02eea0cd877097c8370fe7efb07c61571f0292f4e25898b5c26f9e155fff36b6

Analysis

max time kernel
143s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 07:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48d969efcc6c001bfb6e61aacc721649_JaffaCakes118.html
Size

30KB
MD5

48d969efcc6c001bfb6e61aacc721649
SHA1

61aace6ab32baa86b743d790ed75237ce8911e34
SHA256

02eea0cd877097c8370fe7efb07c61571f0292f4e25898b5c26f9e155fff36b6
SHA512

943bd9cb27a7a600a95fadee3828cb097666b1c0bc0e58b3bb76162541d1733fa14813375c96bbafcef0e334cdc8b0e32246347ecfacaba73c3cc86f0abf0882
SSDEEP

192:uW7Nb5nIj+tnQjxn5Q/enQie9NntOInQOkEnteInQTbnFnQTXCYAe9EYkcwqHAmn:MQ/j/9FNpHu8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3940	msedge.exe
3940	msedge.exe
2528	msedge.exe
2528	msedge.exe
4388	identity_helper.exe
4388	identity_helper.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 3060	2528	msedge.exe	83
PID 2528 wrote to memory of 3060	2528	msedge.exe	83
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 1112	2528	msedge.exe	84
PID 2528 wrote to memory of 3940	2528	msedge.exe	85
PID 2528 wrote to memory of 3940	2528	msedge.exe	85
PID 2528 wrote to memory of 4808	2528	msedge.exe	86
PID 2528 wrote to memory of 4808	2528	msedge.exe	86
PID 2528 wrote to memory of 4808	2528	msedge.exe	86
PID 2528 wrote to memory of 4808	2528	msedge.exe	86
PID 2528 wrote to memory of 4808	2528	msedge.exe	86
PID 2528 wrote to memory of 4808	2528	msedge.exe	86
PID 2528 wrote to memory of 4808	2528	msedge.exe	86
PID 2528 wrote to memory of 4808	2528	msedge.exe	86
PID 2528 wrote to memory of 4808	2528	msedge.exe	86
PID 2528 wrote to memory of 4808	2528	msedge.exe	86
PID 2528 wrote to memory of 4808	2528	msedge.exe	86
PID 2528 wrote to memory of 4808	2528	msedge.exe	86
PID 2528 wrote to memory of 4808	2528	msedge.exe	86
PID 2528 wrote to memory of 4808	2528	msedge.exe	86
PID 2528 wrote to memory of 4808	2528	msedge.exe	86
PID 2528 wrote to memory of 4808	2528	msedge.exe	86
PID 2528 wrote to memory of 4808	2528	msedge.exe	86
PID 2528 wrote to memory of 4808	2528	msedge.exe	86
PID 2528 wrote to memory of 4808	2528	msedge.exe	86
PID 2528 wrote to memory of 4808	2528	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\48d969efcc6c001bfb6e61aacc721649_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc43046f8,0x7ffcc4304708,0x7ffcc4304718
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,7025257306329898099,15870422378084663776,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,7025257306329898099,15870422378084663776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,7025257306329898099,15870422378084663776,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7025257306329898099,15870422378084663776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7025257306329898099,15870422378084663776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,7025257306329898099,15870422378084663776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,7025257306329898099,15870422378084663776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7025257306329898099,15870422378084663776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7025257306329898099,15870422378084663776,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7025257306329898099,15870422378084663776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7025257306329898099,15870422378084663776,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,7025257306329898099,15870422378084663776,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5168 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8dc45b70cbe29a357e2c376a0c2b751b

SHA1
25d623cea817f86b8427db53b82340410c1489b2

SHA256
511cfb6bedbad2530b5cc5538b6ec2184fc4f85947ba4c8166d0bb9f5fe2703a

SHA512
3ce0f52675feb16d6e62aae1c50767da178b93bdae28bacf6df3a2f72b8cc75b09c5092d9065e0872e5d09fd9ffe0c6931d6ae1943ddb1927b85d60659ef866e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1790c766c15938258a4f9b984cf68312

SHA1
15c9827d278d28b23a8ea0389d42fa87e404359f

SHA256
2e3978bb58c701f3c6b05de9349b7334a194591bec7bcf73f53527dc0991dc63

SHA512
2682d9c60c9d67608cf140b6ca4958d890bcbc3c8a8e95fcc639d2a11bb0ec348ca55ae99a5840e1f50e5c5bcf3e27c97fc877582d869d98cc4ea3448315aafb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
318d0ed572f6932e0dffe78ffd449df4

SHA1
56574fa1e35e3404c54000236c138d06b7a1007f

SHA256
d883f2f41c97f9527a48f1287ce1b9215406dc274210b53d07a86970671878f6

SHA512
7ebfaa61918dc4e8655de3afb1018e424d41f08051c3fc0ec6ffa89fbb967dfe15564773ae0eacf5819badbbe574b7735c7185a56510dedb4fc3766e21e24e05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
96d0f3b028f0dc1bf4410ed137281f02

SHA1
9b2df954cc5233bef0e255b89a33894d41af868b

SHA256
b65db608003feb2b273670d6548b9b33ddfd3854dccef54956136724b0303377

SHA512
dca91ec28153fc8dcf0e32addf40f249d48a56215c9d5e0f723b61040103d2b45dba5d246b5e4bd7d2bb0599ba63de48dfe145ed094ce8f85252fd660834dcd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
216d81d004eeb278b4df46e3edc177ee

SHA1
e94141cb2723a0046ff8f5dc1d7eced6b67e7321

SHA256
6310c820f7a732897f773f07b047bb7694b549eacadd0b787497bbd7fb9b8915

SHA512
dbf09352b4762e6393a59d709464a9f8b33263aa9fcf418657dd6dd6326b679093eba9b65df98f06c6489b58a1ac2b52a67cdf09e27629f448fae88fc1c9ce7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a650084906279bb48a63be1faa4473ea

SHA1
c88a14b668d322ff22871710efdf47a9b1ed8db8

SHA256
99b26b627f96383962e6bff7a1e42b5b01708abdc0083b0fda63b365be7047be

SHA512
5487dc4170d70a7ed87e14935631650dd4bd0dfaab1286b3ce4e0dd133b6a7e5ec49ede9e51606a5146e0327b191b8485bb9ca16d3f1a7f708cf0d7296c001db

Download Submit