eb85881f60479cc0de38d41b425b961af6abac5b7d8d1c4b1b1e73962450b9b7

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 19:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a1e60b5d2975e849ba382b4ac4c2c625_JaffaCakes118.html
Size

19KB
MD5

a1e60b5d2975e849ba382b4ac4c2c625
SHA1

80fd2694b1ca94f66d5ef7df2ae70d6c38ac2a3f
SHA256

eb85881f60479cc0de38d41b425b961af6abac5b7d8d1c4b1b1e73962450b9b7
SHA512

75046b306e69686d031ad4e07391321d2fadfd48f2e09ec98d752cc507e2204ccbc2f5bc3e44d58a54b70f5c78735d04150669c61417214b3eb544dc7cb105d2
SSDEEP

384:zikKhgESZVBD8c+Q3RyysgEnemLxXucfIk9xhemszVc9+m:zitSZgcR3kq1mQOIk9emKq+m

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3800	msedge.exe
3800	msedge.exe
4616	msedge.exe
4616	msedge.exe
376	identity_helper.exe
376	identity_helper.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 5068	4616	msedge.exe	87
PID 4616 wrote to memory of 5068	4616	msedge.exe	87
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3440	4616	msedge.exe	88
PID 4616 wrote to memory of 3800	4616	msedge.exe	89
PID 4616 wrote to memory of 3800	4616	msedge.exe	89
PID 4616 wrote to memory of 3204	4616	msedge.exe	90
PID 4616 wrote to memory of 3204	4616	msedge.exe	90
PID 4616 wrote to memory of 3204	4616	msedge.exe	90
PID 4616 wrote to memory of 3204	4616	msedge.exe	90
PID 4616 wrote to memory of 3204	4616	msedge.exe	90
PID 4616 wrote to memory of 3204	4616	msedge.exe	90
PID 4616 wrote to memory of 3204	4616	msedge.exe	90
PID 4616 wrote to memory of 3204	4616	msedge.exe	90
PID 4616 wrote to memory of 3204	4616	msedge.exe	90
PID 4616 wrote to memory of 3204	4616	msedge.exe	90
PID 4616 wrote to memory of 3204	4616	msedge.exe	90
PID 4616 wrote to memory of 3204	4616	msedge.exe	90
PID 4616 wrote to memory of 3204	4616	msedge.exe	90
PID 4616 wrote to memory of 3204	4616	msedge.exe	90
PID 4616 wrote to memory of 3204	4616	msedge.exe	90
PID 4616 wrote to memory of 3204	4616	msedge.exe	90
PID 4616 wrote to memory of 3204	4616	msedge.exe	90
PID 4616 wrote to memory of 3204	4616	msedge.exe	90
PID 4616 wrote to memory of 3204	4616	msedge.exe	90
PID 4616 wrote to memory of 3204	4616	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a1e60b5d2975e849ba382b4ac4c2c625_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb621646f8,0x7ffb62164708,0x7ffb62164718
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,12474399503200457022,6209747892484368517,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,12474399503200457022,6209747892484368517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,12474399503200457022,6209747892484368517,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12474399503200457022,6209747892484368517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12474399503200457022,6209747892484368517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12474399503200457022,6209747892484368517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,12474399503200457022,6209747892484368517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,12474399503200457022,6209747892484368517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12474399503200457022,6209747892484368517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12474399503200457022,6209747892484368517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12474399503200457022,6209747892484368517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12474399503200457022,6209747892484368517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,12474399503200457022,6209747892484368517,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
257c0005d0c4d0bb282cb470925e4376

SHA1
f9b8efb511ed64292568977c9f2ec255509e8f7d

SHA256
8185c36aaacfc71e42f94fad8e198fe7fb2d868398ceabb89261cae94341cb22

SHA512
2f3e8f352ed3ef88e8c28650390f93f98c92174d268330b886f3ebd1ba0163999051298ee12a054606b4986005452a241c6864cd292e69492d79c37d500556f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4819fbc4513c82d92618f50a379ee232

SHA1
ab618827ff269655283bf771fc957c8798ab51ee

SHA256
05e479e8ec96b7505e01e5ec757ccfe35cb73cd46b27ff4746dce90d43d9237c

SHA512
bc24fb972d04b55505101300e268f91b11e5833f1a18e925b5ded7e758b5e3e08bee1aa8f3a0b65514d6df981d0cbfa8798344db7f2a3675307df8de12ae475b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
52c323aefd48b6e2548844228d36341a

SHA1
f40e3491b9049c954b366a860eca60a3db2947d9

SHA256
ef12d81e8c485d68d7d62df68b025da18aecd9c8a629c342f9b93163463f3047

SHA512
a1317424f47eb10aea15ac15a7d28c94345f05cd2a721a9e8871b785d27f7b5b9029f48eb0cfdbab92b786b7055b5ba0667237a4d213dcda4b05036f51d0df77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
410B

MD5
14f2f959a12d56138a25f44510714283

SHA1
1893fb7e3617a440241b5f454fe1edabc1451bc8

SHA256
c79819d5b67e2852a1b2784a4112c6b605292eafa01b4fc140e01d0fd6ad9ec0

SHA512
f582382d1735abf0a089ef97b48ca92ff3f26478f0ea661f2349e5968a1db7d1fca4d9d1d2055f1ec0d6b92eb35a171dc7b7f1c70e59a2db766e9d50f020a1ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d89ae1e072c7014e44ea42281744d6bc

SHA1
c15928cb9c0c87872dc7058cacf45e611f4d2443

SHA256
e5cfeebea481938cf67b97030b1066fc81358feff783989906a76f40e6ee4f75

SHA512
e7a5eae9a84a7159a605fdcaa3973ad4bb087ce59c5246a4b923cab89b0f39abbded39055fa9aab9922a2b74265f9f6de8b3189882b6d36c988d5e27c7c17048

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c8e1e37b6cc47ef2cb2f72e5115d3379

SHA1
301f2f0aabf2f4632da39c066bda9f57a558289f

SHA256
03615b81bbb7752c53e08cf1ee23af806eb86ad9b9c1e075dea555a18ff97aa0

SHA512
4b0f1fd0f13db416cb1cf29625dc19842bac713d8fc9997bec649192e5fffee6a87924ff5ea69d2b056ddcb264c8a15529b57af45bdf69e8201b7d753e868d98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
95cd1581c30a5c26f698a8210bcab430

SHA1
5e8e551a47dd682ec51a7d6808fe8e0f2af39e86

SHA256
d58162c5ae5e18fc06604c285e024c01686093d70994dc93b4ae9d85b4c3f7b9

SHA512
e49403df10177053634c431203a91d26df5dfb23cbbb88847459ecdf4b6107040d0944a3e84ee6bb26cb4e8017a35c8c31b658387cd1b6938ba4cb9f59606ece

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1f864b1678fc5d4977d195a9ee38abe4

SHA1
ce0f438ec06e45969c63572e907f140695934949

SHA256
b570b468bcf61a3948614fcfbf752d74addd327d7e3556fec3edc91d5d9f15f0

SHA512
b5a3b0ed612066ad2261f1a34102ce9c302290ad87105a50d9c22a72e0f64d8968ca0ceaa23d0fa33d9f22d516494cfd371a6e1021c267ea7ef2606847595356

Download Submit