a5a2405044b49849e541128cf502441fde3684dd071da88ad8c8628fda1da858

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 21:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8bde529cc589fffbe48abd2c1ac151e3_JaffaCakes118.html
Size

224KB
MD5

8bde529cc589fffbe48abd2c1ac151e3
SHA1

9bd8154954e43e86293fa096e2896b841de97400
SHA256

a5a2405044b49849e541128cf502441fde3684dd071da88ad8c8628fda1da858
SHA512

cf264a85ecf5b61d3b1bf811a8959d6f67c86a8162c82820379c7b96863fd67715ce4a8ac8b9ea49084598fc15446c29030c4b6c3558223f6306b144edc0dcdf
SSDEEP

6144:eNxh1egRCtBmIZNO77eKQwyyJyc97eMqjGNGaee+CYKQq2Nm6W33Xa8t8KNh0FzO:26W33Xa+8KNh0FZmfv

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3524	msedge.exe
3524	msedge.exe
5056	msedge.exe
5056	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 1616	5056	msedge.exe	82
PID 5056 wrote to memory of 1616	5056	msedge.exe	82
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 4064	5056	msedge.exe	83
PID 5056 wrote to memory of 3524	5056	msedge.exe	84
PID 5056 wrote to memory of 3524	5056	msedge.exe	84
PID 5056 wrote to memory of 1928	5056	msedge.exe	85
PID 5056 wrote to memory of 1928	5056	msedge.exe	85
PID 5056 wrote to memory of 1928	5056	msedge.exe	85
PID 5056 wrote to memory of 1928	5056	msedge.exe	85
PID 5056 wrote to memory of 1928	5056	msedge.exe	85
PID 5056 wrote to memory of 1928	5056	msedge.exe	85
PID 5056 wrote to memory of 1928	5056	msedge.exe	85
PID 5056 wrote to memory of 1928	5056	msedge.exe	85
PID 5056 wrote to memory of 1928	5056	msedge.exe	85
PID 5056 wrote to memory of 1928	5056	msedge.exe	85
PID 5056 wrote to memory of 1928	5056	msedge.exe	85
PID 5056 wrote to memory of 1928	5056	msedge.exe	85
PID 5056 wrote to memory of 1928	5056	msedge.exe	85
PID 5056 wrote to memory of 1928	5056	msedge.exe	85
PID 5056 wrote to memory of 1928	5056	msedge.exe	85
PID 5056 wrote to memory of 1928	5056	msedge.exe	85
PID 5056 wrote to memory of 1928	5056	msedge.exe	85
PID 5056 wrote to memory of 1928	5056	msedge.exe	85
PID 5056 wrote to memory of 1928	5056	msedge.exe	85
PID 5056 wrote to memory of 1928	5056	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8bde529cc589fffbe48abd2c1ac151e3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed0d246f8,0x7ffed0d24708,0x7ffed0d24718
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,10095617816456980228,15928229356723359427,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,10095617816456980228,15928229356723359427,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,10095617816456980228,15928229356723359427,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10095617816456980228,15928229356723359427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10095617816456980228,15928229356723359427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10095617816456980228,15928229356723359427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2336 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,10095617816456980228,15928229356723359427,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4804 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
af9e3a42aa68c7930fc5fd3d342f714b

SHA1
b96649b147e46acde87b3c3ff2b4ebecc72c87a3

SHA256
8ce667932261234ce0fd3312c89969150ebb653cfbd4813e5e019d58de7d4a76

SHA512
4b0879b3460bc39f3c2304461428d6d8140a0654439d955b9bbc6af1584143b68a31dfaedf1be81b726c755eaec60e7a894863dd1c137e7f736168c13692a9b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
aeb3a4e256268b1a6f8c916e6efc5dd9

SHA1
f167f7ae0a86572a0a45189defb661f655980d45

SHA256
d2853e07bb2e7c5f2a57856c28c217f4c6441a102fab58cf13b8c2406c36a47e

SHA512
4cfdb6683c6d472635cb3a249c6653e6e1496350157e4c53de6acca623e99c2966baf2e0c1d036a02543f09051db3916dc676c0c6beb93882c5cb2092a53a5f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f084cafbb3cee3c09bb0d376867249a6

SHA1
cb6226ee141e393faf55fb91ffd6753f25a46401

SHA256
87d4f68cf560a3224fde626806d1fc9c0721e505717f24e41fca1a3d2c2d753c

SHA512
0a8c5fb00b97fb0146c04659e9928e5c0c50a053ab5009555d7da91f37ddbf81985cef50baffef32480a5ed230558b4e5340fd09cdb509ac7cd010e80fad9fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
718e3e407f539d383ace33376df95212

SHA1
a3d569948f2a390faebcc2d7c20b00b49be5dff8

SHA256
da5ab6d5b3decf5d35ddaf2e699f4538d4af6c5dfec473cbf3f0ef8c1282461c

SHA512
d41ba1ab1c0825c1d1e1673fcf50c35d959bfd32c8a36720af6314dea52e63e1a86e0ddc5a16e0d577ca807b996d571a5aec64886086d4aabdd9db4fd877e119

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a2a7867ea5d99159b7c6a13f28bff728

SHA1
5e5a957d1d255e1b9ed8d508026af36e83fe0e7b

SHA256
56fd457c982f4138e71fe166de3b5a2d87bd16b854f76f2cdd983a4f483b2336

SHA512
4a677d893fff133e0690e942be41438fcbfec91fb8775c0683621d00d7b1163836cb3342065fe566ba8cd1fa31fa8f80fdeaf5e8dd4bf86f457a7431bc2bd945

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
525111243e52a8ca9fa7f77d5b4f075f

SHA1
3879cb7b3596db82f178573a81498013fec3b6a7

SHA256
8904ed3427290b71658d97bc82d64903c5dfeac86d198914d9a31a42a2ef0c02

SHA512
5096e50a566b7814b9b7190aff08c4d4f8a261974c2f9006039f0f2d785a502e21a55417d394af7f6ef201f255727230becb513cd042a7296811e9970f92f118

Download Submit