0457c9a502e715b7dfb9072fe357641669b647b76110ecc0e23a324127852102

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2024 03:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

acc1dc382d5e7efc6458eed7a62ac055_JaffaCakes118.html
Size

40KB
MD5

acc1dc382d5e7efc6458eed7a62ac055
SHA1

c9429e60a896870cc1d6480ecb397f077f6d7d72
SHA256

0457c9a502e715b7dfb9072fe357641669b647b76110ecc0e23a324127852102
SHA512

c47799a144f1bc19d1a0c4c55e8ba56e3c6cefd637e3e4ec00020196f19571a4538ede91dd6a1b601b17ef943e36ae6df60fe10e8978fab08dbe0d7bb7475a0b
SSDEEP

192:uwP9b5nAGnQjxn5Q/UnQie3NnnnQOkEnt8anQTbnRnQmSZxmY+sRhig2Xh1fjjyx:QQ/gGxnji+Sb2

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
368	msedge.exe
368	msedge.exe
2772	msedge.exe
2772	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 4452	2772	msedge.exe	82
PID 2772 wrote to memory of 4452	2772	msedge.exe	82
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 2784	2772	msedge.exe	84
PID 2772 wrote to memory of 368	2772	msedge.exe	85
PID 2772 wrote to memory of 368	2772	msedge.exe	85
PID 2772 wrote to memory of 3376	2772	msedge.exe	86
PID 2772 wrote to memory of 3376	2772	msedge.exe	86
PID 2772 wrote to memory of 3376	2772	msedge.exe	86
PID 2772 wrote to memory of 3376	2772	msedge.exe	86
PID 2772 wrote to memory of 3376	2772	msedge.exe	86
PID 2772 wrote to memory of 3376	2772	msedge.exe	86
PID 2772 wrote to memory of 3376	2772	msedge.exe	86
PID 2772 wrote to memory of 3376	2772	msedge.exe	86
PID 2772 wrote to memory of 3376	2772	msedge.exe	86
PID 2772 wrote to memory of 3376	2772	msedge.exe	86
PID 2772 wrote to memory of 3376	2772	msedge.exe	86
PID 2772 wrote to memory of 3376	2772	msedge.exe	86
PID 2772 wrote to memory of 3376	2772	msedge.exe	86
PID 2772 wrote to memory of 3376	2772	msedge.exe	86
PID 2772 wrote to memory of 3376	2772	msedge.exe	86
PID 2772 wrote to memory of 3376	2772	msedge.exe	86
PID 2772 wrote to memory of 3376	2772	msedge.exe	86
PID 2772 wrote to memory of 3376	2772	msedge.exe	86
PID 2772 wrote to memory of 3376	2772	msedge.exe	86
PID 2772 wrote to memory of 3376	2772	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\acc1dc382d5e7efc6458eed7a62ac055_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9fdf746f8,0x7ff9fdf74708,0x7ff9fdf74718
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,17470341525589123187,10863065624329636880,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,17470341525589123187,10863065624329636880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,17470341525589123187,10863065624329636880,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17470341525589123187,10863065624329636880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17470341525589123187,10863065624329636880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,17470341525589123187,10863065624329636880,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2396 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17470341525589123187,10863065624329636880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2300 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17470341525589123187,10863065624329636880,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2376 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,17470341525589123187,10863065624329636880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:2708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c5abc082d9d9307e797b7e89a2f755f4

SHA1
54c442690a8727f1d3453b6452198d3ec4ec13df

SHA256
a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716

SHA512
ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4a74bc775caf3de7fc9cde3c30ce482

SHA1
c6ed3161390e5493f71182a6cb98d51c9063775d

SHA256
dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280

SHA512
55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f2a11d95b7c83ac7d157a1feda9e48f9

SHA1
41e37ea6c31a6cf5239bdf2b9a301717c0951a0b

SHA256
8ee15993f7b551251801087649c2112a589df0b6ad097f1e226502daa7a6d7f8

SHA512
5e6ee66eb88df8b74de26475558ff48263cb1dda09bad18cd63141fef2fd1fa0ba709ee6f7430668b09efdf901059f8e397d37dbdc439454ee8ca205cca15c81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
859be9f4c63f3ee866163241c1bf6f1e

SHA1
5e01249016f6b328da2034d1e7031dfd6aadc8df

SHA256
69e86dd0d0ec877905c4d7b98ec390bf6ea97dfc9d3802b0d65d8936a83770fa

SHA512
318dbdd1da03445e67e2429f66062b45e69ee706f53e64bcf72f432ab10f5941c9d4f43a1df5d955ce4989f8c5b3edbef9360042ced322c27c04ff2e563573cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ecf5af2506aef7eeaeb637187bdca6da

SHA1
f15674f5309fba6817cfe965e57840fd326390b9

SHA256
57ea0920ba66b3ebbf6567a02f9d3bade6a0c58d3526874bfb9bd87f2fdf9819

SHA512
9d3edf395caa11f293bb6b2e7a1ff5165618d1c3191f6883d07a4e121997eea0603dec9624a44e14efd39c1b9d406c7c95586382523aa23beedb551175e34b4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b8e5720518f4027d8c9dfc5f5ad08302

SHA1
f8056263234ed000c5c56a58b8197b28657cef75

SHA256
f402d24f4a8bad1cd4ae8b9633c79e42a0387901e64c823779bc5b013b64a290

SHA512
85d5dda128b93e0b5d4f74659422e19696272caa2abbd99b47d291c6c2fcf98901aff4fd98052178f4b7c6a3a24e0513c44f52f715032d31a84f29138846f57a

Download Submit