5a834886541e55bf4ac4531322c5fc626d0ce7f6c49ca9d205a1deba357df4e9

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16-06-2024 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b51e64d0ac213c780a82bd02ac1f737f_JaffaCakes118.html
Size

34KB
MD5

b51e64d0ac213c780a82bd02ac1f737f
SHA1

64bc0549c91cc980888774fe7c23a3cd7e28ca35
SHA256

5a834886541e55bf4ac4531322c5fc626d0ce7f6c49ca9d205a1deba357df4e9
SHA512

d6e03dbb0d752a97c34d86da14a2b4b46de74d6513539885f27e26e752d2f7220e067a296507d8302133063eeb80e20fc7d69a17c4c3d6077e36d106305f4702
SSDEEP

768:KSFQW81D4RA+vEOjz6rdG2Gil54RZfPGnf3Gu34aji6781DdRA4vEOjq6h8aRlRV:jFQW81D4RA+vEOjz6raAhIa2C81DdRAY

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2396	msedge.exe
2396	msedge.exe
4164	identity_helper.exe
4164	identity_helper.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2960	2396	msedge.exe	81
PID 2396 wrote to memory of 2960	2396	msedge.exe	81
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 3884	2396	msedge.exe	82
PID 2396 wrote to memory of 2416	2396	msedge.exe	83
PID 2396 wrote to memory of 2416	2396	msedge.exe	83
PID 2396 wrote to memory of 3192	2396	msedge.exe	84
PID 2396 wrote to memory of 3192	2396	msedge.exe	84
PID 2396 wrote to memory of 3192	2396	msedge.exe	84
PID 2396 wrote to memory of 3192	2396	msedge.exe	84
PID 2396 wrote to memory of 3192	2396	msedge.exe	84
PID 2396 wrote to memory of 3192	2396	msedge.exe	84
PID 2396 wrote to memory of 3192	2396	msedge.exe	84
PID 2396 wrote to memory of 3192	2396	msedge.exe	84
PID 2396 wrote to memory of 3192	2396	msedge.exe	84
PID 2396 wrote to memory of 3192	2396	msedge.exe	84
PID 2396 wrote to memory of 3192	2396	msedge.exe	84
PID 2396 wrote to memory of 3192	2396	msedge.exe	84
PID 2396 wrote to memory of 3192	2396	msedge.exe	84
PID 2396 wrote to memory of 3192	2396	msedge.exe	84
PID 2396 wrote to memory of 3192	2396	msedge.exe	84
PID 2396 wrote to memory of 3192	2396	msedge.exe	84
PID 2396 wrote to memory of 3192	2396	msedge.exe	84
PID 2396 wrote to memory of 3192	2396	msedge.exe	84
PID 2396 wrote to memory of 3192	2396	msedge.exe	84
PID 2396 wrote to memory of 3192	2396	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b51e64d0ac213c780a82bd02ac1f737f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd66c246f8,0x7ffd66c24708,0x7ffd66c24718
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,17386659574297781250,14482958351296332422,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,17386659574297781250,14482958351296332422,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,17386659574297781250,14482958351296332422,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17386659574297781250,14482958351296332422,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17386659574297781250,14482958351296332422,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,17386659574297781250,14482958351296332422,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,17386659574297781250,14482958351296332422,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17386659574297781250,14482958351296332422,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17386659574297781250,14482958351296332422,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17386659574297781250,14482958351296332422,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17386659574297781250,14482958351296332422,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,17386659574297781250,14482958351296332422,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
572B

MD5
453a336a1ab13599d039209dc7326876

SHA1
ca706ab5b37d625087cad45df0c3d944e95ee098

SHA256
0235047aaf57459e7feeb147bdf78c933dfaef7fa6b44299a6d269d892206ecd

SHA512
8601425e7b76be79061d8bfd7da627f772e963f09db8ea18c40e9f72bb0c27eb47c80a4873f3f54b7e80afbedf748e1f8c624fadec5c2270787d7c51bd33be36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c07c495b5f66c7d6a6af011a34b1a3aa

SHA1
846b50a86eda8ad3cf8eda759ebd5dad6b39a1b5

SHA256
ad9e645a3ac157f8fa0160f0c492eacbff37871fd15f097e21e4e8737ee0fdb0

SHA512
5ded4f8d934b56d31d9f73571130ffee030d966f9025c9e1358a44c16d515c95c338f2e80c24cbc54b0a248dcb727adcb5a902932c6454fa561f3d209af977d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a17a4e287a2ccae1ca39a3b67c4c76fe

SHA1
e39bdc76033b95909bb30b13a63c229be2d2bc6e

SHA256
bdf96be35e52c3d3686aa22ef0990c6f3d6afae6c59506d576645ebbc16f81d3

SHA512
5b2d5f2058fe3f2f2782518d1d99d7f2f975d85a9b32ec234e69d94b4c372b1eefb21f954d833fbdc3399417810890634edd4700f90d16f7d133ed88887faf2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
256f8a362cd5e1ef40b85d869f8ebe6e

SHA1
9e722ce0e325b8be4c2e6188c975060076776126

SHA256
86b66977f1863ca02f9d82fb4cfffe7d23007833882283d9c829ee915899f76a

SHA512
759b15c505caff9afdbd6cb65c802b8222cd791fb7fe3d0b8a9be7aea3eed2015f09f5074d097f4a2e69d6258f141349dabf1e7581fdc1f1ea528fbd5e46be7d

Download Submit