3c61ae4d5087d13a196bbfed427c0cf963a9aeb2aed84a7778dce4ea85c5a314

Analysis

max time kernel
146s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a59e03b3fcdc2f37f5880c0552816796_JaffaCakes118.html
Size

198KB
MD5

a59e03b3fcdc2f37f5880c0552816796
SHA1

68d4847aa8fb9c30ae35daaa867d23ef60e0e0c1
SHA256

3c61ae4d5087d13a196bbfed427c0cf963a9aeb2aed84a7778dce4ea85c5a314
SHA512

0281d7b7c7ffe7e4528d11eb392e0d49bbb28ce63c5701d5780a2f3c03d5c0964041afd404e9aaf5131cfa3516365a8d705337ac46702d89f7cf74f993b0c63a
SSDEEP

1536:eo0lIYJW7KXoI9uth+088wdv770yc9RqsZqQp1o:eoJsW2XoIk/n8V0yc9RqsZNp1o

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
624	msedge.exe
624	msedge.exe
4900	msedge.exe
4900	msedge.exe
4180	identity_helper.exe
4180	identity_helper.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 4516	4900	msedge.exe	82
PID 4900 wrote to memory of 4516	4900	msedge.exe	82
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 1764	4900	msedge.exe	83
PID 4900 wrote to memory of 624	4900	msedge.exe	84
PID 4900 wrote to memory of 624	4900	msedge.exe	84
PID 4900 wrote to memory of 3156	4900	msedge.exe	85
PID 4900 wrote to memory of 3156	4900	msedge.exe	85
PID 4900 wrote to memory of 3156	4900	msedge.exe	85
PID 4900 wrote to memory of 3156	4900	msedge.exe	85
PID 4900 wrote to memory of 3156	4900	msedge.exe	85
PID 4900 wrote to memory of 3156	4900	msedge.exe	85
PID 4900 wrote to memory of 3156	4900	msedge.exe	85
PID 4900 wrote to memory of 3156	4900	msedge.exe	85
PID 4900 wrote to memory of 3156	4900	msedge.exe	85
PID 4900 wrote to memory of 3156	4900	msedge.exe	85
PID 4900 wrote to memory of 3156	4900	msedge.exe	85
PID 4900 wrote to memory of 3156	4900	msedge.exe	85
PID 4900 wrote to memory of 3156	4900	msedge.exe	85
PID 4900 wrote to memory of 3156	4900	msedge.exe	85
PID 4900 wrote to memory of 3156	4900	msedge.exe	85
PID 4900 wrote to memory of 3156	4900	msedge.exe	85
PID 4900 wrote to memory of 3156	4900	msedge.exe	85
PID 4900 wrote to memory of 3156	4900	msedge.exe	85
PID 4900 wrote to memory of 3156	4900	msedge.exe	85
PID 4900 wrote to memory of 3156	4900	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a59e03b3fcdc2f37f5880c0552816796_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb408246f8,0x7ffb40824708,0x7ffb40824718
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,2123162944020324868,15394513430680480508,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,2123162944020324868,15394513430680480508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,2123162944020324868,15394513430680480508,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2123162944020324868,15394513430680480508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2123162944020324868,15394513430680480508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2123162944020324868,15394513430680480508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,2123162944020324868,15394513430680480508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,2123162944020324868,15394513430680480508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2123162944020324868,15394513430680480508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2123162944020324868,15394513430680480508,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2123162944020324868,15394513430680480508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2123162944020324868,15394513430680480508,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,2123162944020324868,15394513430680480508,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4684 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
477462b6ad8eaaf8d38f5e3a4daf17b0

SHA1
86174e670c44767c08a39cc2a53c09c318326201

SHA256
e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d

SHA512
a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b704c9ca0493bd4548ac9c69dc4a4f27

SHA1
a3e5e54e630dabe55ca18a798d9f5681e0620ba7

SHA256
2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411

SHA512
69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
fb0426ba8b54cb7d82b2bbdd0db53afb

SHA1
109a2b80c809eddc20c89eb663f6a590d23c5940

SHA256
d6ea5ccc025e17cf898e39482013901501f26ace6f93f676435204d2d7f520d3

SHA512
35065c8e4084070660fdac855d232cff9c65b40c53996adb57aeb1e599289c96df1931508906018eaec1d584269aac8435e8e9eee3c7c2519b031cad3947d78e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
fc7af49595c6aa358cff2b88d1b2f17d

SHA1
91b517c61da7c13eec722288a4594a82673d7583

SHA256
db52a44c1918522af8c625fd04ac20af8223b9728dac31902c735f807a2e8f77

SHA512
0bc1e48e4a2d66f17aa207de21f939d660c9cebbf9aa8812169e6f84dffe385eaeee07b834304568a993d3655ba30708b797c9d68ac00f01cfd1853779b5c49f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
49b4abbe9631f167a76bf3f288dd2ed1

SHA1
f3107e24b30150e9f99b2091289f2a46280a8b9f

SHA256
8211e7a9ccb002a7541ce458e0336a5a09cddd326c78d0ebdddb16e0a9701709

SHA512
d9b7bcb7c2b8419e0aed6be7bdb9985b7c4d782ea4d3250ec1dfafd9051497c5ac283f2767cd6ec2ebc2378c92503aa547900482a75c2e6f0d4e8e99f87e96a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
091fc6fc9162376091cf120934f447aa

SHA1
9fe64e2a02bb29db955adee6cf191f9e7bd4a787

SHA256
73d423dd044fb6acaf31e8544de9e24afdf2fbf651bcf287736e29f63f1d955d

SHA512
bb78176bfa1f28fd7af0cb21d1b38803464944c5a9cfc4e5b92c31f7c0e92c7ecd7061ae86b29fe6d866b0f5d695417b567b5dab7e1832d03027eb571a8b091d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f2f6d96337cfb757d67d874a123ef99c

SHA1
e4061a1598b16c394bb296d9c8b545a5f8a5f14f

SHA256
e7cd4e07791821022cc9426daa916dd2808b165f54481e761141f8feac64f824

SHA512
aab5ff8a9a1cd7dedcfbc63f7a00314a399adcc8051f2b7f61ae519a6151625f2f0e0e214b1b1887c6377f60c6dcba40c8fa4e6ff435acf940eb596869b2d4d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
91146571020eef3dcc9abfd5ccfabbab

SHA1
71ce4d9920e5f0502f5ec6ea610807adcb49c191

SHA256
25fbf9fda979007c027372bc7e406e3cd0da033d5b0378a6320480da4724bfa2

SHA512
65172a83e5c1f32cbaa11ad0d713c744515fea12190021b6aa505c26bd7b72f50369025091a0d904961056ec3dc9031af79da8dbde69ec57d286a0a0a239882e

Download Submit