7bcf9287c6018b478fe940abe68f33f6bc0e11e5c5383988f7d4f9679814ed5c

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 01:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6cef3ace3edba768aeb21e6d0555c34e_JaffaCakes118.html
Size

36KB
MD5

6cef3ace3edba768aeb21e6d0555c34e
SHA1

f6e2d2c46f3eec6949ad7a3980de54da165d43aa
SHA256

7bcf9287c6018b478fe940abe68f33f6bc0e11e5c5383988f7d4f9679814ed5c
SHA512

3fff14b7fecfd99dca77144f78393bd6dee8f3f8aa395ca8df294c5e572571050aff3d9be123735fdba6dca1056a12980ac5447effee2eea5d952fa736cfa3ba
SSDEEP

768:SYix7sB6HtkD1YI4Erki+KxT26FXZP+mz0GbmVeh:SYixrkZYI4mki+KxT26FXZPjbmVeh

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4220	msedge.exe
4220	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 1488	4220	msedge.exe	82
PID 4220 wrote to memory of 1488	4220	msedge.exe	82
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 3980	4220	msedge.exe	83
PID 4220 wrote to memory of 4328	4220	msedge.exe	84
PID 4220 wrote to memory of 4328	4220	msedge.exe	84
PID 4220 wrote to memory of 5016	4220	msedge.exe	85
PID 4220 wrote to memory of 5016	4220	msedge.exe	85
PID 4220 wrote to memory of 5016	4220	msedge.exe	85
PID 4220 wrote to memory of 5016	4220	msedge.exe	85
PID 4220 wrote to memory of 5016	4220	msedge.exe	85
PID 4220 wrote to memory of 5016	4220	msedge.exe	85
PID 4220 wrote to memory of 5016	4220	msedge.exe	85
PID 4220 wrote to memory of 5016	4220	msedge.exe	85
PID 4220 wrote to memory of 5016	4220	msedge.exe	85
PID 4220 wrote to memory of 5016	4220	msedge.exe	85
PID 4220 wrote to memory of 5016	4220	msedge.exe	85
PID 4220 wrote to memory of 5016	4220	msedge.exe	85
PID 4220 wrote to memory of 5016	4220	msedge.exe	85
PID 4220 wrote to memory of 5016	4220	msedge.exe	85
PID 4220 wrote to memory of 5016	4220	msedge.exe	85
PID 4220 wrote to memory of 5016	4220	msedge.exe	85
PID 4220 wrote to memory of 5016	4220	msedge.exe	85
PID 4220 wrote to memory of 5016	4220	msedge.exe	85
PID 4220 wrote to memory of 5016	4220	msedge.exe	85
PID 4220 wrote to memory of 5016	4220	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6cef3ace3edba768aeb21e6d0555c34e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa54ff46f8,0x7ffa54ff4708,0x7ffa54ff4718
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,13456798226520493939,107452640522963484,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,13456798226520493939,107452640522963484,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,13456798226520493939,107452640522963484,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13456798226520493939,107452640522963484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13456798226520493939,107452640522963484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13456798226520493939,107452640522963484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13456798226520493939,107452640522963484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2488 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,13456798226520493939,107452640522963484,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2912 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
337B

MD5
6a154fa2d762392836ae5e1771e23599

SHA1
f1686f6b0203705bd59ba450663998f4b2e76f65

SHA256
bd7c4bb45ca5d9760c2f1c357b677575d74528ecc9360ad3e23d46eaa0126878

SHA512
f290cd418960fab573df995848e90896a771ed5f58c398ceebe359c1623cdd5b580223a4220398c83ad0b2b24a665adefd4dd0cde22c86a7dc383b6314d919f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
644f55f6935b49ea02b7c358da888de0

SHA1
a7eb81b157d5d6d331926cab3455803d86d5ecd6

SHA256
1f3a4f03d403a926562fd5061fbf22c15a2427d5769fe42a1837a9982ea1c0fe

SHA512
73cb982b711229e838ccc5711c98fda666f692879e26fdc227cafe9d0d89e81257b67f1a95bbe340f536cd611403f2d11173c67f7f5cae2f5c4dc365ea0ecc8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a0a55b4368c39f73b15721535ca444e1

SHA1
9d1655fe69ac68e5771e96a58ef357d8f3db19d8

SHA256
32bfde5426aa57f628893b94745b09e55995f14cbaa24ecfb228c19c4572c763

SHA512
938e22f0276e18eb75bf6f58b78c5ba29c4350a0ab4490803ef4afe57acbca31bcd889ab42028c4a7ec1a23182b133db58a749cf2697b2f0359c6fdc3e7b1fe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b87235184a5fa106a4eb6d89c8d61551

SHA1
5395b04f52d9e865d7659a2e3968026265b89056

SHA256
4c4d9b2f28af81b27d432cd9fb81ad8e58e936a9f0eabb1bb2311e6f0837479e

SHA512
9cdd4a536b0b03fcd1b5ad3065245e45f050060320d937600f8bcf4c02816b1103ce92c20c35ec9606e5024388298d8766b00b577e8ab37c6f2c0e21441405d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d74656241b381f40e18518ad60e0cf90

SHA1
840e27acffd4fc1f99de0458523448fc81456dbb

SHA256
5dd9c63497e77ea3394c518b43259a71634876f90537f4398f6bdcc23e092d6a

SHA512
c9e52c6f80e660545bc039dc4c253bc5ccfa76de5579bf10a620442344867ec5bb03c1cba32e3325c1c70bd65b592c3f24c16f968ab505c3d3ca8517b2901b9a

Download Submit