594c00be22d29565763cfe6bef25e4e38fd0bc3a4355165925b7998a46ba6cd4

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 16:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50617bb2b571963b4835e978d2be641a_JaffaCakes118.html
Size

52KB
MD5

50617bb2b571963b4835e978d2be641a
SHA1

ddbc3434378b17a1f2e761066aebc21d7a58c4dd
SHA256

594c00be22d29565763cfe6bef25e4e38fd0bc3a4355165925b7998a46ba6cd4
SHA512

61b6472ce1e12ac454dc6118d4c10d63c9343bf4457e0cf0692bc6ee7737c389386ae5ddd91271a912b115f2be02ec2dfddfe78419dd6e06fec5879afe86164d
SSDEEP

1536:Ab3zZ+Oe5n0ghNxgefN3MU39DMglNJfXwJ0:6YOe50geefR9Dt+J0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
928	msedge.exe
928	msedge.exe
3144	msedge.exe
3144	msedge.exe
4608	identity_helper.exe
4608	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 3236	3144	msedge.exe	83
PID 3144 wrote to memory of 3236	3144	msedge.exe	83
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 3192	3144	msedge.exe	84
PID 3144 wrote to memory of 928	3144	msedge.exe	85
PID 3144 wrote to memory of 928	3144	msedge.exe	85
PID 3144 wrote to memory of 2084	3144	msedge.exe	86
PID 3144 wrote to memory of 2084	3144	msedge.exe	86
PID 3144 wrote to memory of 2084	3144	msedge.exe	86
PID 3144 wrote to memory of 2084	3144	msedge.exe	86
PID 3144 wrote to memory of 2084	3144	msedge.exe	86
PID 3144 wrote to memory of 2084	3144	msedge.exe	86
PID 3144 wrote to memory of 2084	3144	msedge.exe	86
PID 3144 wrote to memory of 2084	3144	msedge.exe	86
PID 3144 wrote to memory of 2084	3144	msedge.exe	86
PID 3144 wrote to memory of 2084	3144	msedge.exe	86
PID 3144 wrote to memory of 2084	3144	msedge.exe	86
PID 3144 wrote to memory of 2084	3144	msedge.exe	86
PID 3144 wrote to memory of 2084	3144	msedge.exe	86
PID 3144 wrote to memory of 2084	3144	msedge.exe	86
PID 3144 wrote to memory of 2084	3144	msedge.exe	86
PID 3144 wrote to memory of 2084	3144	msedge.exe	86
PID 3144 wrote to memory of 2084	3144	msedge.exe	86
PID 3144 wrote to memory of 2084	3144	msedge.exe	86
PID 3144 wrote to memory of 2084	3144	msedge.exe	86
PID 3144 wrote to memory of 2084	3144	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\50617bb2b571963b4835e978d2be641a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa7cf46f8,0x7fffa7cf4708,0x7fffa7cf4718
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,17484235911417806145,13820946310459542233,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,17484235911417806145,13820946310459542233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,17484235911417806145,13820946310459542233,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17484235911417806145,13820946310459542233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17484235911417806145,13820946310459542233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,17484235911417806145,13820946310459542233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,17484235911417806145,13820946310459542233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17484235911417806145,13820946310459542233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17484235911417806145,13820946310459542233,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17484235911417806145,13820946310459542233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17484235911417806145,13820946310459542233,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17484235911417806145,13820946310459542233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2156 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17484235911417806145,13820946310459542233,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
465B

MD5
e417df1c0fa6749b4fcd8a934cabe8d2

SHA1
c109f7acaa56cc03b7b3c395affe7e6aee15d62d

SHA256
0326acfcf26a8b26dbd9c889fcbb63a0c8f6f0aa00abe46b630bc43969907acc

SHA512
0ed683c6e915240b19ef7f4b8fb4d53569d442a1625d36a86d49c91fe66aa22c2e7f90fdd0bb2b994229aad2d883a843af591ab65fd29ce66e2b9fa33f746b1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
296da697b1b2eb55201221937861cdb5

SHA1
3c7bae2006165f03dcd272e1d56c27949a1fbdd2

SHA256
87f925618899f641232ff64a37497da0a13946ce714c885e46b58b563390e2ee

SHA512
10c84d23ac1a52e2f0764ba4392c53a622881cac44ccc19e8afc8286c3bdd1fd61f3a6e6a31565027869f4239789130e83e83a19b450edfbf7bf08a9b0ccc23b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4094457c2caa2633166b2c77b2317c15

SHA1
4319f8394da23b62b7cd438c0082431e2ecac0be

SHA256
c0b6dc22a8c09982e829f9bb9e520f1085ec3f37179224aa9d2b2e1418ffa905

SHA512
32fc96faf24a95c08ee7b681c289436d8d7b0dc2cdfab04e6fce305844a6c2ab1be061c5bfef4f253a3e1eabf209b1415b49100fc61ef494303d181c6c611540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f9a8e72230cc016aed3c2ef20a7322d4

SHA1
6a220c3e8cb01d786e4c8dba4c5959bda4d6085b

SHA256
28539074ce1e8a92d44fbb2897aac0e9d0ef522add95e3fc0d2d6fc2fdeecf68

SHA512
a716f9bcaeb2fa5490dcd64ea936f1bf8d85423ea223aaaecc606847fef870640fe18761a61d5d0e50d36416e1efb63dae37011d7f5ebc9bc9719c1663cd80fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
0b0932ccc500cd1d911dcad52fc7c70a

SHA1
baf6e899dc31d48125295899b3b68fbfdcb323cb

SHA256
81849359c4ba3cf503890b345e84fd2141f0d89bf6888782a26efe59fc1a44db

SHA512
d32d55051800f41380424b869a40af922ca25aff2e0e929d48bb24f831e37e76993ebc5f45f657286b589e34fdaf0956768529c6527b9c10eb7cb0bc5ef27d5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f7846da58ca685e9255a715ee76d8d96

SHA1
25a2c0b842601ea0a978f201dd5d2318a078de48

SHA256
eda0a86f10d26382c2b861ea155ebab4fddff66e86f9b5d1285966456453121a

SHA512
1822e16b27c92ee9a2d3d51cccf6f684751ec08eb9824bc398ef9272cc09a76fbb7212efebd2062bc9ef259f396b276e1dc71fd566c42d7a3ef066c1b07d2a12

Download Submit