84b81137baae9ca0f28ccd791c4dbcc7d0a469f80941fe53ea699889502ca305

Analysis

max time kernel
140s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b8c1d2a99f3c065def89969165facc3_JaffaCakes118.html
Size

52KB
MD5

5b8c1d2a99f3c065def89969165facc3
SHA1

83baff41b8f25902558118fa604ca9e637fb53e1
SHA256

84b81137baae9ca0f28ccd791c4dbcc7d0a469f80941fe53ea699889502ca305
SHA512

ebf419c1b324244def3d0571ea13d1ad02c21426302a235c1688a4e3195cc1166c7fb6e0ed94f8398812d979f32ce1a4bf68b5f4a3db6647a86ee03348ef55b3
SSDEEP

1536:Ab3zZKOe5n0ghNxgefN3MU39DMglNJfXwJ0:6MOe50geefR9Dt+J0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133606276510904543"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1181767204-2009306918-3718769404-1000\{E8CB9E6F-8C1E-47A2-A172-E5DCFC6B8C09}	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 1128	4236	msedge.exe	115
PID 4236 wrote to memory of 1128	4236	msedge.exe	115
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 1492	4236	msedge.exe	116
PID 4236 wrote to memory of 764	4236	msedge.exe	117
PID 4236 wrote to memory of 764	4236	msedge.exe	117
PID 4236 wrote to memory of 380	4236	msedge.exe	118
PID 4236 wrote to memory of 380	4236	msedge.exe	118
PID 4236 wrote to memory of 380	4236	msedge.exe	118
PID 4236 wrote to memory of 380	4236	msedge.exe	118
PID 4236 wrote to memory of 380	4236	msedge.exe	118
PID 4236 wrote to memory of 380	4236	msedge.exe	118
PID 4236 wrote to memory of 380	4236	msedge.exe	118
PID 4236 wrote to memory of 380	4236	msedge.exe	118
PID 4236 wrote to memory of 380	4236	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5b8c1d2a99f3c065def89969165facc3_JaffaCakes118.html
1⤵
PID:932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=4076,i,6593821857742176458,13646536021844995125,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:1
1⤵
PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=4708,i,6593821857742176458,13646536021844995125,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:1
1⤵
PID:2316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=5304,i,6593821857742176458,13646536021844995125,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
1⤵
PID:4632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5340,i,6593821857742176458,13646536021844995125,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
1⤵
PID:208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5472,i,6593821857742176458,13646536021844995125,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
1⤵
PID:3996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=5912,i,6593821857742176458,13646536021844995125,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
1⤵
PID:1828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --field-trial-handle=5740,i,6593821857742176458,13646536021844995125,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
1⤵
PID:1356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ff8a5a9ceb8,0x7ff8a5a9cec4,0x7ff8a5a9ced0
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3016,i,3157206214682888584,12276877963527268678,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:2
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1900,i,3157206214682888584,12276877963527268678,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:3
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2228,i,3157206214682888584,12276877963527268678,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4380,i,3157206214682888584,12276877963527268678,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4380,i,3157206214682888584,12276877963527268678,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4440,i,3157206214682888584,12276877963527268678,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:8
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4160,i,3157206214682888584,12276877963527268678,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4708,i,3157206214682888584,12276877963527268678,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:8
  2⤵
  PID:212

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"
1⤵
PID:4880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\60e51d48-7b81-4a85-b2f0-65c342f7ce33.tmp

Filesize
69KB

MD5
adb3a35af0b0ace6556bf2d774878d00

SHA1
d22357710f506f7645011613db4f840daeb59448

SHA256
6cc4ac5fe01239e8332110f70081df112c713756db932850c6fa437c3fb985ab

SHA512
59571a7d8a62cca50215db3750d71cc752f67035f5e16e336ab31931706fc5bd2f4ca932864dc7cadbf4140b0c1e28a2a24b2abd9e574175f577eed08dd69110

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
b669763a66573fdd9981c4956077b55c

SHA1
4a1aa56871d5e02d730cc969b82d66cd944278e3

SHA256
6620eae5098b69702acbcf9082a07a8c91c0230d2b31161c357a5fad36ee8f3b

SHA512
0ffe65d1173997a9c77f94b19e9aa9cacaae5aecd6591f68cc609e809b02b411dea4a48915852628a928a7c518b9c0aeb035c67f1ace7cee499900366a64e012

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
30KB

MD5
37b6ea7581bcd47796c730f5927d0060

SHA1
a1429b6b72567e99e9146cdc5be41de2bd3e42f5

SHA256
c3cf7eb630fff6191cf806eb29aad2a13a1e15fb50c6383fcb75af4cc8cbcb56

SHA512
c556204585dcbbf894b944a798ef518a8f15ecf9edee9304d5578e50624cefa9ff71c9897abd0b77d4a732b110ebad29edb7db8f42e244f2304c34ffea18d37e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
69KB

MD5
a66476b0e28e31b4a1329b0928f32a2d

SHA1
834ea5499f466ba5d7b7dfef818d6a4a42596f13

SHA256
faaa8e6aac6b7e0df9a39888c8067898cc66490cc7c825ee745cf92e06cc452c

SHA512
a4ccd057f04125e294b6f78eacb5c296e342504dc5366ff950b25904290b0726d64a778adb938099fb03c3539d79a3af617c980a39dabf8bd5737054710e2d91

Download Submit