7017ed14bf2a6f0818dadc2cb7a5e9430bddb9940d121260e6c114dce1c91362

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 06:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

898f40f9490feab92b6604cfd3151582_JaffaCakes118.html
Size

57KB
MD5

898f40f9490feab92b6604cfd3151582
SHA1

6535a2b1f14cde874b287245f19c8858afc44a0a
SHA256

7017ed14bf2a6f0818dadc2cb7a5e9430bddb9940d121260e6c114dce1c91362
SHA512

93be3bce57fc5b20d1397d901bd25ae254d0de237efc9f5a1279270f467d9059aa179e05d01840e62d14478954693b08cb4e1fe4b9051f90dce286945b8fbebd
SSDEEP

1536:9FSk4hMZtwmHtDaHv7oiNhzE9Y38sgsNhMtsy/4ZhPwwMjc:9FkhMZtwmHtDaHT/XzE9D0NhMtsy/4ZF

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
876	msedge.exe
876	msedge.exe
1836	msedge.exe
1836	msedge.exe
2256	identity_helper.exe
2256	identity_helper.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 2984	1836	msedge.exe	82
PID 1836 wrote to memory of 2984	1836	msedge.exe	82
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 2060	1836	msedge.exe	83
PID 1836 wrote to memory of 876	1836	msedge.exe	84
PID 1836 wrote to memory of 876	1836	msedge.exe	84
PID 1836 wrote to memory of 1320	1836	msedge.exe	85
PID 1836 wrote to memory of 1320	1836	msedge.exe	85
PID 1836 wrote to memory of 1320	1836	msedge.exe	85
PID 1836 wrote to memory of 1320	1836	msedge.exe	85
PID 1836 wrote to memory of 1320	1836	msedge.exe	85
PID 1836 wrote to memory of 1320	1836	msedge.exe	85
PID 1836 wrote to memory of 1320	1836	msedge.exe	85
PID 1836 wrote to memory of 1320	1836	msedge.exe	85
PID 1836 wrote to memory of 1320	1836	msedge.exe	85
PID 1836 wrote to memory of 1320	1836	msedge.exe	85
PID 1836 wrote to memory of 1320	1836	msedge.exe	85
PID 1836 wrote to memory of 1320	1836	msedge.exe	85
PID 1836 wrote to memory of 1320	1836	msedge.exe	85
PID 1836 wrote to memory of 1320	1836	msedge.exe	85
PID 1836 wrote to memory of 1320	1836	msedge.exe	85
PID 1836 wrote to memory of 1320	1836	msedge.exe	85
PID 1836 wrote to memory of 1320	1836	msedge.exe	85
PID 1836 wrote to memory of 1320	1836	msedge.exe	85
PID 1836 wrote to memory of 1320	1836	msedge.exe	85
PID 1836 wrote to memory of 1320	1836	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\898f40f9490feab92b6604cfd3151582_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa31f646f8,0x7ffa31f64708,0x7ffa31f64718
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,8432995399202864255,780578965150552981,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,8432995399202864255,780578965150552981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,8432995399202864255,780578965150552981,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8432995399202864255,780578965150552981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8432995399202864255,780578965150552981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8432995399202864255,780578965150552981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8432995399202864255,780578965150552981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2092 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8432995399202864255,780578965150552981,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1300 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,8432995399202864255,780578965150552981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,8432995399202864255,780578965150552981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8432995399202864255,780578965150552981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8432995399202864255,780578965150552981,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,8432995399202864255,780578965150552981,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4144 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
ca9842ebce48a15bb439e7d96c20e8cf

SHA1
0dc1aff15b7f42ea5580cea3aa56a6b38b7d1329

SHA256
07812ba0ed38064748495227d31f1ecb07d7860a6cd5c9c308be6af7ef207a47

SHA512
b64f8cc6fbf250f6b492287a362dca09f40698a413f7da1bc44b5b6bef68ed2818937bc10ec16148e70c3370dedf1a49b63adf79c89d230b4459274c0140a10e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
57ef2466b5e4ffa89ca87666f328c520

SHA1
9664920af4c466af5130bfaecbfc9ac375aeb8f4

SHA256
759c228bbbf37c61958d79fae24a249fed776a7c41809f01e62a9564f0225a32

SHA512
341fbc057913ac6a458b85fc623eece24b8f0eaad299e137dd944838221ca862d0abcb17a1a32504a4d13e5dacc774dc160456bd3cb2d3e42d7d97f40909fc65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e4e02c963904409258abc95d69f5539e

SHA1
337d66862c6ec18920b2e75ba1a72652d46fe1a1

SHA256
871bfa4f6ca5a623f6bb149134f355371d5c4d620023b1014560e1b7f31752f6

SHA512
e7e1f91da72da9a681bbcdeb9c198cc2e7c5bf0bf52243ad09818087c44e069cf4c164d114550410ec4f87c26f501107f4c0d92e202b885eee304f967527cf4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bbab327291324b9d73d5514c10ac16c1

SHA1
2e2fad8b801b553cb8ee001f50d69583c4cdb0be

SHA256
cc997ddfab1db015389d0466f5d624b856634e56360a6a1aeb8e9f9e00ba99cf

SHA512
e34548a14afd3573160adda730ce61ffee032fbdd28b148297a155ebfcfcbb7fadb05bf69035ba945eaa0ef4ede3f991199a8155a0c33d056d80aa201bf065b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
995c7c5ad9acd6b65ef83c242fa0163e

SHA1
f3dae08c23f7c101c29d6b391cfc103fa8adac55

SHA256
b652df749a5bc31b1f8baf7a1fb338c67ac2afbd3461e623ff1e87b54a4a41ad

SHA512
6dfe72596516c4732706ac267c45254855aedbb34b8053c9d310e3bfc26d9e446cc4c9c93560f9ddd40c8524dd1c0dc77f0cfb9d2e8d5a702d23e18dbe2b5614

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5eb58e02508dcd49aa0b09242f31a39b

SHA1
d5177429fa3d181ffb5b8e77f52cb0573146645d

SHA256
451cf32b14ed6a36e65f5a4e1eb3b76015c47394553a93ff818594954ea89dac

SHA512
6c02d8da8c793e5dfe2f3e2ac0e0c8d3838a101eec92d8d92f2fa10aa84bf832450d157b9f6264fe7270942f45b02b2a9a85c7f142d95532888a91535b15bc7e

Download Submit