0818f33022626594521e0ee7235a684100efa7d83fb4cc091d3b16be4055486a

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61351a22e0807a73a480c399c1581516_JaffaCakes118.html
Size

4KB
MD5

61351a22e0807a73a480c399c1581516
SHA1

51c4b423f78ccf6f2ddcc880204999eeae6ddd01
SHA256

0818f33022626594521e0ee7235a684100efa7d83fb4cc091d3b16be4055486a
SHA512

cd63dc53ce860e50e90752851ce4e5c31f8b583872e210f37f1ee2348d19616880ecbaad45a69e8c144b1ea47adf714d4def4d62199547978f47270eabfc6cce
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o4nVQ8d:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDH

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
2948	msedge.exe
2948	msedge.exe
4916	identity_helper.exe
4916	identity_helper.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 208	2948	msedge.exe	83
PID 2948 wrote to memory of 208	2948	msedge.exe	83
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 2340	2948	msedge.exe	84
PID 2948 wrote to memory of 1524	2948	msedge.exe	85
PID 2948 wrote to memory of 1524	2948	msedge.exe	85
PID 2948 wrote to memory of 436	2948	msedge.exe	86
PID 2948 wrote to memory of 436	2948	msedge.exe	86
PID 2948 wrote to memory of 436	2948	msedge.exe	86
PID 2948 wrote to memory of 436	2948	msedge.exe	86
PID 2948 wrote to memory of 436	2948	msedge.exe	86
PID 2948 wrote to memory of 436	2948	msedge.exe	86
PID 2948 wrote to memory of 436	2948	msedge.exe	86
PID 2948 wrote to memory of 436	2948	msedge.exe	86
PID 2948 wrote to memory of 436	2948	msedge.exe	86
PID 2948 wrote to memory of 436	2948	msedge.exe	86
PID 2948 wrote to memory of 436	2948	msedge.exe	86
PID 2948 wrote to memory of 436	2948	msedge.exe	86
PID 2948 wrote to memory of 436	2948	msedge.exe	86
PID 2948 wrote to memory of 436	2948	msedge.exe	86
PID 2948 wrote to memory of 436	2948	msedge.exe	86
PID 2948 wrote to memory of 436	2948	msedge.exe	86
PID 2948 wrote to memory of 436	2948	msedge.exe	86
PID 2948 wrote to memory of 436	2948	msedge.exe	86
PID 2948 wrote to memory of 436	2948	msedge.exe	86
PID 2948 wrote to memory of 436	2948	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\61351a22e0807a73a480c399c1581516_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffffab46f8,0x7fffffab4708,0x7fffffab4718
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,12891536012391245011,963431369200200840,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,12891536012391245011,963431369200200840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,12891536012391245011,963431369200200840,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12891536012391245011,963431369200200840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12891536012391245011,963431369200200840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,12891536012391245011,963431369200200840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,12891536012391245011,963431369200200840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12891536012391245011,963431369200200840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12891536012391245011,963431369200200840,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12891536012391245011,963431369200200840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,12891536012391245011,963431369200200840,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,12891536012391245011,963431369200200840,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
292B

MD5
ffe385adba47d1a23023f6389a8eb68f

SHA1
90c0c6863891f13715e1ef9dd70a847decc751f9

SHA256
ac2bcae1647909295a62a1a336b1dbf63c55ee6c4e8e092481fdbca831cb019a

SHA512
64b6455d045bad67c8fc52577c05f951863797f2fd267acdfd3be497c04d1a450a30619008e6561a938c1836bf83917ad4042aac755a31fea30cb37b90cbf07c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
31644ef2c091f2f179315a929b55a340

SHA1
cd467ca1d8d2bc3e63200ba55b78ada1cb458e2c

SHA256
49d6982e38093e23dcce59f3b099f4ab5372c0e563038dc06fab80cc6b433c03

SHA512
95c88885b6cc10661182ff521d6337f6b25f407fd5feec95f03645166cc947b558be3101cf4caccd1c2882ecd14a794322e3703bf51e942be7e70845811dc514

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
aaf30f7c4a0715a9a6fada5f5f59004f

SHA1
e47c33be4f8ece1e822d225882ba961bf29abae9

SHA256
2a6f64e8744a983b72758d85cb790555b160a0e612c5d05fa549b027031d5d0c

SHA512
2663ceba5a5b99376513fa8f6c8fee138e09a9826384bf3b5d65bdc69aa984c56d5346c9491ac23ef5918e34e92268996944b149c9dd6899e0fee8e61d3877b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4e62c859dd1310e541a445c0388f53fb

SHA1
f7cc6c6652f232556033a90dabea0762dd3fde15

SHA256
5d15377e6d266216dd2eb36a204da196eee724c30de9541da2301a8ba8d33f5f

SHA512
2de4e112bbbaf5832301ddb75023c4a270c995f2724c19ce0d30f308a69ba3e4874457d598b851d0cd9ec28919c82638239bde18b1a989892340144400f07c78

Download Submit