5ba3d9a83c8ada34395a94df6c88fbc8cc27aaa4116e33761d2091161758602e

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 21:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b95406d60a0b09b778850441650ddbb_JaffaCakes118.html
Size

73KB
MD5

5b95406d60a0b09b778850441650ddbb
SHA1

ab55eb886b1a327319664b6143d15d5e268c534d
SHA256

5ba3d9a83c8ada34395a94df6c88fbc8cc27aaa4116e33761d2091161758602e
SHA512

b664907800e7d7306524bae3431772d91b90b3cfb5f73783bbd9583be9532bcb68def0064151c64fafe9dbef3aeb4e153276b31cd5586fd32586de842659be78
SSDEEP

768:Ji4gcMiR3sI2PDDnX0g6sp6yM2LdTb1kj1dqM+woTyS1wCZkoTyMdtbBnfBgN8/C:JybnxT5oIfNTzNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
648	msedge.exe
648	msedge.exe
2664	msedge.exe
2664	msedge.exe
3872	identity_helper.exe
3872	identity_helper.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 1036	2664	msedge.exe	83
PID 2664 wrote to memory of 1036	2664	msedge.exe	83
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 1852	2664	msedge.exe	84
PID 2664 wrote to memory of 648	2664	msedge.exe	85
PID 2664 wrote to memory of 648	2664	msedge.exe	85
PID 2664 wrote to memory of 652	2664	msedge.exe	86
PID 2664 wrote to memory of 652	2664	msedge.exe	86
PID 2664 wrote to memory of 652	2664	msedge.exe	86
PID 2664 wrote to memory of 652	2664	msedge.exe	86
PID 2664 wrote to memory of 652	2664	msedge.exe	86
PID 2664 wrote to memory of 652	2664	msedge.exe	86
PID 2664 wrote to memory of 652	2664	msedge.exe	86
PID 2664 wrote to memory of 652	2664	msedge.exe	86
PID 2664 wrote to memory of 652	2664	msedge.exe	86
PID 2664 wrote to memory of 652	2664	msedge.exe	86
PID 2664 wrote to memory of 652	2664	msedge.exe	86
PID 2664 wrote to memory of 652	2664	msedge.exe	86
PID 2664 wrote to memory of 652	2664	msedge.exe	86
PID 2664 wrote to memory of 652	2664	msedge.exe	86
PID 2664 wrote to memory of 652	2664	msedge.exe	86
PID 2664 wrote to memory of 652	2664	msedge.exe	86
PID 2664 wrote to memory of 652	2664	msedge.exe	86
PID 2664 wrote to memory of 652	2664	msedge.exe	86
PID 2664 wrote to memory of 652	2664	msedge.exe	86
PID 2664 wrote to memory of 652	2664	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5b95406d60a0b09b778850441650ddbb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e7e446f8,0x7ff8e7e44708,0x7ff8e7e44718
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,15625601097027007193,8710671989886139176,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,15625601097027007193,8710671989886139176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,15625601097027007193,8710671989886139176,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2504 /prefetch:8
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,15625601097027007193,8710671989886139176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,15625601097027007193,8710671989886139176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,15625601097027007193,8710671989886139176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,15625601097027007193,8710671989886139176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,15625601097027007193,8710671989886139176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,15625601097027007193,8710671989886139176,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,15625601097027007193,8710671989886139176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,15625601097027007193,8710671989886139176,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,15625601097027007193,8710671989886139176,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1568c580079716d8447b1d274f35a410

SHA1
43f5f126346231bfef15b39e25621b9e95d36e9a

SHA256
25f3b32f3d8afbe72a69ba594f5ff438f03bc7af2b7e05ef090895f5830589e0

SHA512
2fe02beb60d96a760af98c945ecd54d7e4e1c0b63b2d88b70609d1ced69af7a89dd15df97f51f2920dc96c4e8cf43c8073f444e0e81e7390b0d9f60e7417816b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7e1b6c391072c76f4d59ef45082f9d08

SHA1
a875230723a9a3eaaacd736ffbca210118fe6010

SHA256
769e104dc21f5cedeafc00f2f9b47d06c4225ff8ef62a26688c819b7c52b54a0

SHA512
059d1176c43ace789034fea7f5558b9160b71d7e3f85750c77f73bb4a25cd5e64ca579533a48a55ed116064102c50358dcc2fba1e1b98b2036d063bd644845ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
aebb63a303aaab5992ee16a1960dc804

SHA1
3a7b1e045189163ce11d1caf428e4bfa4e65726f

SHA256
d5cc948fe68420d31cf2b275321ecfbdbd93a203e46005b1bfffc15068b937ff

SHA512
5842503fa6a521fc881883addc330e1658fc91a22df124d926983b1cf82d5cc92bcb63e97cc0ed4493303bbd8d971c65a8e041b3f18859dcda8d14da03711e6a

Download Submit