68ca2ecac0
SHA1

21870a18cb89b72620ceb822efdb51dc3fb8dd2c
SHA256

b4bce358b62145f2e56dbf4a2ad050e3e9185374a8a9c3cadc30b94605c5c8a2
SHA512

7d6d0e03e5209834b9805beaff05084fe6df7d5f3999249488a16c018c8f53284c1da04a9c4908e0224526d3b2cc1541c357c6e020607cc61596dc1c72aa1394
SSDEEP

384:SbHAoGzygTeyUtTmF3i2hV+5c5aGUvMt/FHn76xKZyRtcfx3yn:SbizyIeyUUO5EAI6x4yn

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
15	sites.google.com
10	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
400	msedge.exe
400	msedge.exe
620	identity_helper.exe
620	identity_helper.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 544	400	msedge.exe	81
PID 400 wrote to memory of 544	400	msedge.exe	81
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 1436	400	msedge.exe	82
PID 400 wrote to memory of 4412	400	msedge.exe	83
PID 400 wrote to memory of 4412	400	msedge.exe	83
PID 400 wrote to memory of 3452	400	msedge.exe	84
PID 400 wrote to memory of 3452	400	msedge.exe	84
PID 400 wrote to memory of 3452	400	msedge.exe	84
PID 400 wrote to memory of 3452	400	msedge.exe	84
PID 400 wrote to memory of 3452	400	msedge.exe	84
PID 400 wrote to memory of 3452	400	msedge.exe	84
PID 400 wrote to memory of 3452	400	msedge.exe	84
PID 400 wrote to memory of 3452	400	msedge.exe	84
PID 400 wrote to memory of 3452	400	msedge.exe	84
PID 400 wrote to memory of 3452	400	msedge.exe	84
PID 400 wrote to memory of 3452	400	msedge.exe	84
PID 400 wrote to memory of 3452	400	msedge.exe	84
PID 400 wrote to memory of 3452	400	msedge.exe	84
PID 400 wrote to memory of 3452	400	msedge.exe	84
PID 400 wrote to memory of 3452	400	msedge.exe	84
PID 400 wrote to memory of 3452	400	msedge.exe	84
PID 400 wrote to memory of 3452	400	msedge.exe	84
PID 400 wrote to memory of 3452	400	msedge.exe	84
PID 400 wrote to memory of 3452	400	msedge.exe	84
PID 400 wrote to memory of 3452	400	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\862df233a8e3f93b17a45d68ca2ecac0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd5e2e46f8,0x7ffd5e2e4708,0x7ffd5e2e4718
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,17388820855085227936,8479672347008012345,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 /prefetch:2
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,17388820855085227936,8479672347008012345,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,17388820855085227936,8479672347008012345,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17388820855085227936,8479672347008012345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17388820855085227936,8479672347008012345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,17388820855085227936,8479672347008012345,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,17388820855085227936,8479672347008012345,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17388820855085227936,8479672347008012345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17388820855085227936,8479672347008012345,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17388820855085227936,8479672347008012345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17388820855085227936,8479672347008012345,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,17388820855085227936,8479672347008012345,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
701B

MD5
79ad296506d6989c4723e9b76659f852

SHA1
bc73ed1526e162c4c30b13beabb903d6c0b18794

SHA256
28e8e6fcf1082b1e1572419674b7754ef860f625683fd6cb8b943461b2f11f86

SHA512
4d02d35316579d63d74b73f010c7b0018416293e167a3e1f7a21663e11a4bfd23c989031e8dea7e041bd45e54b002b19e0dccbef4023e15dccbf2fa7963dc243

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ea78a869cd88c8b8552419309d88e6e3

SHA1
577ddb6b8645688b48d487be25bf20640d72ffb3

SHA256
c6512aca25b56ce368f16a180d80acfda0c7117d0d6af1c3236f91e8b6c5b613

SHA512
7b78b0cd53fca868f29719c4b653cd4c86170df503b6eb7516c42d10dc0c914e1b1d81e6058890693ad44d87c0fd13a46f956495e0dc4ee157e858219b5bab6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c5a02fbf7421de5455717d26bbb10814

SHA1
4a0cf339cf5db35e9da516474eab3b5965fde225

SHA256
e3201c11fd54179b9a37cd24ddac4c9e79163eab3c83cbadc42f793e29bcc18e

SHA512
b14954a99bddaaa99f96123c53a764e248807f6ec9826c500350bb38835428c7d1d7926da1de203f4d2cf6bbb21a00d526016b6844970e7a052884ccf54fa764

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c63734125b6cfc1bcadd3479fb7ff436

SHA1
33b42a689e050c7ad04412e0287586f8d8fe5340

SHA256
b32c1ca8ec66d48a9ee23266c4df868b9c1226ddbe12378766f271c60c495d9d

SHA512
9a3042fa1a2e6bc8b0cf11449c9063d60071805ee1a720e7eae14f9bec69f49cf3c93a2cd3a35b47356e860afb77b02354132b325eb5961371ec5636b14b60b6

Download Submit