1e71c5e301f89490a5f24c85575e71416184cf2d08f3a46836d1628f5bf18d08

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 18:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

76645ab140592f06b5c6105530f1487f_JaffaCakes118.html
Size

39KB
MD5

76645ab140592f06b5c6105530f1487f
SHA1

75caf0298280abd75adc604e84ccec49e5827324
SHA256

1e71c5e301f89490a5f24c85575e71416184cf2d08f3a46836d1628f5bf18d08
SHA512

90f2164848783517d843114dd3bb678c2f566b5c75b82955c8e13fcf5ebcc2c2cbf35566416498944d5fa801bcabbdf7843440ae80feebe664e2c2ca278e7396
SSDEEP

768:HUIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZ0m:0IRIOITIwIgIiKZgNDfIwIGI5IVJ7Sqg

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe
4496	msedge.exe
4496	msedge.exe
4200	identity_helper.exe
4200	identity_helper.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 4592	4496	msedge.exe	84
PID 4496 wrote to memory of 4592	4496	msedge.exe	84
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 2852	4496	msedge.exe	85
PID 4496 wrote to memory of 1552	4496	msedge.exe	86
PID 4496 wrote to memory of 1552	4496	msedge.exe	86
PID 4496 wrote to memory of 3236	4496	msedge.exe	87
PID 4496 wrote to memory of 3236	4496	msedge.exe	87
PID 4496 wrote to memory of 3236	4496	msedge.exe	87
PID 4496 wrote to memory of 3236	4496	msedge.exe	87
PID 4496 wrote to memory of 3236	4496	msedge.exe	87
PID 4496 wrote to memory of 3236	4496	msedge.exe	87
PID 4496 wrote to memory of 3236	4496	msedge.exe	87
PID 4496 wrote to memory of 3236	4496	msedge.exe	87
PID 4496 wrote to memory of 3236	4496	msedge.exe	87
PID 4496 wrote to memory of 3236	4496	msedge.exe	87
PID 4496 wrote to memory of 3236	4496	msedge.exe	87
PID 4496 wrote to memory of 3236	4496	msedge.exe	87
PID 4496 wrote to memory of 3236	4496	msedge.exe	87
PID 4496 wrote to memory of 3236	4496	msedge.exe	87
PID 4496 wrote to memory of 3236	4496	msedge.exe	87
PID 4496 wrote to memory of 3236	4496	msedge.exe	87
PID 4496 wrote to memory of 3236	4496	msedge.exe	87
PID 4496 wrote to memory of 3236	4496	msedge.exe	87
PID 4496 wrote to memory of 3236	4496	msedge.exe	87
PID 4496 wrote to memory of 3236	4496	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\76645ab140592f06b5c6105530f1487f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd711f46f8,0x7ffd711f4708,0x7ffd711f4718
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,16258241183103295773,15113355945328692012,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,16258241183103295773,15113355945328692012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2480 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,16258241183103295773,15113355945328692012,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16258241183103295773,15113355945328692012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16258241183103295773,15113355945328692012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,16258241183103295773,15113355945328692012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,16258241183103295773,15113355945328692012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16258241183103295773,15113355945328692012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16258241183103295773,15113355945328692012,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16258241183103295773,15113355945328692012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16258241183103295773,15113355945328692012,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,16258241183103295773,15113355945328692012,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4832 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9bbda2b0-def4-4648-b3bf-919356c3bf0d.tmp

Filesize
6KB

MD5
d7c9b76b365a3ec29a2baf691aa7596c

SHA1
73edef9fcb9a4e642f9e2dc42654a0d227c2aba9

SHA256
25504424f5cd29d1b277059bda836523afb5844b851a0af6fab7316b19e9ef74

SHA512
20e77b64e4aae49766dcad9fc5379e27551382ac70ff5d6f595084a12a09ab7029290f2ab66ce595ec38e7f9b1882ad4865399f8880489bc6288444fc8a2af4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
308B

MD5
be5dc56022ccd377cb508198e341bd87

SHA1
f398b31c2575e5c3b165747e86caaffe1f4d2d10

SHA256
9dd6f0cc7edd1bc40b9daa0d6f78c2d76192f1e527d6cb674ba09ef5dcd02ca4

SHA512
726a37040fe364bda9adf82124a3ed294d8fefe783ab22081e0c2a58c80bff0969c549268e30abed95c25ae31f6d27dc7896a38fa9a99fde6beb1bb6ac0527b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ba3418bec5da79bde7fe5915f624556e

SHA1
16fac4052fd5d6ec1ba23bc0d60643da3e0a9849

SHA256
08d13f9512b0ef8c0ac219dcbbc83c8223dfa3f1217206b5a19196cea194661b

SHA512
8c3435ef2df42a55e974f42fd81542f3a3b0d67bdc41deee25e24211ea25dff87fd13540ae083c019ffc88dbbd5a042b299db7fcd905da7be04b548814170657

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
18cefe53069b531ddff9e828a3ada06f

SHA1
cb846e927a9f03350a722ada67f623eda0ce09e2

SHA256
d6ecfbe2aa35c54068cbcb05ff37232df3348f49d416d936df391aa0b466facf

SHA512
0ad45d17bdcc8517ef7de253fd644eaba731b4f2e3be40b4c7d2c2a9b32b8f05dc865286cd5df8fbff2f0c54f0ae157032c869cbb9df837b94b743154d37ca2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b6b8d4ff2a7c012290d554d109a5091e

SHA1
a9ec67a0bddfaef26f732b6267fa7c1068fba74e

SHA256
1c9479655f326fda69fca45bd5189ee14cf64238ad5d07ece7e900ad44eed910

SHA512
101fb19da2a9dfa3bc18216a3e99f7b3b5a0599bf96853075dfe78c24707dc385208c5ed125afcbdf414a955784622d551e3453ac1d1d28ca85dd7a41accb414

Download Submit