7e221f68ea2c03095ae0e093e4f9a8da4546615825e233563714a8c1ec4a49c6

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 04:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1607dde0d8e24ed3cb199b35dcaa1fd5_JaffaCakes118.html
Size

18KB
MD5

1607dde0d8e24ed3cb199b35dcaa1fd5
SHA1

7e0dced7f96b3a0362e63b57cbe8ed63fd6dfb38
SHA256

7e221f68ea2c03095ae0e093e4f9a8da4546615825e233563714a8c1ec4a49c6
SHA512

2ece980de73f40d0c67a3b2e931b77eb85fab8d7ae45b5858565ffc316e96395166f56bf5ba222b1fb545d693be60e835985e1f79265b65f72daf871ea8943fb
SSDEEP

384:LAzSx+1Y5GVpHnAzagWVk3WigiciTiwigiMiTiuKF:SY5GVpHAzazVk39R2N9B27

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3024	msedge.exe
3024	msedge.exe
4856	msedge.exe
4856	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 3396	4856	msedge.exe	83
PID 4856 wrote to memory of 3396	4856	msedge.exe	83
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 1316	4856	msedge.exe	84
PID 4856 wrote to memory of 3024	4856	msedge.exe	85
PID 4856 wrote to memory of 3024	4856	msedge.exe	85
PID 4856 wrote to memory of 1672	4856	msedge.exe	86
PID 4856 wrote to memory of 1672	4856	msedge.exe	86
PID 4856 wrote to memory of 1672	4856	msedge.exe	86
PID 4856 wrote to memory of 1672	4856	msedge.exe	86
PID 4856 wrote to memory of 1672	4856	msedge.exe	86
PID 4856 wrote to memory of 1672	4856	msedge.exe	86
PID 4856 wrote to memory of 1672	4856	msedge.exe	86
PID 4856 wrote to memory of 1672	4856	msedge.exe	86
PID 4856 wrote to memory of 1672	4856	msedge.exe	86
PID 4856 wrote to memory of 1672	4856	msedge.exe	86
PID 4856 wrote to memory of 1672	4856	msedge.exe	86
PID 4856 wrote to memory of 1672	4856	msedge.exe	86
PID 4856 wrote to memory of 1672	4856	msedge.exe	86
PID 4856 wrote to memory of 1672	4856	msedge.exe	86
PID 4856 wrote to memory of 1672	4856	msedge.exe	86
PID 4856 wrote to memory of 1672	4856	msedge.exe	86
PID 4856 wrote to memory of 1672	4856	msedge.exe	86
PID 4856 wrote to memory of 1672	4856	msedge.exe	86
PID 4856 wrote to memory of 1672	4856	msedge.exe	86
PID 4856 wrote to memory of 1672	4856	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1607dde0d8e24ed3cb199b35dcaa1fd5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9475d46f8,0x7ff9475d4708,0x7ff9475d4718
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,10897545502130810764,7806860032745407042,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,10897545502130810764,7806860032745407042,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,10897545502130810764,7806860032745407042,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10897545502130810764,7806860032745407042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10897545502130810764,7806860032745407042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,10897545502130810764,7806860032745407042,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3012 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
308B

MD5
ad0b0a950b8a1097dc13875f63c7f4b4

SHA1
6293a7750db6db4835264802fc79ce2cc635bf0e

SHA256
8298e91ccbe8325f613064f6c09c3d578198dac6e3da8b5345d4013f41c2ece9

SHA512
83fdcf43eb5ca097fda1850d1975dfc6e7458910d310f9893ec5fd6d84d8350630791cf0ff70123a9ca7f15926952dd242d885013dfcb39f4db4f7f920ced98f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ea8693f6865aeb4f98ca385262fbbed0

SHA1
caa7ad2ae91a6305633f180992c4b15e00f8107d

SHA256
15446f5e84583571c857c5f00c8ad809c417e8ddfe862470f1918651d2f90f01

SHA512
b73c6fb6f7493f68effa2b0f58af0cb0ce360e3d08df3f93cf88cb73153a71a8ade500c41d95d61b0c8d8ecc284920e5e770d5715d24603ad547aec37254c878

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
671c44ba774fd7ffcb542b2153e49bcc

SHA1
03d642150b404dc91f791c7aa14af6d703370591

SHA256
1d163e97a50e4ac0fb7fded776340aa1821444acd9f672ace12421e5f3b80053

SHA512
fc5a775af37c6639cdd665e569a151b0f07196ee8ea5848b812f2d1c5eb63fdc1051e281b1aa423e33d76404f1ad5ec02fb8fce6bc84724443a2f53f53c5499e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bcf6f3a96113d9b51c1e02aadb3882ef

SHA1
ed8d8fa47bc756264222a2f4aa17b199bac1fc04

SHA256
8cd88f79e20a7ac236eebc76d389cc8935d691d3a134d6a962f12837f0eae43f

SHA512
238292d68b8e512715af925e24d92617a504453058e90a80da2717d6b2227f41200b8b8827cb3846de989a493834ab8f32b7dd5b689dae1bf57f1ce7bb2d2a60

Download Submit