f0b7e3d246a331983a53e9be831cf860355da10e29a6b3f4962b72759a77f06d

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 15:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76015104db1fbc719521ecd8001a1455_JaffaCakes118.html
Size

39KB
MD5

76015104db1fbc719521ecd8001a1455
SHA1

a4945df7cce913675fda3bd36d85ceb1326f7db2
SHA256

f0b7e3d246a331983a53e9be831cf860355da10e29a6b3f4962b72759a77f06d
SHA512

4a2e82fe53fcbc95c6822207ea945bc5ebf00be504a7f60bdeed8e6527b87cf9c54d43859f9d5036e97ecbbb729d06754ed91dbc4fab1a642f65b34f852380ed
SSDEEP

192:uw75b5nQGnQjxn5Q/0nQiefNnXnQOkEnt4qnQTbnRnQmS9xiz9hixExWraj9ZLjP:QQ/k6xwnuvqJp

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2372	msedge.exe
2372	msedge.exe
4624	msedge.exe
4624	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
4404	identity_helper.exe
4404	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 2224	4624	msedge.exe	81
PID 4624 wrote to memory of 2224	4624	msedge.exe	81
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 5952	4624	msedge.exe	82
PID 4624 wrote to memory of 2372	4624	msedge.exe	83
PID 4624 wrote to memory of 2372	4624	msedge.exe	83
PID 4624 wrote to memory of 2504	4624	msedge.exe	84
PID 4624 wrote to memory of 2504	4624	msedge.exe	84
PID 4624 wrote to memory of 2504	4624	msedge.exe	84
PID 4624 wrote to memory of 2504	4624	msedge.exe	84
PID 4624 wrote to memory of 2504	4624	msedge.exe	84
PID 4624 wrote to memory of 2504	4624	msedge.exe	84
PID 4624 wrote to memory of 2504	4624	msedge.exe	84
PID 4624 wrote to memory of 2504	4624	msedge.exe	84
PID 4624 wrote to memory of 2504	4624	msedge.exe	84
PID 4624 wrote to memory of 2504	4624	msedge.exe	84
PID 4624 wrote to memory of 2504	4624	msedge.exe	84
PID 4624 wrote to memory of 2504	4624	msedge.exe	84
PID 4624 wrote to memory of 2504	4624	msedge.exe	84
PID 4624 wrote to memory of 2504	4624	msedge.exe	84
PID 4624 wrote to memory of 2504	4624	msedge.exe	84
PID 4624 wrote to memory of 2504	4624	msedge.exe	84
PID 4624 wrote to memory of 2504	4624	msedge.exe	84
PID 4624 wrote to memory of 2504	4624	msedge.exe	84
PID 4624 wrote to memory of 2504	4624	msedge.exe	84
PID 4624 wrote to memory of 2504	4624	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\76015104db1fbc719521ecd8001a1455_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1ec946f8,0x7ffa1ec94708,0x7ffa1ec94718
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,2658555868612754727,15762329919424108550,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,2658555868612754727,15762329919424108550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,2658555868612754727,15762329919424108550,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2658555868612754727,15762329919424108550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2658555868612754727,15762329919424108550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,2658555868612754727,15762329919424108550,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4908 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,2658555868612754727,15762329919424108550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,2658555868612754727,15762329919424108550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2658555868612754727,15762329919424108550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2832 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,2658555868612754727,15762329919424108550,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:5012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9715c52c5c1a9b7ff7fa28652d83c4d1

SHA1
9d1bacea3da977f72306ff9fb38df7f1f390f53c

SHA256
2486492671920043873ed6cc4f8280274d5ffc781492277a9c55d61038ebea8a

SHA512
0e6c807cf3d4898ab5e0d476fd09f65c7af2c419d4895d9d8c5a137bb8e748383e3abb330ed0722adf3cca6ad5d2439b7aa7e2f8992a5cc006ec05697b7b60bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3b234e518b3acea2297ee16d69ebb0c3

SHA1
1c320cf832128d01e50a40758b6402148b305ba9

SHA256
48895873f89b3665d6948ec861f4cd98a35ef3763b866eec9a10d189f29e15c1

SHA512
549356045c4189895d89b84109e4dd8be1dd3f4ce97af8df3e5c6142ba9aa9f304a2f0f1223bfe689363c6f8a915d2a005d3a7ff52a706342d0eb1ce88562d30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
23d2f7f9876b8331cd1bb210c6c94f31

SHA1
db2b8f3af25698bb4d95e0c98fe9a22b6108374f

SHA256
7297f64deca5b3381096760f52a4335f6a5c11e07b9c385bcf51f0ae6b8e8bd5

SHA512
1bbae340de7f04c07a484661347801bd4a89e492eed25e8ff0a7be9dee32ec6fefd183a52055df6b88a28494d94d49267e191bdd45e57d8d1144e16794a374a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d028e63a3babf4de6755aabab2142b05

SHA1
9750a47c12e18a67ada297639494c01728cb4cdf

SHA256
5ef37882259026b045655a65aef8a19896cf0006f3f8d3aebefaaf038d9d9070

SHA512
5f16397041481b906d5c2de066fa3611bec2d3247d79269eefc2b0a3492e7051352a11acc966b0cd0a81ddc1e764e20b28f2032b2fbf20e929b2339aa212a3c7

Download Submit