0f257510a640102038bbf2d2e20c1e5edc56e7d32af2f5bb878ecc150296a257

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 09:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ee7fbb785fe4191ea94d7bed55de061_JaffaCakes118.html
Size

26KB
MD5

3ee7fbb785fe4191ea94d7bed55de061
SHA1

81354ef1f1743eaaef971442d9214f153eac5539
SHA256

0f257510a640102038bbf2d2e20c1e5edc56e7d32af2f5bb878ecc150296a257
SHA512

3f41b39c021f976bb0752a1ab80db8d62d7065f107a71d8d9a8dff6955a5eaefe25b310623b28ee76bab2b6cd07286ff074b959d5c2659074dc71c2402a0a8bf
SSDEEP

384:SzU8buMnBmOGLg1QqnBMJBMbqHKEDs4dYHnU4yIQjjata0XkQbmZatFye0c/iFkN:SzUwhnBmOG8RnCJCUs4NjDJ9K

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1140	msedge.exe
1140	msedge.exe
736	msedge.exe
736	msedge.exe
1236	identity_helper.exe
1236	identity_helper.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 736 wrote to memory of 4724	736	msedge.exe	83
PID 736 wrote to memory of 4724	736	msedge.exe	83
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 2500	736	msedge.exe	85
PID 736 wrote to memory of 1140	736	msedge.exe	86
PID 736 wrote to memory of 1140	736	msedge.exe	86
PID 736 wrote to memory of 1420	736	msedge.exe	87
PID 736 wrote to memory of 1420	736	msedge.exe	87
PID 736 wrote to memory of 1420	736	msedge.exe	87
PID 736 wrote to memory of 1420	736	msedge.exe	87
PID 736 wrote to memory of 1420	736	msedge.exe	87
PID 736 wrote to memory of 1420	736	msedge.exe	87
PID 736 wrote to memory of 1420	736	msedge.exe	87
PID 736 wrote to memory of 1420	736	msedge.exe	87
PID 736 wrote to memory of 1420	736	msedge.exe	87
PID 736 wrote to memory of 1420	736	msedge.exe	87
PID 736 wrote to memory of 1420	736	msedge.exe	87
PID 736 wrote to memory of 1420	736	msedge.exe	87
PID 736 wrote to memory of 1420	736	msedge.exe	87
PID 736 wrote to memory of 1420	736	msedge.exe	87
PID 736 wrote to memory of 1420	736	msedge.exe	87
PID 736 wrote to memory of 1420	736	msedge.exe	87
PID 736 wrote to memory of 1420	736	msedge.exe	87
PID 736 wrote to memory of 1420	736	msedge.exe	87
PID 736 wrote to memory of 1420	736	msedge.exe	87
PID 736 wrote to memory of 1420	736	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3ee7fbb785fe4191ea94d7bed55de061_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f44046f8,0x7ff8f4404708,0x7ff8f4404718
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,2252004939605892943,12458250664071820865,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,2252004939605892943,12458250664071820865,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,2252004939605892943,12458250664071820865,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2252004939605892943,12458250664071820865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2252004939605892943,12458250664071820865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2252004939605892943,12458250664071820865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,2252004939605892943,12458250664071820865,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,2252004939605892943,12458250664071820865,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2252004939605892943,12458250664071820865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2252004939605892943,12458250664071820865,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2252004939605892943,12458250664071820865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2252004939605892943,12458250664071820865,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,2252004939605892943,12458250664071820865,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6116 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
e6870c10f6e7f42ebe087687f6689a40

SHA1
1eebe8d62f1e1b648d821d8023c756e6ad04cb8c

SHA256
54f38d326a83dd5f456a2ae36ac43f890743ee77a01e5d8463949c0df2b512a3

SHA512
3e2742c2be0e9002afc1e632a9962ab5f6bcf639f4de24ac88fdf15853aa426fa6d1c7255bfda48719af464cee0123677e1b99f6c2750c98180a41bbc41b694d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5aa4428dca6cff0e1208eda73284f38d

SHA1
92707ef2d339b5dbd152a1394d4196f839ac8431

SHA256
c5eeba6d0b97b76d9002a190a898eeb995dec1d67fef9de2883a846a03f2553a

SHA512
d6b44c2f2402f6d59961aa0812f59ea6b8bb5cb01ff5d44b9146151707901f937f9b7280bdcc190f7d8aa2cc706abd0471e9403741b9d9bab2aa6f3b2e39bd58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f40361359f577ec2cfd97aab05fac26e

SHA1
151f522051ff7025593d84b144b4b2ba23fbe338

SHA256
f0faac7df43b58a9a4b0c906802a5962f65eebcabcff79cd6b576f54a0d86685

SHA512
ecea09a80a649b0ba4928ce4c982067ce29794ab2635a148dcc6df218da08d69a0a30195cf15ee48e2eeaffcc54a23d47d9f65ddbd965f413936a981769ba53b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3f3423d12ccbd0c6133811b671b52ca9

SHA1
72e2938991ad5fd6a24e3694dff83bb1de5bcd53

SHA256
11621502021cbed173215f997779bdfa7c250f59826223e2711186fc411eb59a

SHA512
1e9ed0ec41d63931dd43241410f2587eb465e06b6d5248496e1f086b152d6f2aaede44784178d145d1713105480bf1488befdec3a42261147333244f2ce0f6f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
00193901486aa0620412eed696c62255

SHA1
0e6a5e8a36cc25005af77c483783444cdb52caec

SHA256
c96da563083798e0a2b5f3f90d48175393a67914418062b73c08421cb1a867e8

SHA512
7efc197470cb79e3de79ccf1dead1c8619adefd5d2e1e7c8025bee5d896aa2fee428114b2e5b0648b4ed1a0df9a9db432d0bdad682bf196a287a864c76127049

Download Submit