d899c0495fcee34f1302901d3665d0ff298de5252ef79479a24a1f94c67480ac

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05-06-2024 12:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

981b065da82ebfa10a490244241623b7_JaffaCakes118.html
Size

33KB
MD5

981b065da82ebfa10a490244241623b7
SHA1

7fdd22410aaeeaea59f0f48fd3f7fbaa65649ddf
SHA256

d899c0495fcee34f1302901d3665d0ff298de5252ef79479a24a1f94c67480ac
SHA512

60391ceb6acc986a68e87dfaa601bf76b7fd2f4e6b73550fe6300065e5e863b6f7ea112309043b83accfe3389295277c3bfb98e114ac363d0341a6758b7cffb9
SSDEEP

768:1MNRTkFvH/IDTdx9X6GCh/hKaZ02NBsiyiHk23BohkkVLEJk5zHA+ABSoqh4T/gs:1MNRSvH/IDTdx9X6GCh/hKaZ0osiyiHH

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
32	msedge.exe
32	msedge.exe
2152	identity_helper.exe
2152	identity_helper.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 32 wrote to memory of 4508	32	msedge.exe	83
PID 32 wrote to memory of 4508	32	msedge.exe	83
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 436	32	msedge.exe	84
PID 32 wrote to memory of 1936	32	msedge.exe	85
PID 32 wrote to memory of 1936	32	msedge.exe	85
PID 32 wrote to memory of 2120	32	msedge.exe	86
PID 32 wrote to memory of 2120	32	msedge.exe	86
PID 32 wrote to memory of 2120	32	msedge.exe	86
PID 32 wrote to memory of 2120	32	msedge.exe	86
PID 32 wrote to memory of 2120	32	msedge.exe	86
PID 32 wrote to memory of 2120	32	msedge.exe	86
PID 32 wrote to memory of 2120	32	msedge.exe	86
PID 32 wrote to memory of 2120	32	msedge.exe	86
PID 32 wrote to memory of 2120	32	msedge.exe	86
PID 32 wrote to memory of 2120	32	msedge.exe	86
PID 32 wrote to memory of 2120	32	msedge.exe	86
PID 32 wrote to memory of 2120	32	msedge.exe	86
PID 32 wrote to memory of 2120	32	msedge.exe	86
PID 32 wrote to memory of 2120	32	msedge.exe	86
PID 32 wrote to memory of 2120	32	msedge.exe	86
PID 32 wrote to memory of 2120	32	msedge.exe	86
PID 32 wrote to memory of 2120	32	msedge.exe	86
PID 32 wrote to memory of 2120	32	msedge.exe	86
PID 32 wrote to memory of 2120	32	msedge.exe	86
PID 32 wrote to memory of 2120	32	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\981b065da82ebfa10a490244241623b7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff850fe46f8,0x7ff850fe4708,0x7ff850fe4718
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,4089458645190951891,11364316535734917138,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,4089458645190951891,11364316535734917138,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,4089458645190951891,11364316535734917138,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4089458645190951891,11364316535734917138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4089458645190951891,11364316535734917138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4089458645190951891,11364316535734917138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4089458645190951891,11364316535734917138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,4089458645190951891,11364316535734917138,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,4089458645190951891,11364316535734917138,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4089458645190951891,11364316535734917138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4089458645190951891,11364316535734917138,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4089458645190951891,11364316535734917138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4089458645190951891,11364316535734917138,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,4089458645190951891,11364316535734917138,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
08e8b6a31b8e3ab1053187bcdadfe7ce

SHA1
e6def8cc72068d04a5762da56861bc925741f06c

SHA256
d65b938ddafa6a4dda2588769859ba1e3f043c4542b3f615ef418ab0898857e7

SHA512
76d62af74a2e80bd13e9664bfca4c3ba610ab648c59470cfc65f22e8b0a93982c04b644551a3256c5168ece12d8d27ab83c30af04eb3d2123cc5d557522819ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
261B

MD5
091241544895f2b470459382d670dc74

SHA1
153aeb4c2fe23f2e0b631e46933abe3d7e5fbe2c

SHA256
8f33e6929500d4b63836d8dcb44b65884ccd3a0e1e1aa313bb0813f89c0c2d9b

SHA512
a2b85a978fe65ecdb51dcb8b698e781065c1af5a67f0b63eb00c04c1c05dce3e9d93608e03086d87bdf44add5611e1ef98dda422781aeca41c23167a24be3fa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
00f21c362208b8fa3bfff5feb8567b7f

SHA1
b430b166e4e96c36da2d1285924bd030e2af461d

SHA256
4be4ca89b0d05481f997897ab9b3093e2be58515275e4288ad95ecbbbaac21b8

SHA512
0df88a02729bb5c779ea362a67c4bfc9f724f92622d3ceeafc7464679fe105cda9e63dbe7f9ee6a8921ce59fe45e9d2219e918b8639e6d0ce554777bbfce5a08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
293f11455d39ec7b2ca543d69c797883

SHA1
abeefe825ea96dbef62d660028fb36188d79dde4

SHA256
020cf3499d293942b9f34256a836def6267bd8779d92ce804ab3ac3c4b2da941

SHA512
d8c32a68bfe8889f415430c22f19147104bfb0d9406e92af437acd298090c9c7faaa772896d5031dc29ff8481686a046c91ebc1c2f3446a1f468fadcf1508906

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ebfd5f8a50fd6dc471bddc6e08d0659d

SHA1
e23dddf5b559910225848dfa0c33d911977bd14a

SHA256
422bb1686d120e2aa691900e947bb444e505a258ac41e38743074461064abc1c

SHA512
4b84e1c519d4add0a71c6d92f9c679c83af74cb089455c033fe4a04e4de61c0d5355bfa41b95dfe8d38735ea5026f16bfddb7102c59706745dc00655e5156139

Download Submit