e7c0795b0f4a611fb05191d4129cdc8f653efb49e09834fd44d299630d158e97

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e7f2e2efb826061e0e6c1d520261e300_JaffaCakes118.html
Size

53KB
MD5

e7f2e2efb826061e0e6c1d520261e300
SHA1

1eaff212ba81789d9cb70ffa568ef0a1cdc8fd2d
SHA256

e7c0795b0f4a611fb05191d4129cdc8f653efb49e09834fd44d299630d158e97
SHA512

2cf151b3c95294a2ac2e5f840006a8d7566bbde4a0e56633d69900cfc033641f94eb354a701fa638327ace5e804fb18f18135ac4aa2a0906517a053df5b54f7d
SSDEEP

1536:CkgUiIakTqGivi+PyUbrunlY463Nj+q5VyvR0w2AzTICbbLRoh/t9M/dNwIUTDmd:CkgUiIakTqGivi+PyUbrunlY463Nj+qm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
2720	msedge.exe
2720	msedge.exe
4844	identity_helper.exe
4844	identity_helper.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 3224	2720	msedge.exe	84
PID 2720 wrote to memory of 3224	2720	msedge.exe	84
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 1604	2720	msedge.exe	86
PID 2720 wrote to memory of 4328	2720	msedge.exe	87
PID 2720 wrote to memory of 4328	2720	msedge.exe	87
PID 2720 wrote to memory of 4640	2720	msedge.exe	88
PID 2720 wrote to memory of 4640	2720	msedge.exe	88
PID 2720 wrote to memory of 4640	2720	msedge.exe	88
PID 2720 wrote to memory of 4640	2720	msedge.exe	88
PID 2720 wrote to memory of 4640	2720	msedge.exe	88
PID 2720 wrote to memory of 4640	2720	msedge.exe	88
PID 2720 wrote to memory of 4640	2720	msedge.exe	88
PID 2720 wrote to memory of 4640	2720	msedge.exe	88
PID 2720 wrote to memory of 4640	2720	msedge.exe	88
PID 2720 wrote to memory of 4640	2720	msedge.exe	88
PID 2720 wrote to memory of 4640	2720	msedge.exe	88
PID 2720 wrote to memory of 4640	2720	msedge.exe	88
PID 2720 wrote to memory of 4640	2720	msedge.exe	88
PID 2720 wrote to memory of 4640	2720	msedge.exe	88
PID 2720 wrote to memory of 4640	2720	msedge.exe	88
PID 2720 wrote to memory of 4640	2720	msedge.exe	88
PID 2720 wrote to memory of 4640	2720	msedge.exe	88
PID 2720 wrote to memory of 4640	2720	msedge.exe	88
PID 2720 wrote to memory of 4640	2720	msedge.exe	88
PID 2720 wrote to memory of 4640	2720	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e7f2e2efb826061e0e6c1d520261e300_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3a8046f8,0x7fff3a804708,0x7fff3a804718
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,12716922342182048920,4278529843394651713,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,12716922342182048920,4278529843394651713,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,12716922342182048920,4278529843394651713,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12716922342182048920,4278529843394651713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12716922342182048920,4278529843394651713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12716922342182048920,4278529843394651713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,12716922342182048920,4278529843394651713,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,12716922342182048920,4278529843394651713,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12716922342182048920,4278529843394651713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12716922342182048920,4278529843394651713,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12716922342182048920,4278529843394651713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12716922342182048920,4278529843394651713,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,12716922342182048920,4278529843394651713,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
403B

MD5
0443126d37a3e565879f536e76c47ca5

SHA1
728a56c41a58d96cc9a2e8bd4b6fdfe65624b214

SHA256
52331bfc041c62791bc90e538a84faf09d7f168cba4dd893fb919b843eace64e

SHA512
c95019048f989cc512659d2f0f5ea1294ceeaf854af85768515c62c22127cf66a99d94c1334e3be7390ee1b08350db6ce9bd506f883c4da0bb86e33131bf0311

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ca655f5db7a8e10c9a76870a7d7db283

SHA1
9d3c6aae680f52e1ee07ce4caff484dd433a9ce2

SHA256
78bcfe5d116427c5506da2db3c5c2e590faa2c0540e6df523876f2b2c1e146e8

SHA512
96a017618ee599cecac7319a653692e202108a5c8cdec54a8633cdbe6f42b106a638c9a92e653de6827b7bae9189b0883fd68caa80ba4efccbbcbc19c0d1368a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c9616238a8a8cda234b4a269e94b80c8

SHA1
e152af9e8718600bb4c54a9a084b135b7fa259b4

SHA256
bc99371a8ff69c969ddeb07e80876e630d5b780bcebd3294373148f483d66b0f

SHA512
f872b06616b3e2a49c84f93de1ea4d85b9684af15db50c447bf895bed641a0c935f0caf1e8b11273790457d51748183e108b214710ff612eb210ffcfc1e7529d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
35867b8cf7e5cae75b07f5db72a4582f

SHA1
e9095773bf0002185bd18a2d4fc3bc1d615b4e58

SHA256
4d435cc2efc2b4e4062bcb3570d25163986f0146a48faa6e2a4ce2aa511f4924

SHA512
d1358bc0c6401820de392c842c55b9c3e5076355344b75723c0815c5c44d4107983d9e9b3a171dc4bfac5a1997466d73ee6fb1adf10848c4d88009547eb7eb5f

Download Submit