8447f765d5f81a00d28a1f941fdefb6f3e83a3e68b03e94f13043f4f51651b69

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7322f8956d92a9a5638f5ea0653bb37b_JaffaCakes118.html
Size

95KB
MD5

7322f8956d92a9a5638f5ea0653bb37b
SHA1

170147321227f20ffb83cd5c49d2dae2c608dd56
SHA256

8447f765d5f81a00d28a1f941fdefb6f3e83a3e68b03e94f13043f4f51651b69
SHA512

a714705aa2794e284f04dbcf5f0281850bb02ca02b77b3786535a8cdae7056ae9feb7aea2a2246eb0b9abf6bd6308535adbceff096817d47e396dd294cd3bf22
SSDEEP

1536:Iet7uswB0aB0+qFppgpduI2qXloP4NU2wCLTI/INd5b1oMqGyf:IewJB0+nXF+6lI/IjhRA

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4668	msedge.exe
4668	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 2152	4668	msedge.exe	82
PID 4668 wrote to memory of 2152	4668	msedge.exe	82
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 3980	4668	msedge.exe	83
PID 4668 wrote to memory of 4328	4668	msedge.exe	84
PID 4668 wrote to memory of 4328	4668	msedge.exe	84
PID 4668 wrote to memory of 744	4668	msedge.exe	85
PID 4668 wrote to memory of 744	4668	msedge.exe	85
PID 4668 wrote to memory of 744	4668	msedge.exe	85
PID 4668 wrote to memory of 744	4668	msedge.exe	85
PID 4668 wrote to memory of 744	4668	msedge.exe	85
PID 4668 wrote to memory of 744	4668	msedge.exe	85
PID 4668 wrote to memory of 744	4668	msedge.exe	85
PID 4668 wrote to memory of 744	4668	msedge.exe	85
PID 4668 wrote to memory of 744	4668	msedge.exe	85
PID 4668 wrote to memory of 744	4668	msedge.exe	85
PID 4668 wrote to memory of 744	4668	msedge.exe	85
PID 4668 wrote to memory of 744	4668	msedge.exe	85
PID 4668 wrote to memory of 744	4668	msedge.exe	85
PID 4668 wrote to memory of 744	4668	msedge.exe	85
PID 4668 wrote to memory of 744	4668	msedge.exe	85
PID 4668 wrote to memory of 744	4668	msedge.exe	85
PID 4668 wrote to memory of 744	4668	msedge.exe	85
PID 4668 wrote to memory of 744	4668	msedge.exe	85
PID 4668 wrote to memory of 744	4668	msedge.exe	85
PID 4668 wrote to memory of 744	4668	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7322f8956d92a9a5638f5ea0653bb37b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa54ff46f8,0x7ffa54ff4708,0x7ffa54ff4718
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,6550197438293065932,6949494993014398242,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,6550197438293065932,6949494993014398242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,6550197438293065932,6949494993014398242,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6550197438293065932,6949494993014398242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6550197438293065932,6949494993014398242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6550197438293065932,6949494993014398242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2276 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,6550197438293065932,6949494993014398242,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1312 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
7a61d3862a1d1af926ee5855c109a45a

SHA1
1a87778517aa254ea7704b2d6160ccee607eb419

SHA256
a2085f26657e1d6b6fb354ea62e431e027e61e53a5020080057d44b0fa4ee10b

SHA512
85c9a2e7c770eaa6a02de270549a0f61eb293901e36d6186b7e64d363f2e62f1af2b17ef8d11977459aa3069aed9a17375f4d3947fe577ff42b268d0efec4417

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dc52798f587da5b100a3372c01d56a5f

SHA1
c5460805d3dc1f358cef87b4aadaf2014827036e

SHA256
0f7f4b368cfa6e42d343c2cb0db39a2188f2df5fb3310d6b7f8473bf50fa8f69

SHA512
b3d89781d7f77d78a00d01ea2b3d3bcd0434724e4a8a831b4786f0109568c016ba8f276757ae57f2b730714e8231182aae0cb0eb99c0794b3c05e792dd6b48d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
198c442dee83673091a62d7de69c9429

SHA1
7fda049faffc6adaea5c46ef9a893e2c0ad446f7

SHA256
81579126edef7e912a8deffff76efefeb2bd669d805bfe2f52b42e5a6c2a227f

SHA512
98443c706708149cfea10ad4592be6297f5ea79fb313a63239718968f1b6f7e3b27d6e23d9ffb01ae23f7043393699b61bdf377b2a5db8231ad8c1e3b5ba38ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f0589091bc41966758ddfdcf3779c691

SHA1
7b8b8babcb449aad2caa852cf8d005fb709bab95

SHA256
08d65151297ce6ff6361f3eb15e6057256e985919d38bf5de85e0d1bc2d8ac87

SHA512
261a465d3145000893203e9efa096ae669221f32131f0a2fe30f5e8735ba05b871e9b6d43a8ef8f09a01ce01fd76c36b6be42502d851affad607df1018f2f2c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

Filesize
74B

MD5
1c034bb391b5f313c57bd2d09095d16a

SHA1
ccab12eaa450893e75e37171a5f57efaba0d0d4e

SHA256
17a0d59843943f93a2c327ad40a62883c9d29fdfdc84121889370f8913d4d157

SHA512
52b598b8bbad723a9c85a6d626356f53980ee5ba138ab16538f48228d3cb270be8161869285a928e117c2265006d79f07bc8ed163c6e2458224334add9c68960

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

Filesize
67B

MD5
5e404cdde295fd324ac337dafafd0c4a

SHA1
e488a50d5219c8126666d984f5f148aed8eec3a3

SHA256
89c2acc504b9bbbe577552b3483895bfb150fdcdef7b22ef508fc5ef33643ffb

SHA512
60e61edfa684104c91d0217c6243d92655e2a5b3a8165048e3e542a1caec2c295d32292fc5acbbc447ed27938304f9d662f3ae98646261d76c872d954d350318

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
833621d53fcbfb48be4957d36e26ce0e

SHA1
53bb998dfdf4944446430b6eb5879b27707ef7d0

SHA256
0e5fa9bc897336d248fe17e19ea963da0d2971a43c46690f66fd29b5f11c4a36

SHA512
88370657b7ce20f23ab0e0b92889c5c61f55f3ffb6dc1ee824ba4e4fd51176be2b053143e11f5cecd0a71c71d43fc38891cdabd5f0104ec9f73305e79f12f962

Download Submit