a3f52773a285d20c5d5f4436e048ccbe756c92579ea538a7f21b44726cfe7f64

Analysis

max time kernel
148s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13-06-2024 12:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a5974f1da64c318af0476de62fa34316_JaffaCakes118.html
Size

41KB
MD5

a5974f1da64c318af0476de62fa34316
SHA1

1b54f3e083a83467cd6571f03df9ec839bb08b48
SHA256

a3f52773a285d20c5d5f4436e048ccbe756c92579ea538a7f21b44726cfe7f64
SHA512

a53337fef95633acf7f3f04cff70080b38e9f067b99c99169b6fea496daee6aeca96e457a8fa296a65709353d37ad2411da0b32a9ede55af2648db094f58fde1
SSDEEP

768:S+1xtaGuWXis0tnfMQCeCvC+CGC9Ex0ozKs+qn1k0jcUNnRVjVEV:S+1xtLuWXiFFf3j+FrWoOvqhNLjiV

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3484	msedge.exe
3484	msedge.exe
4700	msedge.exe
4700	msedge.exe
3376	identity_helper.exe
3376	identity_helper.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 1760	4700	msedge.exe	81
PID 4700 wrote to memory of 1760	4700	msedge.exe	81
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3024	4700	msedge.exe	83
PID 4700 wrote to memory of 3484	4700	msedge.exe	84
PID 4700 wrote to memory of 3484	4700	msedge.exe	84
PID 4700 wrote to memory of 2832	4700	msedge.exe	85
PID 4700 wrote to memory of 2832	4700	msedge.exe	85
PID 4700 wrote to memory of 2832	4700	msedge.exe	85
PID 4700 wrote to memory of 2832	4700	msedge.exe	85
PID 4700 wrote to memory of 2832	4700	msedge.exe	85
PID 4700 wrote to memory of 2832	4700	msedge.exe	85
PID 4700 wrote to memory of 2832	4700	msedge.exe	85
PID 4700 wrote to memory of 2832	4700	msedge.exe	85
PID 4700 wrote to memory of 2832	4700	msedge.exe	85
PID 4700 wrote to memory of 2832	4700	msedge.exe	85
PID 4700 wrote to memory of 2832	4700	msedge.exe	85
PID 4700 wrote to memory of 2832	4700	msedge.exe	85
PID 4700 wrote to memory of 2832	4700	msedge.exe	85
PID 4700 wrote to memory of 2832	4700	msedge.exe	85
PID 4700 wrote to memory of 2832	4700	msedge.exe	85
PID 4700 wrote to memory of 2832	4700	msedge.exe	85
PID 4700 wrote to memory of 2832	4700	msedge.exe	85
PID 4700 wrote to memory of 2832	4700	msedge.exe	85
PID 4700 wrote to memory of 2832	4700	msedge.exe	85
PID 4700 wrote to memory of 2832	4700	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a5974f1da64c318af0476de62fa34316_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffeea1f46f8,0x7ffeea1f4708,0x7ffeea1f4718
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,10398425542161553316,10335878785805362217,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,10398425542161553316,10335878785805362217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,10398425542161553316,10335878785805362217,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2984 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10398425542161553316,10335878785805362217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10398425542161553316,10335878785805362217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10398425542161553316,10335878785805362217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,10398425542161553316,10335878785805362217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,10398425542161553316,10335878785805362217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10398425542161553316,10335878785805362217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10398425542161553316,10335878785805362217,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10398425542161553316,10335878785805362217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10398425542161553316,10335878785805362217,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,10398425542161553316,10335878785805362217,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4904 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
457ff15e1f74ee03c4de5d08953362b5

SHA1
769a46351d52c7449dc485a1a73e9f138155fb2f

SHA256
fa957d0ec1fdb64588f22648ea2f6347b42dd3fe0cb2aff1900e4fd04c4db040

SHA512
a10c455fdf3763509d14deaed6538508fd2284eb505ffd013c8506efb9873e75fb525e2bc98e67b7be91c1b156a0bdbc8024b131de59147a1781698d3b371018

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
afa85f27a6777706ae9b8c4009be37a9

SHA1
b11ccafc2af339bde7ffe05d292a433923a53c24

SHA256
26aad3d702f74c3904b6874c1b6507c5922eaf43429a3f5955557f46ede52219

SHA512
5f012a5087ffb6cb5e24969721b083576c98cc5f78917ecdcd00e2a4fbceb84e6c8121b8e97dfd99e2e2bae2dacd1c88ed0cf98f7d39194065d53c2102d7fc43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f751541af1c0f11303c7d5288983a7f6

SHA1
94af4110ce6540f287e2e47b5e52473835f03ded

SHA256
bd305c4d4841165178df28581ea1c9b8dba9f45f94809c4cf537dff745e13546

SHA512
441ea07729bdadad26b61ca0e09b7ec2f21ed2f634e561c6b6f36c477b9110c45b0420af43e73cc852270858d236271483fcb59d8c288a056743f96dcc952dd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f26a49fec411d3360d6b8e05d4c22b50

SHA1
2b46fea3a69c239a6994ae90a98d51dd372f68a6

SHA256
9857f375dfbe9f7d5b68dbca505acbac934c930702844f6da1bc4cb6aa1eb616

SHA512
6077bac289e9c809eaeb110e2a1a9c3def6e3a91e33554143848c7ea31bad9f5c7f030207ecebc5988104505505d085f9a1f1891f8d85f2a0a8954d691a4e529

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
85e93924c5ab4209858165929dc04866

SHA1
dea727ff5e28f2fd6c8476f483997cbd55532219

SHA256
839d09bc5ec4ceccb9458c7acac5efd64d60a3f9b455bb49e1ebfcfbe8b4b7ea

SHA512
5618eb4b17a6b9d6e1961518a41db6a68e2d8d81c12e9412f139662e327459c2898463ef77149966cff47b7a42a4bc52b7e7a1179efa5e394bc5908320a28763

Download Submit