fe05e71c76c1b5b9d4d48f03dcb607627a16e2752daa13abb7d53d88e1cbcc7c

Analysis

max time kernel
145s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0dc2f578a61b87ce8fb74a083c0c41ef_JaffaCakes118.html
Size

22KB
MD5

0dc2f578a61b87ce8fb74a083c0c41ef
SHA1

77a685abf1998980670ea6371c6db3224544c933
SHA256

fe05e71c76c1b5b9d4d48f03dcb607627a16e2752daa13abb7d53d88e1cbcc7c
SHA512

9ca94253815df0720dc97dd70fd3d1aaee0899f88c07d05b4c7d0c247f113cbb0c2a8c3c50adfe241182f27441f1e1689eac43e88131c8583dc1c04eee8ec240
SSDEEP

384:wtXiS/z/E/y/8//WJfp9U3cIlmiCQ/vUj9tC89cv06kDmDTV+iJyiZq6rvxN3Z:wtXiS/z/E/y/8//WJfp9U3cIlminUj96

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
916	msedge.exe
916	msedge.exe
228	msedge.exe
228	msedge.exe
1312	identity_helper.exe
1312	identity_helper.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 3592	228	msedge.exe	84
PID 228 wrote to memory of 3592	228	msedge.exe	84
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 3828	228	msedge.exe	85
PID 228 wrote to memory of 916	228	msedge.exe	86
PID 228 wrote to memory of 916	228	msedge.exe	86
PID 228 wrote to memory of 4996	228	msedge.exe	87
PID 228 wrote to memory of 4996	228	msedge.exe	87
PID 228 wrote to memory of 4996	228	msedge.exe	87
PID 228 wrote to memory of 4996	228	msedge.exe	87
PID 228 wrote to memory of 4996	228	msedge.exe	87
PID 228 wrote to memory of 4996	228	msedge.exe	87
PID 228 wrote to memory of 4996	228	msedge.exe	87
PID 228 wrote to memory of 4996	228	msedge.exe	87
PID 228 wrote to memory of 4996	228	msedge.exe	87
PID 228 wrote to memory of 4996	228	msedge.exe	87
PID 228 wrote to memory of 4996	228	msedge.exe	87
PID 228 wrote to memory of 4996	228	msedge.exe	87
PID 228 wrote to memory of 4996	228	msedge.exe	87
PID 228 wrote to memory of 4996	228	msedge.exe	87
PID 228 wrote to memory of 4996	228	msedge.exe	87
PID 228 wrote to memory of 4996	228	msedge.exe	87
PID 228 wrote to memory of 4996	228	msedge.exe	87
PID 228 wrote to memory of 4996	228	msedge.exe	87
PID 228 wrote to memory of 4996	228	msedge.exe	87
PID 228 wrote to memory of 4996	228	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0dc2f578a61b87ce8fb74a083c0c41ef_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ff8130f46f8,0x7ff8130f4708,0x7ff8130f4718
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7803320056367771281,10165489330123938875,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,7803320056367771281,10165489330123938875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,7803320056367771281,10165489330123938875,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7803320056367771281,10165489330123938875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2220 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7803320056367771281,10165489330123938875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7803320056367771281,10165489330123938875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7803320056367771281,10165489330123938875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7803320056367771281,10165489330123938875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7803320056367771281,10165489330123938875,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7803320056367771281,10165489330123938875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7803320056367771281,10165489330123938875,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7803320056367771281,10165489330123938875,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3092 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2a70f1bd4da893a67660d6432970788d

SHA1
ddf4047e0d468f56ea0c0d8ff078a86a0bb62873

SHA256
c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561

SHA512
26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fbe1ce4d182aaffb80de94263be1dd35

SHA1
bc6c9827aa35a136a7d79be9e606ff359e2ac3ea

SHA256
0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51

SHA512
3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\596e6f31-783d-49b1-9f9a-6d88ec4fda98.tmp

Filesize
5KB

MD5
728b8d063bf9d38b55156253a314b82b

SHA1
d055fca5e399bf5933bdfa6b4d286e41a7917d1e

SHA256
0d1a00dd6d74f01423e19b45dc4a424159ad8638949998640003d9176c68e490

SHA512
90e87c3e9592fb7b5b77c000032b9aa291f766871e5859c08dd7d297678d9dab93e339882a8c67d47c0e4b375139e062f9403de48ab647f315ce072d73bbbca1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
99802afa98fd3dac75281bf4bb515fd2

SHA1
5bb2c68e16f5d715ff57f2333702bc02e52845aa

SHA256
90fd4477007a9dce9f7096a107b699128f179f10ea2dc559c506df1571a0084d

SHA512
50896b0bbae00a99902b60c6b69a4109d05e57c1c895d522f3538d5e813b8786cd975685ae6e717e86c26b7909310dd897072e2f58e52a07d98f46aa2d60548f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
324be1eae4e9e490695eb1a2ae82bc17

SHA1
220075ea77c205ad86463fbffb477e6c8cc04a18

SHA256
a9b7c35cc0e57aff6a03695cd4ee0f24392b39311935af859b0c4c30c16030b8

SHA512
c6591cf459887a5994f675fdb6f57bef5a7678bb59f9ac4c96fd2cf6fda2739ccb3bd1cc2584a5935d44084a0d4bb8aaeb6c128da30820f59c5f88f4774c39e1

Download Submit