d404667c98a8aeee586b38f719f7ae45fc39b5c05639b35595fe5b446281e2cd

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 03:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

acb4e3d05fefc587c00a571df5d53190_JaffaCakes118.html
Size

178KB
MD5

acb4e3d05fefc587c00a571df5d53190
SHA1

6d8e096606fab61e83bf81ac22c971671c18e20d
SHA256

d404667c98a8aeee586b38f719f7ae45fc39b5c05639b35595fe5b446281e2cd
SHA512

c0bc423223e237a71054b4e73f3ba492ba5b1815be42179069228a4dd906952b4de8086b76ab61b30cb4d95151c771c18033a12fbad548cc3a87981221cb4670
SSDEEP

3072:SbbyfkMY+BES09JXAnyrZalI+YbbWT0n0DpF:Sb+sMYod+X3oI+YbbBn0DpF

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
1308	msedge.exe
1308	msedge.exe
2044	identity_helper.exe
2044	identity_helper.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 2516	1308	msedge.exe	83
PID 1308 wrote to memory of 2516	1308	msedge.exe	83
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4732	1308	msedge.exe	84
PID 1308 wrote to memory of 4752	1308	msedge.exe	85
PID 1308 wrote to memory of 4752	1308	msedge.exe	85
PID 1308 wrote to memory of 4912	1308	msedge.exe	86
PID 1308 wrote to memory of 4912	1308	msedge.exe	86
PID 1308 wrote to memory of 4912	1308	msedge.exe	86
PID 1308 wrote to memory of 4912	1308	msedge.exe	86
PID 1308 wrote to memory of 4912	1308	msedge.exe	86
PID 1308 wrote to memory of 4912	1308	msedge.exe	86
PID 1308 wrote to memory of 4912	1308	msedge.exe	86
PID 1308 wrote to memory of 4912	1308	msedge.exe	86
PID 1308 wrote to memory of 4912	1308	msedge.exe	86
PID 1308 wrote to memory of 4912	1308	msedge.exe	86
PID 1308 wrote to memory of 4912	1308	msedge.exe	86
PID 1308 wrote to memory of 4912	1308	msedge.exe	86
PID 1308 wrote to memory of 4912	1308	msedge.exe	86
PID 1308 wrote to memory of 4912	1308	msedge.exe	86
PID 1308 wrote to memory of 4912	1308	msedge.exe	86
PID 1308 wrote to memory of 4912	1308	msedge.exe	86
PID 1308 wrote to memory of 4912	1308	msedge.exe	86
PID 1308 wrote to memory of 4912	1308	msedge.exe	86
PID 1308 wrote to memory of 4912	1308	msedge.exe	86
PID 1308 wrote to memory of 4912	1308	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\acb4e3d05fefc587c00a571df5d53190_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa228f46f8,0x7ffa228f4708,0x7ffa228f4718
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,5786622631791927301,7769728503740320935,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,5786622631791927301,7769728503740320935,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,5786622631791927301,7769728503740320935,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5786622631791927301,7769728503740320935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5786622631791927301,7769728503740320935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,5786622631791927301,7769728503740320935,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,5786622631791927301,7769728503740320935,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5786622631791927301,7769728503740320935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5786622631791927301,7769728503740320935,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5786622631791927301,7769728503740320935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5786622631791927301,7769728503740320935,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,5786622631791927301,7769728503740320935,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
183B

MD5
a28fc8c7b408c9fec7eb29ba72319a1a

SHA1
2b1815d04fb077e076a7c078db984304b82cf50e

SHA256
1d26a34f3b686ef9b0f4402fd77dbbf4e517c3a60d31f19751f038953abe9e65

SHA512
6a6f10e0011b2e2f335d65b2b5da07e47e06aa5eeb22ac8950f63928c18242952d216526c8a2ba909ad04fdaf073215c4277272c6de2a28c7cb39a211f0a78bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4be123c671f48d32786afe1b54782e0c

SHA1
cb799a39cf3b3c1ee399b43f8389b7ab6b344a1b

SHA256
d935d52b8c22b938814741540913f6822d7d75b1916e15a8a5c6bd35efc51d98

SHA512
7bdd6efda569fdadd509cd06a1f4d83385571c2f6c05dba5f25c828cbdccb6f4c6edb110942058408063d58bc33d83e49e31917caf0543eb6f4f66a419820b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e33c4845cd8816bd0862ea212e307fd6

SHA1
d2fc7e6abd6418b4352289b2530aa3868120ae00

SHA256
b4448da5e82d74ab31b4022be6b0adf19ead1697a55fd82f7262207d760c18b6

SHA512
1368c8fb271ab04ae0ec507d10911392b5bc9e878899676b5bedb9364c1383354035ffc54cada81a94bbdd479de74946926f83b2217fd5246651137f8cacd5fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
16340348cea5363bcc31f687c307a436

SHA1
4b11c30850d77d11ca2e1068c9766ae78cea3484

SHA256
a9492b4443ea087509e6b9f1d4fe5d0bc3c4e17e085c3e07807b98eaae7fb8b7

SHA512
d6b00cd5ab9b50013a1016a4541a67990f40e985ac92e10177baee9f862091396fbb203dcf5d49fd657af4fa6e9f055253394a78492ed17f96b1ac458a198479

Download Submit