f0f2aa447589eb981dd610597e3c2a9409a59b131b4a7b99e5e1974416ee85c3

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 01:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

777f5162ac49a783d809a20f1d47dbee_JaffaCakes118.html
Size

139KB
MD5

777f5162ac49a783d809a20f1d47dbee
SHA1

64d7d0b136ae8e0e7a1050dc301365dc87bd46be
SHA256

f0f2aa447589eb981dd610597e3c2a9409a59b131b4a7b99e5e1974416ee85c3
SHA512

a2355a9acb39e74910a4179e049ee781a40f68ed06601f14eaa1807baa3f2ce12e939584cd19928168744ddb8162b1258285af5abf28e1d31b271af92655f488
SSDEEP

1536:SENZpoGulqFcDZyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:SE9FcDZyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
5072	msedge.exe
5072	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5072	msedge.exe
5072	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 1704	5072	msedge.exe	82
PID 5072 wrote to memory of 1704	5072	msedge.exe	82
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 4412	5072	msedge.exe	83
PID 5072 wrote to memory of 1168	5072	msedge.exe	84
PID 5072 wrote to memory of 1168	5072	msedge.exe	84
PID 5072 wrote to memory of 4548	5072	msedge.exe	85
PID 5072 wrote to memory of 4548	5072	msedge.exe	85
PID 5072 wrote to memory of 4548	5072	msedge.exe	85
PID 5072 wrote to memory of 4548	5072	msedge.exe	85
PID 5072 wrote to memory of 4548	5072	msedge.exe	85
PID 5072 wrote to memory of 4548	5072	msedge.exe	85
PID 5072 wrote to memory of 4548	5072	msedge.exe	85
PID 5072 wrote to memory of 4548	5072	msedge.exe	85
PID 5072 wrote to memory of 4548	5072	msedge.exe	85
PID 5072 wrote to memory of 4548	5072	msedge.exe	85
PID 5072 wrote to memory of 4548	5072	msedge.exe	85
PID 5072 wrote to memory of 4548	5072	msedge.exe	85
PID 5072 wrote to memory of 4548	5072	msedge.exe	85
PID 5072 wrote to memory of 4548	5072	msedge.exe	85
PID 5072 wrote to memory of 4548	5072	msedge.exe	85
PID 5072 wrote to memory of 4548	5072	msedge.exe	85
PID 5072 wrote to memory of 4548	5072	msedge.exe	85
PID 5072 wrote to memory of 4548	5072	msedge.exe	85
PID 5072 wrote to memory of 4548	5072	msedge.exe	85
PID 5072 wrote to memory of 4548	5072	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\777f5162ac49a783d809a20f1d47dbee_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb884446f8,0x7ffb88444708,0x7ffb88444718
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,7584037013681713310,6914825221671495334,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,7584037013681713310,6914825221671495334,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,7584037013681713310,6914825221671495334,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7584037013681713310,6914825221671495334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7584037013681713310,6914825221671495334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,7584037013681713310,6914825221671495334,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1308 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
94e6732002cacdd6d24920c7d419a869

SHA1
11b7b2e584a41bc3ffeb9e3e5e7745d7760959bd

SHA256
36f7c0c42d2207614a7af281d18315e1404b8c82d601caa53313730b387caf62

SHA512
2dfd99dabbe6c1639ce966f7f1f64ad9d660247b8068540e9c687535ab1eb6b275007b1063f0a33a9e7d0db6cddcfd0f7ea974e96107e57ec6be0d6031b808e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7d432d45f64d2fe004d5321da089dc93

SHA1
a5680cb381286f090ca19a2dddff32edf3e4d5cf

SHA256
c3cf829e603f8f7a3d92bf811933e1a831989a50afe2f7a5e72e39a93d06c51a

SHA512
8aae792eedff031223210a144f746c276b43c38458b0f0dda69eec832d3daf68b6f0b32c150c52852698907f5f514878465835cc862ad6d20a59a941ebd1706e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9b68f0d65cfc8ae7812111e2a732bbf0

SHA1
dd5151e1ed08a0ad9248d7b19c32253845dc1aef

SHA256
bed8477cedf5fe27fca3df4bcb99066d295cf1baa739ed75aa112cfc9168540c

SHA512
1bd466f2fa252343a727cc54124ef14a8890b442f6f360d4445b269ff2ead29040767c5012ef48f488bf48db32c85df3656ea6ba53978fca5477ba487c732f08

Download Submit