58f04737a3cbfda2c4b4213d96717bcb5d057b482c06db6ccd830e779f51e2d4

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/05/2024, 23:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ebff307cc86ef9d6358190ec0ff2891_JaffaCakes118.html
Size

46KB
MD5

1ebff307cc86ef9d6358190ec0ff2891
SHA1

32a68a2f770984042df4a239617e3db4aaf4b4f6
SHA256

58f04737a3cbfda2c4b4213d96717bcb5d057b482c06db6ccd830e779f51e2d4
SHA512

dd8e8608bf6d017b34129d0699929404644c5faa4800c4f1b8636e3f9003ee32db72fe46e38e0d54cb839725446a07ebd9dd49daaa4dc0dc19147928345dca24
SSDEEP

768:zIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZODp:zIRIOITIwIgIiKZgNDfIwIGI5IVJ7Sqt

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3808065738-1666277613-1125846146-1000\{96F5579E-1190-4488-991F-4C0F91CDA40D}	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 3536	4912	msedge.exe	105
PID 4912 wrote to memory of 3536	4912	msedge.exe	105
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 400	4912	msedge.exe	106
PID 4912 wrote to memory of 4636	4912	msedge.exe	107
PID 4912 wrote to memory of 4636	4912	msedge.exe	107
PID 4912 wrote to memory of 2652	4912	msedge.exe	108
PID 4912 wrote to memory of 2652	4912	msedge.exe	108
PID 4912 wrote to memory of 2652	4912	msedge.exe	108
PID 4912 wrote to memory of 2652	4912	msedge.exe	108
PID 4912 wrote to memory of 2652	4912	msedge.exe	108
PID 4912 wrote to memory of 2652	4912	msedge.exe	108
PID 4912 wrote to memory of 2652	4912	msedge.exe	108
PID 4912 wrote to memory of 2652	4912	msedge.exe	108
PID 4912 wrote to memory of 2652	4912	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1ebff307cc86ef9d6358190ec0ff2891_JaffaCakes118.html
1⤵
PID:3532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=1420 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:1
1⤵
PID:4948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4112 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:1
1⤵
PID:2636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5872 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5544 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:1
1⤵
PID:5116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4820 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=5932 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:2472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff9e2402e98,0x7ff9e2402ea4,0x7ff9e2402eb0
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2252 --field-trial-handle=2256,i,8294955542633439934,12122318180107803626,262144 --variations-seed-version /prefetch:2
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3312 --field-trial-handle=2256,i,8294955542633439934,12122318180107803626,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3320 --field-trial-handle=2256,i,8294955542633439934,12122318180107803626,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4412 --field-trial-handle=2256,i,8294955542633439934,12122318180107803626,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4412 --field-trial-handle=2256,i,8294955542633439934,12122318180107803626,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4612 --field-trial-handle=2256,i,8294955542633439934,12122318180107803626,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4500 --field-trial-handle=2256,i,8294955542633439934,12122318180107803626,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4500 --field-trial-handle=2256,i,8294955542633439934,12122318180107803626,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
72ffd74e71771043fe09e2bfa2f0ba23

SHA1
c709939dacd84731b8cce3bfb0f29b89749f9e40

SHA256
d719a3a79a83c269fcbb8135acd0c454ab7846e317a7aefded9c95ca378a4631

SHA512
04608f4fe336b8e344cf20a433b8c664e7b1b1cbf60575b19ffe5a247ff2bc6e2891b031ed452d0da61083cfcd9237952b2175b1286ee5049080c364c0fecade

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
5710728d46d08905cdf41ca06ada1b25

SHA1
c4334d287628e248f5d9be59adadb19cf42cc914

SHA256
3a7c9c2afade371c3d4bb4d1f860f437ed3db15c402a93f110557f7960b000d0

SHA512
3e5642154195bbfc7a277d6b28368ab7da16df37d7143fc6075085b8f87182c0f83b8a19cefe6a669449830e6cc1adf21a0681554ca796c2c3508097376099d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
30KB

MD5
91a105e6270203db7ae43ffe88682584

SHA1
a16e9e855d858eaf5d7e5bc76b25d2d7f65b7a06

SHA256
dc3ec5e0964bf1ffba0398fd992abe436b89cf30c3469ee9f8497b888c84eba6

SHA512
966c1b8746f11cca2420c742b44645629467f25a2cd013d90c40cfbaeb132b2aa0921cf2d04cdb875e9240c360a4a6c16e8fd8a2b7b433d4ce553f8c83bc0890

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
67KB

MD5
a597df0c40ef901b570bcce46203595a

SHA1
075516a34c9404c40b0e5ade5e49cc1acb18f9bf

SHA256
305a0f1eb510616b8eb0b7c650c05f948503c1d7cd8c9e454d823b0204571810

SHA512
96225eddd97882fdc34969abb2083e51b3f4bd285bee88aefaaddf9c96375f05d84c5f00340db9a279e8ebb4ad6fa2f7d9835471cb5fae617167e2681f0df4b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
57KB

MD5
a7dd83bb8d2381dcead9460248013023

SHA1
df41b2e576455090752512e658ee6fe8fb25d9c5

SHA256
83b23af5bcd8e1ca37c7ad98fc20006167c2eb8630554a52b23fa8a4f2d44113

SHA512
287ed9a4810eab16e67e40f859ad81b0c1975b2eeaa9f8268d194aa6508f3d11590505eb915b96015aba70297c5d5923e4df881f612d78538c7d670645b09840

Download Submit