5e6d8dc9a9683adea351b0609191d47ca73c5cf44c54362d298387a0f3e12b8f

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 16:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5076dffbf6009a2a652b07c3448dce76_JaffaCakes118.html
Size

41KB
MD5

5076dffbf6009a2a652b07c3448dce76
SHA1

7fecb9a9270c7a728a08a3765ad8ecda1b6a22f6
SHA256

5e6d8dc9a9683adea351b0609191d47ca73c5cf44c54362d298387a0f3e12b8f
SHA512

c8834e0d56c07d7a1db4db00eeeea5b83e96a0b9b14cdb43a713277189305ced44941084de7a0e0d395c639651b47d195ad7dd3e61899b001d597d062a2e9ad8
SSDEEP

768:290qJGRcC3jIOa5CuUnnRp0CthhN7EoJ4uz4JqWEFz+tsAY5IC1Xyd5jOc6S5300:2ZGRcC3jIf5vUnnk7UwMcObR1E3jEjFW

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
1048	msedge.exe
1048	msedge.exe
3500	identity_helper.exe
3500	identity_helper.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 2296	1048	msedge.exe	82
PID 1048 wrote to memory of 2296	1048	msedge.exe	82
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 3708	1048	msedge.exe	83
PID 1048 wrote to memory of 4164	1048	msedge.exe	84
PID 1048 wrote to memory of 4164	1048	msedge.exe	84
PID 1048 wrote to memory of 2396	1048	msedge.exe	85
PID 1048 wrote to memory of 2396	1048	msedge.exe	85
PID 1048 wrote to memory of 2396	1048	msedge.exe	85
PID 1048 wrote to memory of 2396	1048	msedge.exe	85
PID 1048 wrote to memory of 2396	1048	msedge.exe	85
PID 1048 wrote to memory of 2396	1048	msedge.exe	85
PID 1048 wrote to memory of 2396	1048	msedge.exe	85
PID 1048 wrote to memory of 2396	1048	msedge.exe	85
PID 1048 wrote to memory of 2396	1048	msedge.exe	85
PID 1048 wrote to memory of 2396	1048	msedge.exe	85
PID 1048 wrote to memory of 2396	1048	msedge.exe	85
PID 1048 wrote to memory of 2396	1048	msedge.exe	85
PID 1048 wrote to memory of 2396	1048	msedge.exe	85
PID 1048 wrote to memory of 2396	1048	msedge.exe	85
PID 1048 wrote to memory of 2396	1048	msedge.exe	85
PID 1048 wrote to memory of 2396	1048	msedge.exe	85
PID 1048 wrote to memory of 2396	1048	msedge.exe	85
PID 1048 wrote to memory of 2396	1048	msedge.exe	85
PID 1048 wrote to memory of 2396	1048	msedge.exe	85
PID 1048 wrote to memory of 2396	1048	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5076dffbf6009a2a652b07c3448dce76_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc502e46f8,0x7ffc502e4708,0x7ffc502e4718
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,13961974691542804928,10771371332892934648,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,13961974691542804928,10771371332892934648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,13961974691542804928,10771371332892934648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13961974691542804928,10771371332892934648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13961974691542804928,10771371332892934648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,13961974691542804928,10771371332892934648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,13961974691542804928,10771371332892934648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13961974691542804928,10771371332892934648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13961974691542804928,10771371332892934648,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13961974691542804928,10771371332892934648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13961974691542804928,10771371332892934648,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,13961974691542804928,10771371332892934648,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c34f2634abaa526976ebc77df68463ff

SHA1
9512e8f205cce37c4e9f5107b4bc28929a08f930

SHA256
947f0b42fb41724855a64c159473bb8da6f6d6985bf405dcba04cd78c93a99cf

SHA512
12b65064d612897fdf29a532d0bb554ccc117cde7e206667e874f3f238509e961da9c20b793112736a99403340cf255f19e95627a75c3fba27f76a4d68504a5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9e76f66e209a55c470c93a93428b26e7

SHA1
2bc344da02b4c8382972494a5a8c8e85859d5184

SHA256
085b0751c66bff64e05e4b87ce7de2b5b6cdd12f7d51e84b1a50452fc1adc932

SHA512
52b3c00537a16071629937447874b769dd6a6854a7921e2ee32628d07702eac73d40b4471f1046ed841fd71ca3e47f02b9aedd19f8ed6ff3ecaa991ff2c0a541

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f94ff7c4a2aff360f16163b36840a6fa

SHA1
b6b0830d7fa8ee7e6cf950dfe6c71e9dad59de99

SHA256
ff01d8ff92f0e685e425107eb6ae24ac22a1c457eeab62af4140e88973f97568

SHA512
b165347bbe070e3704e94cde2c968f5a3962e7e26bc4ce25ea5e6f605af42f028cd1b2ddc92ccc4e57136509d0647964c162dc21dc8d8e3127a7477bfa0fab40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b23ee0888501e3dd03757330e27ea7da

SHA1
d496205bdd40dfb8082c0a6550a078a88cf8193f

SHA256
95034333b8b5b4854720104f2ebc89b611b6342cd610e954c6b888e5eb45d4b8

SHA512
4596e711f0daeaa91e6fe8ce1fdd58f1ad2612594a05e2771cd3a89b6955d14e4ca781322bff8c1d919dc6cba6b595338adc4cc7d1228fd17ed1b8d9e41e944a

Download Submit