102ccdd093969284cbe2d055bab34d2a79128037d5c61e01f341ee8c1056c048

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 05:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7484e9e72365718447c591e5cc5db90c_JaffaCakes118.html
Size

147KB
MD5

7484e9e72365718447c591e5cc5db90c
SHA1

1333ba788c2f18d729a010550a63054d278dfc0a
SHA256

102ccdd093969284cbe2d055bab34d2a79128037d5c61e01f341ee8c1056c048
SHA512

3138cbf3dbbfe06048e3441d31e9f75ece18e7f984477e72bc6970835ac230001efda5096777761661d95924b7685239ba952115b4a44ed50460cc9a3409d438
SSDEEP

1536:Smmy7fz5z3xPA/6S+VBNKAa/26upJRtSyLi+rffMxqNisaQx4V5roEIfGJZN8qbI:ShMGyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3012	msedge.exe
3012	msedge.exe
912	msedge.exe
912	msedge.exe
3444	identity_helper.exe
3444	identity_helper.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 4868	912	msedge.exe	82
PID 912 wrote to memory of 4868	912	msedge.exe	82
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 2724	912	msedge.exe	83
PID 912 wrote to memory of 3012	912	msedge.exe	84
PID 912 wrote to memory of 3012	912	msedge.exe	84
PID 912 wrote to memory of 3220	912	msedge.exe	85
PID 912 wrote to memory of 3220	912	msedge.exe	85
PID 912 wrote to memory of 3220	912	msedge.exe	85
PID 912 wrote to memory of 3220	912	msedge.exe	85
PID 912 wrote to memory of 3220	912	msedge.exe	85
PID 912 wrote to memory of 3220	912	msedge.exe	85
PID 912 wrote to memory of 3220	912	msedge.exe	85
PID 912 wrote to memory of 3220	912	msedge.exe	85
PID 912 wrote to memory of 3220	912	msedge.exe	85
PID 912 wrote to memory of 3220	912	msedge.exe	85
PID 912 wrote to memory of 3220	912	msedge.exe	85
PID 912 wrote to memory of 3220	912	msedge.exe	85
PID 912 wrote to memory of 3220	912	msedge.exe	85
PID 912 wrote to memory of 3220	912	msedge.exe	85
PID 912 wrote to memory of 3220	912	msedge.exe	85
PID 912 wrote to memory of 3220	912	msedge.exe	85
PID 912 wrote to memory of 3220	912	msedge.exe	85
PID 912 wrote to memory of 3220	912	msedge.exe	85
PID 912 wrote to memory of 3220	912	msedge.exe	85
PID 912 wrote to memory of 3220	912	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7484e9e72365718447c591e5cc5db90c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff9cb046f8,0x7fff9cb04708,0x7fff9cb04718
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,3472992223952132439,2674388580699766954,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,3472992223952132439,2674388580699766954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,3472992223952132439,2674388580699766954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3472992223952132439,2674388580699766954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3472992223952132439,2674388580699766954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,3472992223952132439,2674388580699766954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:260
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,3472992223952132439,2674388580699766954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3472992223952132439,2674388580699766954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3472992223952132439,2674388580699766954,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3472992223952132439,2674388580699766954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3472992223952132439,2674388580699766954,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,3472992223952132439,2674388580699766954,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b371d890a88b7f6af8afb61288bf187b

SHA1
20d965ec255b0e02eabc615723b42aecfe548ab2

SHA256
1582199f75a5d77c45f539ffa782e407443dbe926450258b7553e597f6d6be17

SHA512
2c200fffe7175837b187d2344f0d5fc2d5e053c011852894f3ed69ee9d4591d354081666a3674fe6b2a15beb67877b7ed5345854046ce095e69655f91fbcc376

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a22c5591022e6ad64413995b7aa92d8b

SHA1
b8ade858181f760f87ee587eea9ce2fefd7f8793

SHA256
cbfe7b41760977fa05ee6ba83aa7d46200a7948322f06b2189bc850ca1ff7e56

SHA512
7efd9c7c8a8d10a3551bb9e79aee571c2399d6ad18ea4adaa35b5c3073ef3f8017ba8cd22dbf4ea878fea2794f076d8e02d2787c3389f7d0dda9f8beea209391

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
49f7420f065d4ed2a433cdfd2df7c779

SHA1
f65cbc828e9e1a74b9c41e9116ab30ac86175444

SHA256
c365a2d057456cdd0d94f30087cc4636178dc247ed2dbb5bdc73f092fe309a4e

SHA512
66a1d1cf83da9b979120b531e92a9d0afc0e3b0988c8b6bf47f5fd72716f80e39aa929bc1c3e444b54b83f10f112d5b64c12b4580dc324decc4940815737cad6

Download Submit