0f4e0ec19712cbfec497041cd8465e614af1832d5d6b699ee2ba1a6a252c648e

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 23:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

653f349ab0d99add24316cf56e454339_JaffaCakes118.html
Size

262KB
MD5

653f349ab0d99add24316cf56e454339
SHA1

6aba4d1cc3231a65047bd3cccf5363646fd289c3
SHA256

0f4e0ec19712cbfec497041cd8465e614af1832d5d6b699ee2ba1a6a252c648e
SHA512

5add29724ee4928eefead748846b63a6c18353159cc2361079a0f6820d65860c485f6717af2a42a1626dbf30fb417fbaa73bc92d62176ee779cf6437804ef1f9
SSDEEP

3072:wWkrtgrNzUVFPRZ0MrspN921UhwZVG3FJP7xCiw:w4GZZ0MQp21UhwZVG3ZC

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
784	msedge.exe
784	msedge.exe
4680	msedge.exe
4680	msedge.exe
2356	identity_helper.exe
2356	identity_helper.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 1068	4680	msedge.exe	84
PID 4680 wrote to memory of 1068	4680	msedge.exe	84
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 4444	4680	msedge.exe	85
PID 4680 wrote to memory of 784	4680	msedge.exe	86
PID 4680 wrote to memory of 784	4680	msedge.exe	86
PID 4680 wrote to memory of 3272	4680	msedge.exe	87
PID 4680 wrote to memory of 3272	4680	msedge.exe	87
PID 4680 wrote to memory of 3272	4680	msedge.exe	87
PID 4680 wrote to memory of 3272	4680	msedge.exe	87
PID 4680 wrote to memory of 3272	4680	msedge.exe	87
PID 4680 wrote to memory of 3272	4680	msedge.exe	87
PID 4680 wrote to memory of 3272	4680	msedge.exe	87
PID 4680 wrote to memory of 3272	4680	msedge.exe	87
PID 4680 wrote to memory of 3272	4680	msedge.exe	87
PID 4680 wrote to memory of 3272	4680	msedge.exe	87
PID 4680 wrote to memory of 3272	4680	msedge.exe	87
PID 4680 wrote to memory of 3272	4680	msedge.exe	87
PID 4680 wrote to memory of 3272	4680	msedge.exe	87
PID 4680 wrote to memory of 3272	4680	msedge.exe	87
PID 4680 wrote to memory of 3272	4680	msedge.exe	87
PID 4680 wrote to memory of 3272	4680	msedge.exe	87
PID 4680 wrote to memory of 3272	4680	msedge.exe	87
PID 4680 wrote to memory of 3272	4680	msedge.exe	87
PID 4680 wrote to memory of 3272	4680	msedge.exe	87
PID 4680 wrote to memory of 3272	4680	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\653f349ab0d99add24316cf56e454339_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffb29f46f8,0x7fffb29f4708,0x7fffb29f4718
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,17505628943468012466,12954624648099077609,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,17505628943468012466,12954624648099077609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,17505628943468012466,12954624648099077609,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17505628943468012466,12954624648099077609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17505628943468012466,12954624648099077609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17505628943468012466,12954624648099077609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1740 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,17505628943468012466,12954624648099077609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,17505628943468012466,12954624648099077609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17505628943468012466,12954624648099077609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17505628943468012466,12954624648099077609,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17505628943468012466,12954624648099077609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17505628943468012466,12954624648099077609,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,17505628943468012466,12954624648099077609,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4960 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d406f3135e11b0a0829109c1090a41dc

SHA1
810f00e803c17274f9af074fc6c47849ad6e873e

SHA256
91f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4

SHA512
2b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7f37f119665df6beaa925337bbff0e84

SHA1
c2601d11f8aa77e12ab3508479cbf20c27cbd865

SHA256
1073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027

SHA512
8e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
763B

MD5
47956dfe98d844f9b6ac8be4c77a90bf

SHA1
423c3f5840cd9b7dd35f995f8576927384393091

SHA256
3e753f65edc1013455c9bc8d0ae2bc3fa08c11395502022f0e35406145a8f8a7

SHA512
677e3fe97dff420c1d6549961baa667582b4d28ad478414430f1d1c1cc83bc0f6c5e183499e535abf405e6fc8799b471f58cb62a2c25888fecf619adf5a62746

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
732B

MD5
12001a276d10db1b56090562b3aceb74

SHA1
187215d5ce98266086d5c0e65e4d16151ba77814

SHA256
2e75df027385fa0321c127ae0ba0c2d0b2421a8f11ce3c7c46738cf225eb4380

SHA512
ba0d80f1e8a062b03ae2b104b45de979be72ab2167a7727774d98d7dd5ff99edb3fcdcd23b55ee81cb470fafd28bcd2b450591d22fc779a30357ff42e68fec0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6feb66f838e9dbce3cc3bbdfefc15590

SHA1
a1381e47c2d8059c2bf3782d6a736ec540086f75

SHA256
7ac5eac477c17c4e990cdb842420f475809ced6535418fd01ecdd2b5d51a30f4

SHA512
48fdf8b6f36c7f1ec669ba40792659fe69a0462d96ac1a21f5db808465701a4386d2e2912fd8557ddafcb4b873f39a0441b62084dbe04e2883ac3bdd6bc36a1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fa53001d-5552-4665-9a6f-579f1ed878a8.tmp

Filesize
5KB

MD5
a7ede705162e771a2f0277c137f8a034

SHA1
c40675e915c5909e1c014b8d2b9e44aa51607c7c

SHA256
11637f48ab0f906f44a7c6ea9920833f27d1c3b3c7453f69733048169b237f8f

SHA512
ac0103fcb3563409cadc900253b77559f40963032aaab9fac8d451279d53a6b269f10e867da198fce1ed6cd1b35970f557b7f476a9d1d1af5c9780853a03ec10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
12d030b4383e8dd498ac9565ea9a40fa

SHA1
4420a69cd83048c8c56a3c3fc679fbfa37ebbc68

SHA256
8c5d535d8c05ec586bf63750227ffa47556df5082b0b0b6768996f7cb81b07c5

SHA512
efdc6a28dac119684c506191626f1de725a398fc5eaeb74a30ff70cf367e01a41e73d55dea81bc294fd1561b3920668a0ba12f2af4f187ac7492fed982387ca0

Download Submit