19483194da80f670331bbd830a8a01f8e1d1a8cdaf2729b90a00dd2704365e20

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13-06-2024 07:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a47cff1200726c8cfec12690f738c09e_JaffaCakes118.html
Size

113KB
MD5

a47cff1200726c8cfec12690f738c09e
SHA1

25f057dc4ec073141dd79ccc6ff982faf24cc9dd
SHA256

19483194da80f670331bbd830a8a01f8e1d1a8cdaf2729b90a00dd2704365e20
SHA512

93639b4597e0c873e18e6f83b4c19149e239c0981ffcac98fe2e2a89971242e0b3f6299e928de6fe4fe24d0e75c66f81ffdbf7bce681921986440e43f1aa1f77
SSDEEP

768:STmWZs53fzEB+3GfrizaWpFZWg8hmvCs275Ux0BKxMkq:STmWqZfzEB+3G+zaoZWg8g275meKxRq

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe
4952	msedge.exe
4952	msedge.exe
1464	identity_helper.exe
1464	identity_helper.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 4136	4952	msedge.exe	81
PID 4952 wrote to memory of 4136	4952	msedge.exe	81
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 5016	4952	msedge.exe	82
PID 4952 wrote to memory of 1636	4952	msedge.exe	83
PID 4952 wrote to memory of 1636	4952	msedge.exe	83
PID 4952 wrote to memory of 3532	4952	msedge.exe	84
PID 4952 wrote to memory of 3532	4952	msedge.exe	84
PID 4952 wrote to memory of 3532	4952	msedge.exe	84
PID 4952 wrote to memory of 3532	4952	msedge.exe	84
PID 4952 wrote to memory of 3532	4952	msedge.exe	84
PID 4952 wrote to memory of 3532	4952	msedge.exe	84
PID 4952 wrote to memory of 3532	4952	msedge.exe	84
PID 4952 wrote to memory of 3532	4952	msedge.exe	84
PID 4952 wrote to memory of 3532	4952	msedge.exe	84
PID 4952 wrote to memory of 3532	4952	msedge.exe	84
PID 4952 wrote to memory of 3532	4952	msedge.exe	84
PID 4952 wrote to memory of 3532	4952	msedge.exe	84
PID 4952 wrote to memory of 3532	4952	msedge.exe	84
PID 4952 wrote to memory of 3532	4952	msedge.exe	84
PID 4952 wrote to memory of 3532	4952	msedge.exe	84
PID 4952 wrote to memory of 3532	4952	msedge.exe	84
PID 4952 wrote to memory of 3532	4952	msedge.exe	84
PID 4952 wrote to memory of 3532	4952	msedge.exe	84
PID 4952 wrote to memory of 3532	4952	msedge.exe	84
PID 4952 wrote to memory of 3532	4952	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a47cff1200726c8cfec12690f738c09e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb10c746f8,0x7ffb10c74708,0x7ffb10c74718
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,8189258754485656622,11780120809578699384,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,8189258754485656622,11780120809578699384,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,8189258754485656622,11780120809578699384,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8189258754485656622,11780120809578699384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8189258754485656622,11780120809578699384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8189258754485656622,11780120809578699384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2776 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,8189258754485656622,11780120809578699384,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,8189258754485656622,11780120809578699384,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8189258754485656622,11780120809578699384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8189258754485656622,11780120809578699384,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8189258754485656622,11780120809578699384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8189258754485656622,11780120809578699384,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,8189258754485656622,11780120809578699384,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5192 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
ec341fe98a75cb34729bf687e5ffb6c3

SHA1
521a4a1b09b90b144196fc1b36e8369894653cd1

SHA256
a4ed2a0c532296848c6dce4cbbf316ff243fed16e59e6c07036f8e906a58c2a6

SHA512
c0e467f7df28ef030bd4ac16edb81607598039c684a91ad30b7b751992c8f6f64dd25bfe337e26dc049e6abcf2f537e4cd87cd209a176994e90c61eb0635c128

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
397B

MD5
4f89310843e7df1b23e462f5cba2a2cf

SHA1
951ca55cce9801f3bf5643417e906fece85767db

SHA256
bb09aaafbca50b53f4f9cf6b8cca083b2c0c78a8851c3332df2ef47998cc91ae

SHA512
1a7c4467cfb52d6cd660cc93a4def20aa312087df425963b3d954c98ad0e3927a96f823f6fc3912a81b551f05e85e6954abc6f53642fcfae30dbc00d8c92cf9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
71a457bdae2a2858af3209bb4e5e29f7

SHA1
e80d4bbced8ad6f2c5ef36860f73a4ec7e8a8093

SHA256
e87889551ce495de7acdf59c4182e71dafa07b072179d1e83bd6b3b3859df4f0

SHA512
2d4d9c3175586fe4bee8d7afb6389fa4668a6d2a3a62f3bcbb6d1b8b58249f99cc7b9cc76ba4deba79043ffea4e708782251573a39ee98c1efcf23ae17a493ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
78162d80078d53c891bef618e1817e19

SHA1
72bfaef95ef96bed226cc153127b8e8a89e0d252

SHA256
cb7a0be32763ac05bc226b5dc0693c6528f85566351e02025cc5a34c238a0ee6

SHA512
a3f45b8a401804556f175a43ed602325b2ad1a192e96b864ed31a23f14f6c991b2137380d3809926191dc26ed71b2b591ea02a3d43391566aa70347693f738b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fa220a3ebf16458ae622b609028f3193

SHA1
c3398528db4964cbbb7ec9472b35b092e5fdffcf

SHA256
b6e1ac4929af357061364e6673bc5af159b1402a6246fa9849b872e023ac5f34

SHA512
dd4f7484871060b6ad10c4d183834d2617019f515778cc7452ffd0806321da4ff601328c8f387f9f4853b1827866b979b386561bcc00e3b9bd012d1412b724c4

Download Submit