20d51ffa8673e2171b6bc93cd92a30572d8e839c3b362ee59016d53824a32a49

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7389c4edcb547af8eedeec6cd5248461_JaffaCakes118.html
Size

4KB
MD5

7389c4edcb547af8eedeec6cd5248461
SHA1

fe152d9ea3a1a13de32cc4ff5c2613f687776da2
SHA256

20d51ffa8673e2171b6bc93cd92a30572d8e839c3b362ee59016d53824a32a49
SHA512

87b0a4bad327d242c26607514225b036b7240c9a82709e59cceb2c6ea9a4e832f977ca8331a939d844853bc38b7cbc93c29c01c13572fa2f9f2786835a2e3cc6
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oAtacd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDd

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
3936	msedge.exe
3936	msedge.exe
4976	identity_helper.exe
4976	identity_helper.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 1720	3936	msedge.exe	83
PID 3936 wrote to memory of 1720	3936	msedge.exe	83
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 1396	3936	msedge.exe	84
PID 3936 wrote to memory of 4760	3936	msedge.exe	85
PID 3936 wrote to memory of 4760	3936	msedge.exe	85
PID 3936 wrote to memory of 4068	3936	msedge.exe	86
PID 3936 wrote to memory of 4068	3936	msedge.exe	86
PID 3936 wrote to memory of 4068	3936	msedge.exe	86
PID 3936 wrote to memory of 4068	3936	msedge.exe	86
PID 3936 wrote to memory of 4068	3936	msedge.exe	86
PID 3936 wrote to memory of 4068	3936	msedge.exe	86
PID 3936 wrote to memory of 4068	3936	msedge.exe	86
PID 3936 wrote to memory of 4068	3936	msedge.exe	86
PID 3936 wrote to memory of 4068	3936	msedge.exe	86
PID 3936 wrote to memory of 4068	3936	msedge.exe	86
PID 3936 wrote to memory of 4068	3936	msedge.exe	86
PID 3936 wrote to memory of 4068	3936	msedge.exe	86
PID 3936 wrote to memory of 4068	3936	msedge.exe	86
PID 3936 wrote to memory of 4068	3936	msedge.exe	86
PID 3936 wrote to memory of 4068	3936	msedge.exe	86
PID 3936 wrote to memory of 4068	3936	msedge.exe	86
PID 3936 wrote to memory of 4068	3936	msedge.exe	86
PID 3936 wrote to memory of 4068	3936	msedge.exe	86
PID 3936 wrote to memory of 4068	3936	msedge.exe	86
PID 3936 wrote to memory of 4068	3936	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7389c4edcb547af8eedeec6cd5248461_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde42446f8,0x7ffde4244708,0x7ffde4244718
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,179638499782475159,4657308439228993190,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,179638499782475159,4657308439228993190,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,179638499782475159,4657308439228993190,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,179638499782475159,4657308439228993190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,179638499782475159,4657308439228993190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,179638499782475159,4657308439228993190,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,179638499782475159,4657308439228993190,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,179638499782475159,4657308439228993190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,179638499782475159,4657308439228993190,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,179638499782475159,4657308439228993190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,179638499782475159,4657308439228993190,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,179638499782475159,4657308439228993190,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3076 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
292B

MD5
7fe84c4104517344df059bc568560369

SHA1
37c677e6762a476636470b21e0e225461ed5629e

SHA256
a710a1ca0f36ab84753481376c835ed9f2d47f7c2f24a95ba3d5307b0725047b

SHA512
6ea575e53dd04dc6dea60835219c278e2c0b28f86cb42528fc70abf5e18fa295ee02ba1d018f84d36ac2f67647c1082f63b36d134ddce81d62403fa95311d75f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ae4db08202f54424196ff99bef3ebec3

SHA1
32e042ad933173a2fece754dcab367fd97d9047d

SHA256
86cb27669b1040a9b100b76882622e99d8665d391cf018a5989682b58984e5d6

SHA512
5d2e134e649282914b529c2721ae8b9b1d0f80ddc1964afda103718021de65704d1223b7b5d45173b3bec90285e8d7d200f45af3df05bc069683e81b9d82cde3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c5ebb1dfe298791e2766b4923542c88a

SHA1
d203129953b3acf0ad58f5ff503984f48416e8f2

SHA256
5287b34120f4748aa1539cf1a09e86a452f96565334262a80d5e58f3573122b8

SHA512
a20d29f4f73f0b49cc157366d2f6acdc3c285d0fbd93c23acaac2be095526c0f5bee53a4431d3497cecb93ba61f9446456fd7197a0e781f4254248d4708fa7c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\da9f6c48-11a6-431e-985b-f1db95d63801.tmp

Filesize
11KB

MD5
a2d0865216f8e97bdd71567bbe337b9b

SHA1
cdf35aab67245981c079f0186ce2ce31657a49b5

SHA256
156442a0e99daf1f2759e32edc44fe59332444759070ecac293c0fc0bb1d9a06

SHA512
2fe5aa808b510cf707f8dc2e155fe1b1c0edcb17689f64952740f191c1254bf58d6ae8397a4cdc66ed9eb021e5018e5a61efe543eefe4b8e11f551d309147029

Download Submit