7d8de298b3c11dd2bd4055ca4250346595278f298282395817f51e13db22192a

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b10bac55f6107f873f782c646115f676_JaffaCakes118.html
Size

33KB
MD5

b10bac55f6107f873f782c646115f676
SHA1

f20b88948ddeb7a2a05e414a57a3b3b968c68606
SHA256

7d8de298b3c11dd2bd4055ca4250346595278f298282395817f51e13db22192a
SHA512

2fb80b4575b3553b24749520b3d00d34a9abd43de17e821a1c9e3aa1dc60d6c2a583b2602a39dbe3ed62f278a3697b87b8254ee496a5ffdaa0623fe66a912c53
SSDEEP

768:XmgcSNni1R/rQC9oiVBREsLHMKE4NdT0/y81WvstBp4x:XDcSg1R/rQUoihE2HMl4N90/y8WKBp4x

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
840	msedge.exe
840	msedge.exe
360	msedge.exe
360	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 360 wrote to memory of 4940	360	msedge.exe	81
PID 360 wrote to memory of 4940	360	msedge.exe	81
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 4588	360	msedge.exe	82
PID 360 wrote to memory of 840	360	msedge.exe	83
PID 360 wrote to memory of 840	360	msedge.exe	83
PID 360 wrote to memory of 3428	360	msedge.exe	84
PID 360 wrote to memory of 3428	360	msedge.exe	84
PID 360 wrote to memory of 3428	360	msedge.exe	84
PID 360 wrote to memory of 3428	360	msedge.exe	84
PID 360 wrote to memory of 3428	360	msedge.exe	84
PID 360 wrote to memory of 3428	360	msedge.exe	84
PID 360 wrote to memory of 3428	360	msedge.exe	84
PID 360 wrote to memory of 3428	360	msedge.exe	84
PID 360 wrote to memory of 3428	360	msedge.exe	84
PID 360 wrote to memory of 3428	360	msedge.exe	84
PID 360 wrote to memory of 3428	360	msedge.exe	84
PID 360 wrote to memory of 3428	360	msedge.exe	84
PID 360 wrote to memory of 3428	360	msedge.exe	84
PID 360 wrote to memory of 3428	360	msedge.exe	84
PID 360 wrote to memory of 3428	360	msedge.exe	84
PID 360 wrote to memory of 3428	360	msedge.exe	84
PID 360 wrote to memory of 3428	360	msedge.exe	84
PID 360 wrote to memory of 3428	360	msedge.exe	84
PID 360 wrote to memory of 3428	360	msedge.exe	84
PID 360 wrote to memory of 3428	360	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b10bac55f6107f873f782c646115f676_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffabd7046f8,0x7ffabd704708,0x7ffabd704718
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,15945157447657283039,11319202344400997304,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,15945157447657283039,11319202344400997304,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,15945157447657283039,11319202344400997304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15945157447657283039,11319202344400997304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15945157447657283039,11319202344400997304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,15945157447657283039,11319202344400997304,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,15945157447657283039,11319202344400997304,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15945157447657283039,11319202344400997304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15945157447657283039,11319202344400997304,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15945157447657283039,11319202344400997304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15945157447657283039,11319202344400997304,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,15945157447657283039,11319202344400997304,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
01e6bd8f332e1c1f5f9edaed11095bab

SHA1
868a1294e8e4427545211a1e87929b6c85f57002

SHA256
a1650d2e0335c96be4cacf188fb52eacd19b8a9660ff1c9268df8e84bbfed7e2

SHA512
41494e0ded793231258f1e34c6d49f9f1c26644cfbbbca464499e0f6b173fd4d9acce69d77504fa0d08fbae92a1f0690f48ebb78305691d30b44ef28604cd97e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2fc8c9c6a48ab1ed530ac90fac87df07

SHA1
56cfd14c0dfcccca9974dce73f1c4932394938e0

SHA256
52f079dbcb4fb3e815c64f503c4b3e2e43258b8df2b76d97180b67f5acfbeed7

SHA512
bd967cdd65a13ec3a55f3f7e8d2aba00adf65760f8e31c37626138ecfdbbc5e9b1c6b5b393f1379c2e64a257d1c71f7f46f9e2c1502919611160f5be7d6b93bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
be0bd98375f48188384587551bbcbe60

SHA1
b5e6e3f2016e5907bb38ef32fec5af4405e3f145

SHA256
2cf74972d4f94cab09839c020662401a7063ca9a95e502eddd89a1519618116d

SHA512
b4fb5cc8227756bb92e4d4a73513efd2f752d886d790cc53f6054c29c9f7e24cf1df970c86c55f9120a8cae9891c4dcd9bde226a71d8bb75f07b09e7974ec5c5

Download Submit