8c64124f8ca9932f4fc40620fad79293bd62e7efb142b1836d6c23f8f09560c4

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 14:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f796500eec9628041613ccae068681e_JaffaCakes118.html
Size

36KB
MD5

5f796500eec9628041613ccae068681e
SHA1

5a6a5e283a42c346f0b96a18e16f281f026c17e3
SHA256

8c64124f8ca9932f4fc40620fad79293bd62e7efb142b1836d6c23f8f09560c4
SHA512

af2973a37486c0eed8eb944425d60c0880eab36e7545a783ae8b176f4e70c6cc078ed300075c4b430e6d1956f46668ed1c466c363ff0c08c0dd8b241e05790fa
SSDEEP

768:zwx/MDTHqc88hAR3ZPXKE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TyZO+6cLV6OxJyi:Q/zbJxNV0u6SF/j8JK

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3892	msedge.exe
3892	msedge.exe
1968	msedge.exe
1968	msedge.exe
3076	identity_helper.exe
3076	identity_helper.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 4600	1968	msedge.exe	83
PID 1968 wrote to memory of 4600	1968	msedge.exe	83
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 64	1968	msedge.exe	84
PID 1968 wrote to memory of 3892	1968	msedge.exe	85
PID 1968 wrote to memory of 3892	1968	msedge.exe	85
PID 1968 wrote to memory of 3936	1968	msedge.exe	86
PID 1968 wrote to memory of 3936	1968	msedge.exe	86
PID 1968 wrote to memory of 3936	1968	msedge.exe	86
PID 1968 wrote to memory of 3936	1968	msedge.exe	86
PID 1968 wrote to memory of 3936	1968	msedge.exe	86
PID 1968 wrote to memory of 3936	1968	msedge.exe	86
PID 1968 wrote to memory of 3936	1968	msedge.exe	86
PID 1968 wrote to memory of 3936	1968	msedge.exe	86
PID 1968 wrote to memory of 3936	1968	msedge.exe	86
PID 1968 wrote to memory of 3936	1968	msedge.exe	86
PID 1968 wrote to memory of 3936	1968	msedge.exe	86
PID 1968 wrote to memory of 3936	1968	msedge.exe	86
PID 1968 wrote to memory of 3936	1968	msedge.exe	86
PID 1968 wrote to memory of 3936	1968	msedge.exe	86
PID 1968 wrote to memory of 3936	1968	msedge.exe	86
PID 1968 wrote to memory of 3936	1968	msedge.exe	86
PID 1968 wrote to memory of 3936	1968	msedge.exe	86
PID 1968 wrote to memory of 3936	1968	msedge.exe	86
PID 1968 wrote to memory of 3936	1968	msedge.exe	86
PID 1968 wrote to memory of 3936	1968	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5f796500eec9628041613ccae068681e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff99cdf46f8,0x7ff99cdf4708,0x7ff99cdf4718
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,8250245562196086976,9544539207658886535,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,8250245562196086976,9544539207658886535,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,8250245562196086976,9544539207658886535,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8250245562196086976,9544539207658886535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8250245562196086976,9544539207658886535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,8250245562196086976,9544539207658886535,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,8250245562196086976,9544539207658886535,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8250245562196086976,9544539207658886535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8250245562196086976,9544539207658886535,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8250245562196086976,9544539207658886535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8250245562196086976,9544539207658886535,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,8250245562196086976,9544539207658886535,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3104 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
614B

MD5
e4e7bbc5e933dde32d08cd4faa7d470b

SHA1
37f24fc3d852f338b4730dc4135f99f8324cf2a1

SHA256
5990f49d6fcebbec71f740e3058b42cf8e1b4852ec2a7db3d5ed4bca9def3c05

SHA512
b3c35bbc8d8b6c2adf640d01b71c8868e09f9622398913573df4122d926eaf6a444d521843451024b9ef0d73dad8f995c965df6227ecd688ccb0d564b21424a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
557c307782a97b3382134572bc79d542

SHA1
7b8972efaac603b18d50eb64f2d66ed722fe665b

SHA256
390894f6f1b8c6d707ccdb3f1f58b1d8dba14a6f21e683d2a56088a77cf5b8a9

SHA512
d90bc266ce02bf655b95328102817a59629d3d32bbdb5d959224ad390235e9980d74e2184530e25767542aa9b13af80cc0536fced7188ee407b7dd99a948ede7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
07707e8210f68c51871a4579247cb466

SHA1
f640b15f8dd4a809f65ad511f87c86c410135fc8

SHA256
3a731a23fc62fb1fd21d6b65ef0fbaedfb85c4c4211110e856871a8fa320e213

SHA512
55148f002227571d4b35cbe3eea5625f1b783182c61c8f63a084859db1e1c5703594c87f20ad19dccb9a7a86689a5b4d1f6dbe69d73508617886611ef6a2f5fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f24e24e6841bd01fbc5e876b7f39215b

SHA1
6431f22a273521ca79edbfed03446b74c25c3096

SHA256
7f8f197a68608d0623aaa64bc9d27fbbb4cc163e45f057016ceca20bf271c5f2

SHA512
c3c524e3c3746efb55a518b8ed3cdbb6a6ebebc08472b232d5a62f40c630427e790d47403921d5f68af3399c2df32f03eeed5643d2d0ae655c3d74ca326ee3b2

Download Submit