1c73983071792905035c832a8f136812f3d9965b712f2818b70a14303f864ece

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 08:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27e142090132e7bf731cad061705247c_JaffaCakes118.html
Size

18KB
MD5

27e142090132e7bf731cad061705247c
SHA1

2e03dce1356bfb2ce585eed72187475dbaa9cc25
SHA256

1c73983071792905035c832a8f136812f3d9965b712f2818b70a14303f864ece
SHA512

53fe6383e5dcb4ca1be662454fc48559970d60899d08d3244d40741aa755c0d960354595a03486be765caccb4f4aa6a7687a272f105df0542d465d1297da7a32
SSDEEP

192:nhkVcsZd77uE5VJGxFCVkFvH0H4XBL7zv0NnfrWjoZGHcdZIEJhWCiwsb/5+q32k:hkVcsZdnubCmpRLirWjoZGHcdZIjAmL

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe
2820	msedge.exe
2820	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 872	2820	msedge.exe	82
PID 2820 wrote to memory of 872	2820	msedge.exe	82
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 648	2820	msedge.exe	84
PID 2820 wrote to memory of 4876	2820	msedge.exe	85
PID 2820 wrote to memory of 4876	2820	msedge.exe	85
PID 2820 wrote to memory of 2276	2820	msedge.exe	86
PID 2820 wrote to memory of 2276	2820	msedge.exe	86
PID 2820 wrote to memory of 2276	2820	msedge.exe	86
PID 2820 wrote to memory of 2276	2820	msedge.exe	86
PID 2820 wrote to memory of 2276	2820	msedge.exe	86
PID 2820 wrote to memory of 2276	2820	msedge.exe	86
PID 2820 wrote to memory of 2276	2820	msedge.exe	86
PID 2820 wrote to memory of 2276	2820	msedge.exe	86
PID 2820 wrote to memory of 2276	2820	msedge.exe	86
PID 2820 wrote to memory of 2276	2820	msedge.exe	86
PID 2820 wrote to memory of 2276	2820	msedge.exe	86
PID 2820 wrote to memory of 2276	2820	msedge.exe	86
PID 2820 wrote to memory of 2276	2820	msedge.exe	86
PID 2820 wrote to memory of 2276	2820	msedge.exe	86
PID 2820 wrote to memory of 2276	2820	msedge.exe	86
PID 2820 wrote to memory of 2276	2820	msedge.exe	86
PID 2820 wrote to memory of 2276	2820	msedge.exe	86
PID 2820 wrote to memory of 2276	2820	msedge.exe	86
PID 2820 wrote to memory of 2276	2820	msedge.exe	86
PID 2820 wrote to memory of 2276	2820	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\27e142090132e7bf731cad061705247c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf03346f8,0x7ffaf0334708,0x7ffaf0334718
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,14871188548123566949,17235408877461598700,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,14871188548123566949,17235408877461598700,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,14871188548123566949,17235408877461598700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14871188548123566949,17235408877461598700,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14871188548123566949,17235408877461598700,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14871188548123566949,17235408877461598700,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14871188548123566949,17235408877461598700,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,14871188548123566949,17235408877461598700,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,14871188548123566949,17235408877461598700,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14871188548123566949,17235408877461598700,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14871188548123566949,17235408877461598700,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14871188548123566949,17235408877461598700,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14871188548123566949,17235408877461598700,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,14871188548123566949,17235408877461598700,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3028 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
de1d175f3af722d1feb1c205f4e92d1e

SHA1
019cf8527a9b94bd0b35418bf7be8348be5a1c39

SHA256
1b99cae942ebf99c31795fa279d51b1a2379ca0af7b27bd3c58ea6c78a033924

SHA512
f0dcd08afd3c6a761cc1afa2846ec23fb5438d6127ebd535a754498debabd0b1ebd04858d1b98be92faf14b512f982b1f3dcbb702860e96877eb835f763f9734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
06b496d28461d5c01fc81bc2be6a9978

SHA1
36e7a9d9c7a924d5bb448d68038c7fe5e6cbf5aa

SHA256
e4a2d1395627095b0fa55e977e527ccb5b71dff3cd2d138df498f50f9f5ab507

SHA512
6488a807c978d38d65010583c1e5582548ab8102ebd68ee827e603c9bdfcdbb9f98a488d31414a829409f6edca8bd2eb4aadd4ff31b144de41249fa63a26bc91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
257B

MD5
4b1f3959bda91435c41d914cd8aef09f

SHA1
c6c0649e876aa23b275206f02e9b07093a251764

SHA256
e8991c9ccd18cec60fb89ba3bd2470448160964a368728faecf48c08a0495ec9

SHA512
9b38623e270d2322b921703a2829f6341bc0d13bdcb3c1a81bbd583f5b3bd024857e5d322120a37338b3f93b185704dda91851f99762e460f05226570a3a4613

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b9391aab869a485602c1655a072c42d2

SHA1
59c16e92894999ee5cc8989a306a53d8bae4e9dd

SHA256
d42df950eb0ba351c81c5ef4747dec65937312861df4db6c24e1c7f3028ac09c

SHA512
9041f0441e60d4bbe357dc0486c9817d43c7613495856f8e240d5577cb2e139e3a55e84c3a2b368a743e9379851dce4f3e18bc0237399e6914b356898e871b59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\abe8e45f-998f-4b8d-8325-5814d848fdee.tmp

Filesize
6KB

MD5
c8801503a74a349eb9c8e82334cfae0e

SHA1
d96e5f4f606175d254c1ce3bf7a0b26859f26a69

SHA256
deae855126e194b951a4c968834437326fef1e906f75e4becf55d67312497728

SHA512
08474adbffdd0f2daef26678ae7f7aac4f32bfba76ec2501aee813a4d99f17ecdd4164ddcae2047bde7a089174a817eda8be9af50b5a075cfb5bca180d847b34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0a7cf8a6411fc0b889e780f0ddfea9c4

SHA1
ceb86d9fd02ac900bda5507be3c219fa2ce7c993

SHA256
d5f491ad40e2d0af2a61e3ed95c012d24e7a13227d808e344de26fb309d2a1b7

SHA512
0fe09832bdd6759a08a1564822d90ed20e0afcdc558ce47854be7cbe9c8b6f109237de58c7572186123ec49a8f619bc889717c2f176aab2c30dbb24bfd05fdaa

Download Submit