7969603649a8d8399d41b09abc098a2b52ac06ab8b5a730d51f97d970ed46521

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 04:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77ea7281b47d870993bb16f4598f9632_JaffaCakes118.html
Size

18KB
MD5

77ea7281b47d870993bb16f4598f9632
SHA1

a7afff322e94219f7ea4a93464ef552fdca5072e
SHA256

7969603649a8d8399d41b09abc098a2b52ac06ab8b5a730d51f97d970ed46521
SHA512

3dac4b871f8ce892260102d7e76beb03545cea0a921f61f2aeca3a8549bf7da34a934e6ee42e81e8060ea62977f0ebe61bca5527f1976453de70a51ddf50cdb2
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIX4fzUnjBhRb82qDB8:SIMd0I5nvHBsvRAxDB8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1700	msedge.exe
1700	msedge.exe
2968	msedge.exe
2968	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 364	2968	msedge.exe	81
PID 2968 wrote to memory of 364	2968	msedge.exe	81
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 2652	2968	msedge.exe	82
PID 2968 wrote to memory of 1700	2968	msedge.exe	83
PID 2968 wrote to memory of 1700	2968	msedge.exe	83
PID 2968 wrote to memory of 3048	2968	msedge.exe	84
PID 2968 wrote to memory of 3048	2968	msedge.exe	84
PID 2968 wrote to memory of 3048	2968	msedge.exe	84
PID 2968 wrote to memory of 3048	2968	msedge.exe	84
PID 2968 wrote to memory of 3048	2968	msedge.exe	84
PID 2968 wrote to memory of 3048	2968	msedge.exe	84
PID 2968 wrote to memory of 3048	2968	msedge.exe	84
PID 2968 wrote to memory of 3048	2968	msedge.exe	84
PID 2968 wrote to memory of 3048	2968	msedge.exe	84
PID 2968 wrote to memory of 3048	2968	msedge.exe	84
PID 2968 wrote to memory of 3048	2968	msedge.exe	84
PID 2968 wrote to memory of 3048	2968	msedge.exe	84
PID 2968 wrote to memory of 3048	2968	msedge.exe	84
PID 2968 wrote to memory of 3048	2968	msedge.exe	84
PID 2968 wrote to memory of 3048	2968	msedge.exe	84
PID 2968 wrote to memory of 3048	2968	msedge.exe	84
PID 2968 wrote to memory of 3048	2968	msedge.exe	84
PID 2968 wrote to memory of 3048	2968	msedge.exe	84
PID 2968 wrote to memory of 3048	2968	msedge.exe	84
PID 2968 wrote to memory of 3048	2968	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\77ea7281b47d870993bb16f4598f9632_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff739b46f8,0x7fff739b4708,0x7fff739b4718
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,17669175004368529809,6359827020858119160,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,17669175004368529809,6359827020858119160,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,17669175004368529809,6359827020858119160,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17669175004368529809,6359827020858119160,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17669175004368529809,6359827020858119160,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,17669175004368529809,6359827020858119160,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a732e1e405de13e6e4034127364be5fd

SHA1
9551077319f274664ec55c4bce4fb223e9401184

SHA256
f7c53b04e9057faeb6532cba0c1404a74a24a46171ab643ba0bd749995cb1da0

SHA512
8dc498372f765ca8fd8be98ba26192b1d402cdb0d17ab48cce357e7583a9a6654942090700e5acb9abbf2785e57322c4453435c5e80bb264f925e709bbd06021

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
772383dc5fdbbdacdcce6683f9d4c559

SHA1
29a738399b86c403e8d2aacc0ad5b8a14ddaddfe

SHA256
70a445bd83c92808d1e95d2b72d9254cdc9cee5533b3f46d6eac2307a4256698

SHA512
bb5fa9ed52104fd2e2544a566947f2d21c494d458028d81b56fad31607f07b38928c25592fd498e607fe181f38307858df2fc5e46a18da13f9cdbc411c13964c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7f332423018acdcf9a9e03375ae1ba26

SHA1
1a73cf94495ba9ca3c669c6901e209a59b750c68

SHA256
b2f666232f85e2447fec202d2c7d3c7e1c51d128ab8a541e3011bee0bfbe22ec

SHA512
e2380c502c4488ad1d00ef9c43f383063ed68224670c29b22cb4937e845baeb8572e5407ba60a3da6456b0782935e193c31bd6fe7eec68fa8f2c477e6e374cdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
da49bb76db42461eb63ad9634f55509d

SHA1
c66088f71c60026a41e76a5eb19c89a79ca17235

SHA256
57085532c897e7e339cfaf7b7e53026bee6d42993a59ffb85147c7eceb870780

SHA512
27cf54f1aefe562b0025cfab47c7c89dce19cf5327aea0e2210851058eec85aaadbabb124e4b107e2c82f508165556f5c7f229232bf5fc57c22cdc9b7848360a

Download Submit