b5de554fc13cb36d5acd68880053cc99486767725a9b37e851bd4a00f367f859

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 08:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ff7292430b83280d68cc7b0da1176df_JaffaCakes118.html
Size

42KB
MD5

1ff7292430b83280d68cc7b0da1176df
SHA1

39adaa67a9848026c9bd46f5599777a4bebfc843
SHA256

b5de554fc13cb36d5acd68880053cc99486767725a9b37e851bd4a00f367f859
SHA512

be1a4e787edd70a9d89713fe76df8bf920e3e53aa531fd22e86a1da36f28e98cb5dcdf75b2399fd3beff4e4bc225a1f9fd1d82e7237a406bfbe3c3c8cf05c004
SSDEEP

768:e3Ep1//asitr03zhUt/ibGM9rotvg5Cod4jCqFlJzGfP4eumLGw1x1b7QUQ8ON1H:e321//Fit43zhUt/ibstvYCoKjCSJzGw

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
632	msedge.exe
632	msedge.exe
2232	msedge.exe
2232	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2232	msedge.exe
2232	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 4372	2232	msedge.exe	83
PID 2232 wrote to memory of 4372	2232	msedge.exe	83
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 2760	2232	msedge.exe	84
PID 2232 wrote to memory of 632	2232	msedge.exe	85
PID 2232 wrote to memory of 632	2232	msedge.exe	85
PID 2232 wrote to memory of 3756	2232	msedge.exe	86
PID 2232 wrote to memory of 3756	2232	msedge.exe	86
PID 2232 wrote to memory of 3756	2232	msedge.exe	86
PID 2232 wrote to memory of 3756	2232	msedge.exe	86
PID 2232 wrote to memory of 3756	2232	msedge.exe	86
PID 2232 wrote to memory of 3756	2232	msedge.exe	86
PID 2232 wrote to memory of 3756	2232	msedge.exe	86
PID 2232 wrote to memory of 3756	2232	msedge.exe	86
PID 2232 wrote to memory of 3756	2232	msedge.exe	86
PID 2232 wrote to memory of 3756	2232	msedge.exe	86
PID 2232 wrote to memory of 3756	2232	msedge.exe	86
PID 2232 wrote to memory of 3756	2232	msedge.exe	86
PID 2232 wrote to memory of 3756	2232	msedge.exe	86
PID 2232 wrote to memory of 3756	2232	msedge.exe	86
PID 2232 wrote to memory of 3756	2232	msedge.exe	86
PID 2232 wrote to memory of 3756	2232	msedge.exe	86
PID 2232 wrote to memory of 3756	2232	msedge.exe	86
PID 2232 wrote to memory of 3756	2232	msedge.exe	86
PID 2232 wrote to memory of 3756	2232	msedge.exe	86
PID 2232 wrote to memory of 3756	2232	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1ff7292430b83280d68cc7b0da1176df_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd92c546f8,0x7ffd92c54708,0x7ffd92c54718
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,7579333447759987328,15657570971780466320,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,7579333447759987328,15657570971780466320,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,7579333447759987328,15657570971780466320,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7579333447759987328,15657570971780466320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7579333447759987328,15657570971780466320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,7579333447759987328,15657570971780466320,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7996 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
92KB

MD5
0a595f65926168e21d30a9335de2f752

SHA1
cd04a208ec73bbd607d5f0e3d0acfcec0b75e390

SHA256
8bcebca463b3100cede8829ccc31cfa71f68527960620fec3bb8e4c64b057821

SHA512
b18831d787e493ef3ed766a9453ad2b2aa711d546fc91b7d8621b94dedfb1a62f10131797128b0333efa06a844a50dc0323e34c0e4879d01c1095fd263fed9ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
36KB

MD5
f3a425d5eb8825c3af0c3bd55b4e9b6b

SHA1
c64da67013fb2f57733bd30508dbd739e6a69ed5

SHA256
f3c87832b631aefa31acbe7aad7150090be3968d4a286f6e5af560f04af9b21a

SHA512
53fb91a4414210827e724cfe4707feb7f808479f78354d061751e99026c5a229a310b167eca9d7d45ded53bfa95ce6d5ee5d2f0cd016cfb37699e602dcaac0dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
534B

MD5
c3c1d87703314ec699f2763e882df12a

SHA1
65e8a2788d895ed93f58079e5483c308c1bb6a1f

SHA256
975568baa21f55dc057ec09b7dca04ef3c222b28e3292d1e99654887114b326d

SHA512
06ae3a2cc7282189441a893cddaa8e20eef74f15f9182cfd5cf54e542d6ca130e44ae08e35b14af316b1abc81df6fd45ca221fbcce994079016a75e60eb13da6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5691d0e6fc1a94c5398b8f3e1ebd63c7

SHA1
bf5e6eebb9c1146197dbc79c8f8c1a6ebc16a818

SHA256
456c78b13dda97a2075639e0cf0981c0ab30c501ecc89871cc337019bdcc7938

SHA512
af4a366bbb05d7c29860552808ffe7cf3f7e259250c9faa702d4da1d148264b1bf8d8cc733e2b54b63386eba9bc213b8734cbb6a491052e45df255bf062aec15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d9f917de0787a57972205a396b36e076

SHA1
bd39aec34d144fbd76aa2f566b2336a7b5b4058f

SHA256
994376cb68e220056a22af5f052271565aa7a22379d4a949e62e060fbb3a4917

SHA512
7afe871931002a0995423d3015dfbdcb48c591d6b2f5ecc1dc409eea9bcbd50942474554576f79d7463daed2131b2a42664e05fd79c90b42501658306c3dbd11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
ee39d032d838191674ff0a37d2aeded5

SHA1
611c3ad466a0dc2d41ed0599e8adca57b74fd00a

SHA256
12c595fe1afeb9a35617d210817c33c43a1cf57f7a796a6247d8326fc260a482

SHA512
e6c182c871227750b22dcd7078a4a152f13fc808ab87dc5ef02582751bdd18fe9895f0f8317b74b4b8bce1111a2825bfa98b83d85cecf3525770b7a0a800cd2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59963b.TMP

Filesize
204B

MD5
89800cf2d63f3cdaa089fa1508f71673

SHA1
88892a624772f0b0a32dcf48a1ea3140d12a5fb1

SHA256
ac41eb810098c72b8212c82e5f5628e38975a9b27b008b51144cda3217e86a6e

SHA512
88ae2ad0fd49be7777b2f9bd56c8124f8bd585664f8dc55ea3f31169e0115aa7f748e4fdd695faa433d193f1ad411e599b7cefe5ac846b9a40147825b7245779

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7de3cf0c9aa15629ae26469bf3fac832

SHA1
2d2c86a3980e1dedcd4455efb63c9f8da88b711d

SHA256
cb106cc66cee201e10ef2dcfed0557b6815a41e79ff3618ab50e7be231135298

SHA512
a58d7ee451c19acf0656cfcc6469730a0c527031868f29a25b92a46b8732ab42a8d26c64c22c965005f2b8b58cc5c39a20c52c42f73369699d5f43d8c2fd3d90

Download Submit