ed521ffcb0f9005ab3db3fd1ad312d4fa1cf496d3fd8f0245686eb82e1bfb4aa

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60c3a7113d269b3ca63f58dfc3ccb81d_JaffaCakes118.html
Size

56KB
MD5

60c3a7113d269b3ca63f58dfc3ccb81d
SHA1

d355da81cf136965d1711124dc4211720637c193
SHA256

ed521ffcb0f9005ab3db3fd1ad312d4fa1cf496d3fd8f0245686eb82e1bfb4aa
SHA512

b621c8931c223a899aed74cd485218af80c4204a12fe889404fcce808d083b796f0c9cfc0c3f8f9cd431d8b82e50f909943c1100e73ee0774e1821ca065eb03b
SSDEEP

1536:wMK0JprSHv7oG84fMP0Jp/CfwsER8AjCXkDNOLzubO0yDjf0pMvw0tzhVI0Jp1:xK0JprSHTXPfMP0Jp/CfwsER8AjCXSNA

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3648	msedge.exe
3648	msedge.exe
3172	msedge.exe
3172	msedge.exe
4424	identity_helper.exe
4424	identity_helper.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 2712	3172	msedge.exe	82
PID 3172 wrote to memory of 2712	3172	msedge.exe	82
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 1292	3172	msedge.exe	83
PID 3172 wrote to memory of 3648	3172	msedge.exe	84
PID 3172 wrote to memory of 3648	3172	msedge.exe	84
PID 3172 wrote to memory of 3516	3172	msedge.exe	85
PID 3172 wrote to memory of 3516	3172	msedge.exe	85
PID 3172 wrote to memory of 3516	3172	msedge.exe	85
PID 3172 wrote to memory of 3516	3172	msedge.exe	85
PID 3172 wrote to memory of 3516	3172	msedge.exe	85
PID 3172 wrote to memory of 3516	3172	msedge.exe	85
PID 3172 wrote to memory of 3516	3172	msedge.exe	85
PID 3172 wrote to memory of 3516	3172	msedge.exe	85
PID 3172 wrote to memory of 3516	3172	msedge.exe	85
PID 3172 wrote to memory of 3516	3172	msedge.exe	85
PID 3172 wrote to memory of 3516	3172	msedge.exe	85
PID 3172 wrote to memory of 3516	3172	msedge.exe	85
PID 3172 wrote to memory of 3516	3172	msedge.exe	85
PID 3172 wrote to memory of 3516	3172	msedge.exe	85
PID 3172 wrote to memory of 3516	3172	msedge.exe	85
PID 3172 wrote to memory of 3516	3172	msedge.exe	85
PID 3172 wrote to memory of 3516	3172	msedge.exe	85
PID 3172 wrote to memory of 3516	3172	msedge.exe	85
PID 3172 wrote to memory of 3516	3172	msedge.exe	85
PID 3172 wrote to memory of 3516	3172	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\60c3a7113d269b3ca63f58dfc3ccb81d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcdad846f8,0x7ffcdad84708,0x7ffcdad84718
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,9466582777785676491,17662724462209901631,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,9466582777785676491,17662724462209901631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,9466582777785676491,17662724462209901631,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,9466582777785676491,17662724462209901631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,9466582777785676491,17662724462209901631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,9466582777785676491,17662724462209901631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,9466582777785676491,17662724462209901631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,9466582777785676491,17662724462209901631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,9466582777785676491,17662724462209901631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,9466582777785676491,17662724462209901631,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,9466582777785676491,17662724462209901631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,9466582777785676491,17662724462209901631,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,9466582777785676491,17662724462209901631,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6000 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
6a53ea5e7b431b1824fc5ba493923eb1

SHA1
8797d1d7d4434c4482e09c16a94eeb34198ecb5b

SHA256
a988dc51d14ca710fc56a5273d6cd334fe8e923941e3a58149fb323a24e61062

SHA512
9b7dfb40a15dff961a530699975c0ab6f9008887860bd821d42e7f64323abb435a1ea334f3a38c85516303316630ece0042bc324a10fe4cb4ce38533d4399241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
749b3ee002a1bc02f491ffce8bab8f06

SHA1
6d199b77f045a645cad86452d0a52e63be2999d6

SHA256
a1575a47624aeadab9eda6e0365bce6638e0d9544359e116fb4b5a1ca675f9fc

SHA512
d236bcc228fab00f840e9297a473bd4850a5f735e06717835d2018a840ddc6ed6f84403c8294aa8f7013c7aa3d492b9114196d8f4e422bd607a4d77779f2e223

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
82e570f4c08dac8d1255708dcdc1a887

SHA1
22d941b2f1c7ee87002f4b46c62333ec539a008f

SHA256
e74604f94a1790972746398194fb52ed23d5d9e7cff071389015290b32f88049

SHA512
4806cd04354ae3fbcf7c59c8413a0d527ae1a34f7e0b128700945b6f2f0af8fd7d302cf7b64d1eb977e7c7ba60b2258dfeafb93a81995e2acc94c2e0d7879618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d8468c78f10e00f52afb1fc06123eeca

SHA1
8777790e9606132be05a37f73a9871952acc3a47

SHA256
bb7835c7463f835b338a59534f1d647a9feb1919eed7cbf4baeba8aae87d5bb5

SHA512
275cca8c4803c21cc03362809e5c5540901cba974f3e0c3a89c6bb3fe62039ba779eacfec443164bbc5df9efe229a8908076694012489b8c78968ef294b04a0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
68916b9b5afe8b5947747d31fe49e785

SHA1
422635ce1f6090978bb8a97b6bbc4d3ed991a451

SHA256
ae0831b6b1c5eea9a27f82550239afe06acee9ff090a745b3cc6ce8f87c7f60b

SHA512
d378d814e8471ed4e053a23736801a396cccb96a13f3a40e58fc052288d0bb03a976c8b9630d5ca8694ae233e46b77901e99d977722029fb462629af53a53ad2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ee7a384bc05ae2534edee50f0efca3de

SHA1
c03c7a79cd022bbe4d64ee7b58f53f0cb09f3f4b

SHA256
21b05055cebd6b578c60c4a3feb6eb3409b7fdf77f2c9cdc645221ae33119520

SHA512
4273858581b5bb47f17d67836e727505904ad9c84d01aa08252900e2cf2ffbc280a8b19d1448a4d4735b1a5974425755a0f21c3981bc2d4a702d11c65427ff45

Download Submit