46eb38159a49b6ad42bdcf499b36f1ea240e1105325a297d970c5eb74a3a23ca

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

afd26118392edcf58897826b6b60f8c1_JaffaCakes118.html
Size

55KB
MD5

afd26118392edcf58897826b6b60f8c1
SHA1

a097500ad9cf3b0ba46702966c0c2fe9c0ea3b70
SHA256

46eb38159a49b6ad42bdcf499b36f1ea240e1105325a297d970c5eb74a3a23ca
SHA512

d75a6ae67e1dc1bacc803a127ca124e1814e57d748e0eec778e0e4b27b0cc6739ade14fd35baadde83c30e1abd7f6b16c977bd42110fd54afdad045b9cfe16fe
SSDEEP

1536:eEVaUwdqxq2qtqsqlTMqXqSqNq8qlOUquqRq+qTqlicq0qbqQqdqlNDqPqsqjqWU:eE5/Aph

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
4176	msedge.exe
4176	msedge.exe
2792	identity_helper.exe
2792	identity_helper.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 4164	4176	msedge.exe	81
PID 4176 wrote to memory of 4164	4176	msedge.exe	81
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 1244	4176	msedge.exe	82
PID 4176 wrote to memory of 3144	4176	msedge.exe	83
PID 4176 wrote to memory of 3144	4176	msedge.exe	83
PID 4176 wrote to memory of 808	4176	msedge.exe	84
PID 4176 wrote to memory of 808	4176	msedge.exe	84
PID 4176 wrote to memory of 808	4176	msedge.exe	84
PID 4176 wrote to memory of 808	4176	msedge.exe	84
PID 4176 wrote to memory of 808	4176	msedge.exe	84
PID 4176 wrote to memory of 808	4176	msedge.exe	84
PID 4176 wrote to memory of 808	4176	msedge.exe	84
PID 4176 wrote to memory of 808	4176	msedge.exe	84
PID 4176 wrote to memory of 808	4176	msedge.exe	84
PID 4176 wrote to memory of 808	4176	msedge.exe	84
PID 4176 wrote to memory of 808	4176	msedge.exe	84
PID 4176 wrote to memory of 808	4176	msedge.exe	84
PID 4176 wrote to memory of 808	4176	msedge.exe	84
PID 4176 wrote to memory of 808	4176	msedge.exe	84
PID 4176 wrote to memory of 808	4176	msedge.exe	84
PID 4176 wrote to memory of 808	4176	msedge.exe	84
PID 4176 wrote to memory of 808	4176	msedge.exe	84
PID 4176 wrote to memory of 808	4176	msedge.exe	84
PID 4176 wrote to memory of 808	4176	msedge.exe	84
PID 4176 wrote to memory of 808	4176	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\afd26118392edcf58897826b6b60f8c1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef34646f8,0x7ffef3464708,0x7ffef3464718
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16531332456374856899,12957976246575360354,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,16531332456374856899,12957976246575360354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,16531332456374856899,12957976246575360354,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16531332456374856899,12957976246575360354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16531332456374856899,12957976246575360354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16531332456374856899,12957976246575360354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16531332456374856899,12957976246575360354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16531332456374856899,12957976246575360354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16531332456374856899,12957976246575360354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16531332456374856899,12957976246575360354,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16531332456374856899,12957976246575360354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16531332456374856899,12957976246575360354,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16531332456374856899,12957976246575360354,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
99384eeea575098325efad2e20f50d1d

SHA1
5154e01e1d7d5e7413d6b959e9cc7ef1d01e385a

SHA256
92c3baf61648a006e827c120267a65e863dc83edd51479ebbb020882e1f6004a

SHA512
ed3008cb1f9eee967e103bf3c07c5b0db7764cbc7fed084d87b2b4e6d0d2985c16fd57ee6779db988c0fc3427b5a732e9ef297262daa01727b29b034c1b15e7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ca2f8b9421cea851a0004c692d349009

SHA1
aba21ee08e7b1b81af33124a49edf5f86e1114e3

SHA256
c673b7b9f60a4f6ebd637d87f286aab9622b1c47d7b5d98f166f7f907907a975

SHA512
5461a5e72750b6c9f9182a16be9367e71a7c971d4bc92a758c8b8a309f4a17221fee4dedf297acc91a6066c80b2524dbd46959b719326ce6fe41c512a106a661

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
de7785ce21f51b4fda8900d8df5720b2

SHA1
26046f144b4a4e368d2d7ca626e4db917927415c

SHA256
58d089cad6a402b231e98111029913dea04f22381b66f5534d9cddc370b4c3d8

SHA512
95b71581fb25aab8a02d4a9ed8ed7bd265d51fed625237b384f669bd9b10e3c5c05c6d2d7ef04d5855894ec6c3eee10e2e8716ad5405b748d795aa89997afb06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
da63714030182a156f38c65b4176d2e4

SHA1
4ab6ab1088c41176cf950cf242f5174689b22370

SHA256
195267f3d958800cef769b60d105551add2c2aa532ea7e96257fa4fe51687028

SHA512
e4ca84e501b60c1d67171313a94c0d930adf712cf88735ef359697d01b6fa6de0306f6d6c744361e1422f448a07e384fa71fdfad31a3a06efb749d4903754489

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
06021be811df21b20477d67a88736b39

SHA1
71946c1d10906eab12e6838675867f2495413468

SHA256
68e6b3bf7df331240f652d1c436484253bc7618003203b09c7996931c23cb8a9

SHA512
571b03fa59c0f1a5eb9e339021ddedfdf498ab64c2bb08fc9e4570fe3fe2a797c76ea025c770be6d5940852ada45238a90d9ee6f3c6a682164a9afae6da5d759

Download Submit