08163e2ee5d07362a6c0b20a9dd7fb854e27c565503b86889778afb649cbf92c

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2024 04:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ace79635d173a810d714eb24147d3633_JaffaCakes118.html
Size

461KB
MD5

ace79635d173a810d714eb24147d3633
SHA1

053810aa72b61eb843bb536e579403c1a75d60f3
SHA256

08163e2ee5d07362a6c0b20a9dd7fb854e27c565503b86889778afb649cbf92c
SHA512

121727af606e470a854cf024329a4a85fee1005a2b91291661aa04ceb2fee2dcf692f70a30c1d7023139db5c87f5e7fbdc54c6f3fd769eb57ca2737363bf511c
SSDEEP

6144:S5sMYod+X3oI+YSQ+sMYod+X3oI+YasMYod+X3oI+YLsMYod+X3oI+YQ:Y5d+X3c5d+X365d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
3644	msedge.exe
3644	msedge.exe
2324	identity_helper.exe
2324	identity_helper.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 4536	3644	msedge.exe	82
PID 3644 wrote to memory of 4536	3644	msedge.exe	82
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 2448	3644	msedge.exe	84
PID 3644 wrote to memory of 1696	3644	msedge.exe	85
PID 3644 wrote to memory of 1696	3644	msedge.exe	85
PID 3644 wrote to memory of 4456	3644	msedge.exe	86
PID 3644 wrote to memory of 4456	3644	msedge.exe	86
PID 3644 wrote to memory of 4456	3644	msedge.exe	86
PID 3644 wrote to memory of 4456	3644	msedge.exe	86
PID 3644 wrote to memory of 4456	3644	msedge.exe	86
PID 3644 wrote to memory of 4456	3644	msedge.exe	86
PID 3644 wrote to memory of 4456	3644	msedge.exe	86
PID 3644 wrote to memory of 4456	3644	msedge.exe	86
PID 3644 wrote to memory of 4456	3644	msedge.exe	86
PID 3644 wrote to memory of 4456	3644	msedge.exe	86
PID 3644 wrote to memory of 4456	3644	msedge.exe	86
PID 3644 wrote to memory of 4456	3644	msedge.exe	86
PID 3644 wrote to memory of 4456	3644	msedge.exe	86
PID 3644 wrote to memory of 4456	3644	msedge.exe	86
PID 3644 wrote to memory of 4456	3644	msedge.exe	86
PID 3644 wrote to memory of 4456	3644	msedge.exe	86
PID 3644 wrote to memory of 4456	3644	msedge.exe	86
PID 3644 wrote to memory of 4456	3644	msedge.exe	86
PID 3644 wrote to memory of 4456	3644	msedge.exe	86
PID 3644 wrote to memory of 4456	3644	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ace79635d173a810d714eb24147d3633_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffcdd4c46f8,0x7ffcdd4c4708,0x7ffcdd4c4718
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,14039026603210109125,9055123559348539250,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,14039026603210109125,9055123559348539250,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,14039026603210109125,9055123559348539250,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14039026603210109125,9055123559348539250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14039026603210109125,9055123559348539250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,14039026603210109125,9055123559348539250,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,14039026603210109125,9055123559348539250,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14039026603210109125,9055123559348539250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14039026603210109125,9055123559348539250,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14039026603210109125,9055123559348539250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14039026603210109125,9055123559348539250,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,14039026603210109125,9055123559348539250,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9081c34e133c32d02f593df88f047a

SHA1
a0da007c14fd0591091924edc44bee90456700c6

SHA256
c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e

SHA512
12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3a09f853479af373691d131247040276

SHA1
1b6f098e04da87e9cf2d3284943ec2144f36ac04

SHA256
a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f

SHA512
341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fcd104cf07b4edd14874d6296b576013

SHA1
ec1dad3f82f3943785628e2cfac9c00be5df7a24

SHA256
9891912edd97d19de704c30717b1bfde167b26ff7fd42deea45c1a3141c62890

SHA512
61c597c540c1ea04d7ad3d5c0e411eb7eee03b7ed797625d35b0fed83205b4cd5a2d2076a42d37d20091151f32d2d5b43e7af159f0b77866182532e9b6868a6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c5c89efd8ddc37431d8851009d6158b1

SHA1
e0981d8de78d18ef090a8f2badfdd1f49642ef84

SHA256
760cdf183a55a1b167214bc137f23aace42ef766e690eed2bdaab64738694017

SHA512
fa6af69afd7e46610d6355b8add5a0ecd56f32e5e83bce37b8e891672ee273bb69aebdddeb39d414ba401995a866f0b4118df4e90ca183919eb75619e11209c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bfe1afa9d6f7eb7599d3d5a2dfb30a5d

SHA1
6d2380bc6986854559db35e748e1e59580071d4c

SHA256
8469d4a3a7e6d03a54ddb10b58856e7a9345e3f9b1abec3e52c3b4ee2fc9bd99

SHA512
b6c8a6b2c2bf72bfb0361eeeb1f97095ae5b7f47d403c5bedab35a1959b4f7054b59d1609dc8f2daf42a2b19221fbdfe2336a76706422ecec94add41f149f854

Download Submit