796fff0abf5a4411c452f2126c1950bf88a20b32ec9a6e09f8de4c5491bb173f

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 15:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b77779eaa2db7d16afc1b7576239904_JaffaCakes118.html
Size

38KB
MD5

6b77779eaa2db7d16afc1b7576239904
SHA1

e76d6d3c256cb2f972760720fd950f35bd9f1d61
SHA256

796fff0abf5a4411c452f2126c1950bf88a20b32ec9a6e09f8de4c5491bb173f
SHA512

a801e18ee89207a990078d1f9d8dc499426812d6b60da7575be10cd1a19b066cd5d15eb6e0aeeed36393b1e7bbf5611ab533ed8c22360043166c5e90ec045fd5
SSDEEP

768:zwx/MDTHS088hARTZPXGE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TIwIf6Nx9/6jLRc:Q/JbJxNVJutASF/f8HK

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
3076	msedge.exe
3076	msedge.exe
3988	identity_helper.exe
3988	identity_helper.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 1368	3076	msedge.exe	82
PID 3076 wrote to memory of 1368	3076	msedge.exe	82
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 572	3076	msedge.exe	83
PID 3076 wrote to memory of 4604	3076	msedge.exe	84
PID 3076 wrote to memory of 4604	3076	msedge.exe	84
PID 3076 wrote to memory of 3468	3076	msedge.exe	85
PID 3076 wrote to memory of 3468	3076	msedge.exe	85
PID 3076 wrote to memory of 3468	3076	msedge.exe	85
PID 3076 wrote to memory of 3468	3076	msedge.exe	85
PID 3076 wrote to memory of 3468	3076	msedge.exe	85
PID 3076 wrote to memory of 3468	3076	msedge.exe	85
PID 3076 wrote to memory of 3468	3076	msedge.exe	85
PID 3076 wrote to memory of 3468	3076	msedge.exe	85
PID 3076 wrote to memory of 3468	3076	msedge.exe	85
PID 3076 wrote to memory of 3468	3076	msedge.exe	85
PID 3076 wrote to memory of 3468	3076	msedge.exe	85
PID 3076 wrote to memory of 3468	3076	msedge.exe	85
PID 3076 wrote to memory of 3468	3076	msedge.exe	85
PID 3076 wrote to memory of 3468	3076	msedge.exe	85
PID 3076 wrote to memory of 3468	3076	msedge.exe	85
PID 3076 wrote to memory of 3468	3076	msedge.exe	85
PID 3076 wrote to memory of 3468	3076	msedge.exe	85
PID 3076 wrote to memory of 3468	3076	msedge.exe	85
PID 3076 wrote to memory of 3468	3076	msedge.exe	85
PID 3076 wrote to memory of 3468	3076	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6b77779eaa2db7d16afc1b7576239904_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5fea46f8,0x7ffa5fea4708,0x7ffa5fea4718
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,13540007830981670411,10189295969176704791,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,13540007830981670411,10189295969176704791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,13540007830981670411,10189295969176704791,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13540007830981670411,10189295969176704791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13540007830981670411,10189295969176704791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,13540007830981670411,10189295969176704791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,13540007830981670411,10189295969176704791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13540007830981670411,10189295969176704791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13540007830981670411,10189295969176704791,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13540007830981670411,10189295969176704791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13540007830981670411,10189295969176704791,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,13540007830981670411,10189295969176704791,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
613B

MD5
6df96b45612f514d28144d868fa4a6c2

SHA1
83b5a1ebeea39750afbb43faa56573fe6ef3a896

SHA256
d6edcf09e64ae9cd4be4e3f0c78df4cea24b3ed9f60052f6c60ebbaeb16c9e7a

SHA512
feb846aa7a98ebacd0f62046501aaa8afd1b3f26b8ad727fc93c356dbd28163d828a6d77aa08c6b304850d7d1dfb131a1fe490ff2b3f46b7c7ffedf37212bb17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7f76f78c5923c9c6b631385f6de5bbc6

SHA1
bdab9f3e5f663a2ac0b2c7b416d9a8ad4cc1879a

SHA256
24a583efa9250a77f4b24361872cf433251a35a257d1079f69351518730ac0ee

SHA512
405e81578c160078cb084290d5c2747cb85601fcdc5ca39ab60165bfe145edc5963e975d86a9d51bf5089f5be92cec1d1598facb9627778a4d5ca111e2726b35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f41fbbfc8b36a2c4b6833dd0f8ae15f9

SHA1
4c6aa6ac36342c9bc5493d8de2bddf9816aafb2a

SHA256
4bd86a7d22e5f52917564798b68655ddbd88ccdbbb8dfa4b4e817e933b69f013

SHA512
9f76c97f1acbe93e9a44f9dffe48c470b169712001e403ba83e6ffb2427354dca7e72ddd45fc163d87e9af9065ee17f0f02092425cda7ae8288987f5cfffc54b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8f44ffb838e4a79a680dbeb3bea099ea

SHA1
49c7b174d83366a25db914d03c018a2d5ce27089

SHA256
dcd5255952faa7bb4908119b3da5ea82dbceffed5cd376cd97adbfcabf7ffcba

SHA512
d711ab72603abbe515dc6038f01c56c0dbbda0b77b04aff40395c7684ed76d6f6663d539fbe0ecc0fa72bcf191a22436e566ba130c9d3cda706b55331a3054a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b78c8e6a000fb12cda8cf057ab30701c

SHA1
17e52e192ef508fc6cd05e4f7c26c2a2c1e6e6ed

SHA256
53a778e5aa09096ea88138eadfaf6293fc9acfb76e2c5dcab95b9ebc684786b2

SHA512
b4374570c766d7a6522ed1be9ef3760b18e0b129d381b2e123d285db19395ccb9151b9f919c6fb2bdec401a6224cabc14def555507d25d69c5fccbb554541eac

Download Submit