14be0528b532d42591aeb4f398f5b900325af81c485d5b80689dc9c8131497a1

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 14:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

397ac5e45fed842bd346c04d5d4b92eb_JaffaCakes118.html
Size

122KB
MD5

397ac5e45fed842bd346c04d5d4b92eb
SHA1

efc6564b2528d1cb8192f8c87fff5bbbd4ed136a
SHA256

14be0528b532d42591aeb4f398f5b900325af81c485d5b80689dc9c8131497a1
SHA512

c0e05bd27dfc2691dd201a81943b2951ce8184c7976a5f4999cca9943c5a49275cf60b9d692ef11fb822a49679e928a3ad29cb696dbb476fc11639e2a9d4a462
SSDEEP

1536:G9DMLJjN/AdWvTnhjDf2/aAOga5cZeuzBLzAxhQEGix8mBfzB25xkZsX57Y+NeLM:G6AdOgVKozWkvwIH

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
1032	msedge.exe
1032	msedge.exe
3156	identity_helper.exe
3156	identity_helper.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 1932	1032	msedge.exe	83
PID 1032 wrote to memory of 1932	1032	msedge.exe	83
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 2356	1032	msedge.exe	84
PID 1032 wrote to memory of 1180	1032	msedge.exe	85
PID 1032 wrote to memory of 1180	1032	msedge.exe	85
PID 1032 wrote to memory of 4756	1032	msedge.exe	86
PID 1032 wrote to memory of 4756	1032	msedge.exe	86
PID 1032 wrote to memory of 4756	1032	msedge.exe	86
PID 1032 wrote to memory of 4756	1032	msedge.exe	86
PID 1032 wrote to memory of 4756	1032	msedge.exe	86
PID 1032 wrote to memory of 4756	1032	msedge.exe	86
PID 1032 wrote to memory of 4756	1032	msedge.exe	86
PID 1032 wrote to memory of 4756	1032	msedge.exe	86
PID 1032 wrote to memory of 4756	1032	msedge.exe	86
PID 1032 wrote to memory of 4756	1032	msedge.exe	86
PID 1032 wrote to memory of 4756	1032	msedge.exe	86
PID 1032 wrote to memory of 4756	1032	msedge.exe	86
PID 1032 wrote to memory of 4756	1032	msedge.exe	86
PID 1032 wrote to memory of 4756	1032	msedge.exe	86
PID 1032 wrote to memory of 4756	1032	msedge.exe	86
PID 1032 wrote to memory of 4756	1032	msedge.exe	86
PID 1032 wrote to memory of 4756	1032	msedge.exe	86
PID 1032 wrote to memory of 4756	1032	msedge.exe	86
PID 1032 wrote to memory of 4756	1032	msedge.exe	86
PID 1032 wrote to memory of 4756	1032	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\397ac5e45fed842bd346c04d5d4b92eb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9303046f8,0x7ff930304708,0x7ff930304718
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,4877007967039756090,6035164437181768278,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,4877007967039756090,6035164437181768278,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,4877007967039756090,6035164437181768278,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4877007967039756090,6035164437181768278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4877007967039756090,6035164437181768278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4877007967039756090,6035164437181768278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,4877007967039756090,6035164437181768278,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,4877007967039756090,6035164437181768278,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4877007967039756090,6035164437181768278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4877007967039756090,6035164437181768278,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4877007967039756090,6035164437181768278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4877007967039756090,6035164437181768278,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,4877007967039756090,6035164437181768278,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4856 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2f842025e22e522658c640cfc7edc529

SHA1
4c2b24b02709acdd159f1b9bbeb396e52af27033

SHA256
1191573f2a7c12f0b9b8460e06dc36ca5386305eb8c883ebbbc8eb15f4d8e23e

SHA512
6e4393fd43984722229020ef662fc5981f253de31f13f30fadd6660bbc9ededcbfd163f132f6adaf42d435873322a5d0d3eea60060cf0e7f2e256262632c5d05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54aadd2d8ec66e446f1edb466b99ba8d

SHA1
a94f02b035dc918d8d9a46e6886413f15be5bff0

SHA256
1971045943002ef01930add9ba1a96a92ddc10d6c581ce29e33c38c2120b130e

SHA512
7e077f903463da60b5587aed4f5352060df400ebda713b602b88c15cb2f91076531ea07546a9352df772656065e0bf27bd285905a60f036a5c5951076d35e994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9b5c08b1-e88f-42a8-a005-2a15951bd3f8.tmp

Filesize
6KB

MD5
63a96df336490c71709c3424058d7f4f

SHA1
79e2e4e37287bb8a49a989ca5c8e691a35beb342

SHA256
e560a6bfe8cbd97d985bb64f97e25a3eaf6374d82f43de0670546ad0805beeca

SHA512
ccf062eafa89cdcb385f709ed24799cb0597751419a2ebfa4e89cf826441a04f9ea2554c36ab966d49528934170c894eb7c13692d84d0988c223649011500acd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
4e07f5cb01b612a83b52c4d53c1407b3

SHA1
7c29a501e53a2ac7051d60547225bec39f604c51

SHA256
d4a5adb23d63b1bf99d305ed76202fc6db37543c5bc58e7eec6366350dcd3dc2

SHA512
1c2c71380d7ccf38e6158177a4fa828ed78228a33e578794bf4cd1bc17193c0db6aaa9f51abe48f98a8a2be7a6944aca92379e1891eda7d307b47403277213f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
644B

MD5
2f558cc125accf34724e4df2717cff31

SHA1
d68d26d9480852c017d640ee1b20483691adb5b3

SHA256
dccb4ccfbfe855f3c2a459ff60fd9b7dc82238ac3a35f39cc1d44d24dbe95b50

SHA512
75e512c5dcb6896ca2d8e21c96707d5fb55e436053b33850cd5e7d78c6cbc9607de3a544745f23da79f1b01718c22c7da02bdd63e93f12c88ba44244dbeaabff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a6fc9dfb0613f114ad5adb67ac887d80

SHA1
47a4ec26f5c22f92b7a957bbf75ade90c99be43d

SHA256
4d6927c0a016a30a75b2179e03207db5bb46a93f7a0c53464752b4dce29bd2f4

SHA512
a58b515cf66c344c50a973db0044052145ee409cf3256f547921997fb5e32a1e41fe01c0d2ca6fb4e050b0259e977a92c49bba453008c5c04c570bafa843daa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
83b3c64d6e7d162a1e5f542f3421fc28

SHA1
80e816e72eb956796150d8e8a69e5dfac80f0ad6

SHA256
452bf45abcd4a0a50380d9c5215f4a13f16501964a5f3b263896eb60f8ec4b4d

SHA512
9b2447372d7f5eb28086df98191e022b4697fca4349dc7cec22f1f4cc339d5a3f6a38c5f52e086d46e11beb8f3303715f2371ced64a318842ffd4cb856d99a8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ea79668aaaf25455229f74c1a33e67fd

SHA1
fff2cbda56fd9810dec46a75ca0fbf1af3302fb6

SHA256
6e798bb68199d88b48b1e8e5fb114c517c35474450e19936b89ae5b8d0f59188

SHA512
dd949ae2d2cd769d02b55e3a339188edd1a0dbb0c019e8f8f09c5e8c296c15c864de294bbf6bf101d3604f39290b3d212ba2ee0d521517c57bca8fb348caded7

Download Submit