476f7cfba395228a642a9c231379d2ec07716d831183a529184b5d03347e23e2

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 07:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5de0c1750ea32b80d362b12127150b0b_JaffaCakes118.html
Size

34KB
MD5

5de0c1750ea32b80d362b12127150b0b
SHA1

670d8f4822f132a96383f83c96e80c65e70520c4
SHA256

476f7cfba395228a642a9c231379d2ec07716d831183a529184b5d03347e23e2
SHA512

baf7dde43fcf22990b4158fdee9508617245b1a32e2f661c070274247e6cb11f44c40152e704ef9693252afecc4e040c149fa00b1d40c86df8dcc2576451ac10
SSDEEP

768:7+Q7sihYVQ0cXH+XSw8LzUj6XGj9OFps/A7XB0t/+6iB8mINrPqq4qhMWtf+XH88:7+Q7sihWQ0chLoOXGj9OFps/A7XB0tTk

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1220	msedge.exe
1220	msedge.exe
2856	msedge.exe
2856	msedge.exe
5044	identity_helper.exe
5044	identity_helper.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 3080	2856	msedge.exe	82
PID 2856 wrote to memory of 3080	2856	msedge.exe	82
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 4832	2856	msedge.exe	83
PID 2856 wrote to memory of 1220	2856	msedge.exe	84
PID 2856 wrote to memory of 1220	2856	msedge.exe	84
PID 2856 wrote to memory of 3680	2856	msedge.exe	85
PID 2856 wrote to memory of 3680	2856	msedge.exe	85
PID 2856 wrote to memory of 3680	2856	msedge.exe	85
PID 2856 wrote to memory of 3680	2856	msedge.exe	85
PID 2856 wrote to memory of 3680	2856	msedge.exe	85
PID 2856 wrote to memory of 3680	2856	msedge.exe	85
PID 2856 wrote to memory of 3680	2856	msedge.exe	85
PID 2856 wrote to memory of 3680	2856	msedge.exe	85
PID 2856 wrote to memory of 3680	2856	msedge.exe	85
PID 2856 wrote to memory of 3680	2856	msedge.exe	85
PID 2856 wrote to memory of 3680	2856	msedge.exe	85
PID 2856 wrote to memory of 3680	2856	msedge.exe	85
PID 2856 wrote to memory of 3680	2856	msedge.exe	85
PID 2856 wrote to memory of 3680	2856	msedge.exe	85
PID 2856 wrote to memory of 3680	2856	msedge.exe	85
PID 2856 wrote to memory of 3680	2856	msedge.exe	85
PID 2856 wrote to memory of 3680	2856	msedge.exe	85
PID 2856 wrote to memory of 3680	2856	msedge.exe	85
PID 2856 wrote to memory of 3680	2856	msedge.exe	85
PID 2856 wrote to memory of 3680	2856	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5de0c1750ea32b80d362b12127150b0b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae23946f8,0x7ffae2394708,0x7ffae2394718
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,16870729626149879603,6881297784126064415,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,16870729626149879603,6881297784126064415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,16870729626149879603,6881297784126064415,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3024 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16870729626149879603,6881297784126064415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16870729626149879603,6881297784126064415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16870729626149879603,6881297784126064415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,16870729626149879603,6881297784126064415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,16870729626149879603,6881297784126064415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16870729626149879603,6881297784126064415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16870729626149879603,6881297784126064415,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16870729626149879603,6881297784126064415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16870729626149879603,6881297784126064415,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,16870729626149879603,6881297784126064415,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5564 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
505B

MD5
74cc21a536ab7884d41004bcff09107d

SHA1
b8ea31f69609e40ec2a22e84899d07f09714edcb

SHA256
3ec5191f227beb0b704a3d673e788356d58f62b15e328661885900b0157b2a05

SHA512
04d9c44e8401ab4e27f9f7e51c7ac4557bea763320a738540b7baa6753200893a34e4aadbe863294350d73066d31b63f928539ead05e239b9e2d7107e099128f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dee2cfd0c362bc136f86666ff69583fb

SHA1
909f078dc81aef50c9f8c84bd1dd08c2ce7534e1

SHA256
3efddfc070f9f7b34c4f8a8f6b25b27a29746203559f4cc2c36b2bf238c167dd

SHA512
076ed10b9eaacf86c44c31b8f0b62d3aab0f9fc5a247da0f08dafee2d47b25a42aed177b54ce39962d3ad8d45f8e69571945cd6dff76e5e9ad0358ce74b210f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
873a4f58c63a2d496cbb28d03cd6eb66

SHA1
3c4469bb1a66ce16c106ad5c860dcf273028899b

SHA256
9656b8138e13f319bf9a33d842492a35801d8cd1b48382b6786f16fa5e90176f

SHA512
7d18873921fe44dcbe93f72160ba4416a960767e5f063096de78f9b7d9914a41cef1c68ac63adfd932970a19a20a59a079f1a2ae9982704059abb8e0567e3285

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ab831b7a9cd7894b8d0e3d605f691929

SHA1
1d7427e5d463962315f1e1f2af89085b5279e368

SHA256
4008aa8a0d76764c02d401b07a065a8c713d7127d1eda157fb7bfe8838d29d20

SHA512
094b48ca6f8118ef70fa174c49dd084d02904d8b665c2068a84e4a1a03b4c6f6c64b9c42cfc15e4cd84f17aca8560714cae3c9bb70e2c8e29b9ea562275f6343

Download Submit