25350e0a1098a23fd4d3e8f9c52727066881fb09da15204fb9a74aa0f3761f28

Analysis

max time kernel
145s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab26c699f53add5a8388ba9f15739645_JaffaCakes118.html
Size

249KB
MD5

ab26c699f53add5a8388ba9f15739645
SHA1

a0589d3be22e6466be5dcc4e37f6e76feb307099
SHA256

25350e0a1098a23fd4d3e8f9c52727066881fb09da15204fb9a74aa0f3761f28
SHA512

272d2ffa217e8990f7a31d909979f3e7bcb046a52c64fb7f2cff304647f7542ec11174e9b274a5513770207d95876589cc5c40f13fafc5ee5965d9575bdbb17e
SSDEEP

3072:SeyfkMY+BES09JXAnyrZalI+YhyfkMY+BES09JXAnyrZalI+Ywsh:S7sMYod+X3oI+YksMYod+X3oI+Ywsh

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4468	msedge.exe
4468	msedge.exe
4300	msedge.exe
4300	msedge.exe
4572	identity_helper.exe
4572	identity_helper.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 1892	4300	msedge.exe	82
PID 4300 wrote to memory of 1892	4300	msedge.exe	82
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 940	4300	msedge.exe	83
PID 4300 wrote to memory of 4468	4300	msedge.exe	84
PID 4300 wrote to memory of 4468	4300	msedge.exe	84
PID 4300 wrote to memory of 3160	4300	msedge.exe	85
PID 4300 wrote to memory of 3160	4300	msedge.exe	85
PID 4300 wrote to memory of 3160	4300	msedge.exe	85
PID 4300 wrote to memory of 3160	4300	msedge.exe	85
PID 4300 wrote to memory of 3160	4300	msedge.exe	85
PID 4300 wrote to memory of 3160	4300	msedge.exe	85
PID 4300 wrote to memory of 3160	4300	msedge.exe	85
PID 4300 wrote to memory of 3160	4300	msedge.exe	85
PID 4300 wrote to memory of 3160	4300	msedge.exe	85
PID 4300 wrote to memory of 3160	4300	msedge.exe	85
PID 4300 wrote to memory of 3160	4300	msedge.exe	85
PID 4300 wrote to memory of 3160	4300	msedge.exe	85
PID 4300 wrote to memory of 3160	4300	msedge.exe	85
PID 4300 wrote to memory of 3160	4300	msedge.exe	85
PID 4300 wrote to memory of 3160	4300	msedge.exe	85
PID 4300 wrote to memory of 3160	4300	msedge.exe	85
PID 4300 wrote to memory of 3160	4300	msedge.exe	85
PID 4300 wrote to memory of 3160	4300	msedge.exe	85
PID 4300 wrote to memory of 3160	4300	msedge.exe	85
PID 4300 wrote to memory of 3160	4300	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ab26c699f53add5a8388ba9f15739645_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b7db46f8,0x7ff9b7db4708,0x7ff9b7db4718
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,14325896382332033518,2853410879421994593,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,14325896382332033518,2853410879421994593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,14325896382332033518,2853410879421994593,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14325896382332033518,2853410879421994593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14325896382332033518,2853410879421994593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,14325896382332033518,2853410879421994593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,14325896382332033518,2853410879421994593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14325896382332033518,2853410879421994593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14325896382332033518,2853410879421994593,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14325896382332033518,2853410879421994593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14325896382332033518,2853410879421994593,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,14325896382332033518,2853410879421994593,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6b422e018512b2c8e13bcf682f117e2a

SHA1
cef1cfc2c9d28a497749da52a0612b679cb21871

SHA256
a7e029ccc9f0b521bcd8d3c4650ee1d33edc4e34334a1b07a7ffe2d91254f687

SHA512
27783beca330e497f0a1be78b1283bba4d606b33dcc2a400cf1766d893363cf45c26c44a33f1ecaee871aa8d37dc1a7cf28a47c5581a2ca27cc23dcf956a08c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5f89cc108be540a4d01ed6f4f317a071

SHA1
41c160d28b786abc986a8ef9cfa49a7b86b40fde

SHA256
09fd8f752c84fe0301f1881b6fdd6970ff0986fb128f940ca18c452c24ab0f97

SHA512
0fa164b611c05b0aef94048b048b49e3cedc9ef36ed3a1a2912a028dd9490a998ae2b882a10db40286a837b7a0e6d66b06248821103a6fa6c8d35eb9e9ae8e60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
d191eb3f252271090be252caacfd0799

SHA1
c7095847a0802849052d7648343fb9cce3f4e0bd

SHA256
4f155526b949fad0aba88b1ad83529b753ae2442f2fc4ac9b37bf8da0ecc7170

SHA512
4d29447a06feaf39e6b4c8107b697c9660f575aed48bc8f422812723376a9ac0463bfae3756095f855418a6dc452d7be842bc075818783341b8f02c7720a575b

Download Submit