d1e6df53968b3428866f6ff312ea1b08ed83699ea7474e0b683db1d0b6a56d6b

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 04:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77ebaa44790987a4f004cc268bd0d783_JaffaCakes118.html
Size

13KB
MD5

77ebaa44790987a4f004cc268bd0d783
SHA1

b47dba37e690141c1c12db9a77f29b9b6878d648
SHA256

d1e6df53968b3428866f6ff312ea1b08ed83699ea7474e0b683db1d0b6a56d6b
SHA512

67677f98ae04e49652a8ab51b007b5eac0d969f56281970385bc4929543f363c24338c67330d7dc103b8b9c480279518640ceb06e34d7b61bc95945bc690cda4
SSDEEP

384:HSYraIwpGvY6mkjIIr2+6sZ6VYWmjwk24HChJZYNkC9LK:l+IwpamgIIC+rZ6VJmkk24HChJZYN9A

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4660	msedge.exe
4660	msedge.exe
5048	msedge.exe
5048	msedge.exe
3948	identity_helper.exe
3948	identity_helper.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 912	5048	msedge.exe	82
PID 5048 wrote to memory of 912	5048	msedge.exe	82
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4956	5048	msedge.exe	83
PID 5048 wrote to memory of 4660	5048	msedge.exe	84
PID 5048 wrote to memory of 4660	5048	msedge.exe	84
PID 5048 wrote to memory of 4236	5048	msedge.exe	85
PID 5048 wrote to memory of 4236	5048	msedge.exe	85
PID 5048 wrote to memory of 4236	5048	msedge.exe	85
PID 5048 wrote to memory of 4236	5048	msedge.exe	85
PID 5048 wrote to memory of 4236	5048	msedge.exe	85
PID 5048 wrote to memory of 4236	5048	msedge.exe	85
PID 5048 wrote to memory of 4236	5048	msedge.exe	85
PID 5048 wrote to memory of 4236	5048	msedge.exe	85
PID 5048 wrote to memory of 4236	5048	msedge.exe	85
PID 5048 wrote to memory of 4236	5048	msedge.exe	85
PID 5048 wrote to memory of 4236	5048	msedge.exe	85
PID 5048 wrote to memory of 4236	5048	msedge.exe	85
PID 5048 wrote to memory of 4236	5048	msedge.exe	85
PID 5048 wrote to memory of 4236	5048	msedge.exe	85
PID 5048 wrote to memory of 4236	5048	msedge.exe	85
PID 5048 wrote to memory of 4236	5048	msedge.exe	85
PID 5048 wrote to memory of 4236	5048	msedge.exe	85
PID 5048 wrote to memory of 4236	5048	msedge.exe	85
PID 5048 wrote to memory of 4236	5048	msedge.exe	85
PID 5048 wrote to memory of 4236	5048	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\77ebaa44790987a4f004cc268bd0d783_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8699846f8,0x7ff869984708,0x7ff869984718
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,11495146427117936986,9667273300338891597,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,11495146427117936986,9667273300338891597,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,11495146427117936986,9667273300338891597,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11495146427117936986,9667273300338891597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11495146427117936986,9667273300338891597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11495146427117936986,9667273300338891597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11495146427117936986,9667273300338891597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,11495146427117936986,9667273300338891597,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,11495146427117936986,9667273300338891597,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11495146427117936986,9667273300338891597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11495146427117936986,9667273300338891597,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11495146427117936986,9667273300338891597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11495146427117936986,9667273300338891597,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,11495146427117936986,9667273300338891597,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
d4602811470486d24f4cbd26cb4aed2d

SHA1
187a3dde09a27fdf5de0a4a5640bf45e94ee7ac3

SHA256
50d4143732a703c9a3942d483070876377ae51644cd5e8dba39834a35611234c

SHA512
659484676970e83ece5306659091e5f800554bdd40bd73629d2ea53d515859d73d7b74045ce9f35166653d3f66b7b8c3538f671d688a293ccd1a9384b6d32240

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
601B

MD5
a4527b83504bba9a051a56f33dbd3016

SHA1
bc4f85ed0f32f464c3343187318d6fb4fdb35494

SHA256
2f5fe2601e111cd1d5591ec8df1007212dc022a63dc9502d78a0718127489ae5

SHA512
b9257cde46578d186824faf679f3c9eb17eabcaf43922e7d6ff636ea4eb9ebfb90d3327ae87ef481f6c7f545eaf602d2f9198b4dc4970691d09c46292c43ec54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
421d617bcf207a2531ee7e857608c6f1

SHA1
296066bb9c7862b8ddbfa8441631cad5e3914208

SHA256
e1159a2bfb877e5351cc97b00c7d96cd53b6a9016484634dc25c9227450a3137

SHA512
1ff48a112d48ffa19f7f498b1788f1597e5d385de62550114260f946f74fead609b57db16e55e033b059bb37c70ed33dda8fbd4f5ef408d975e0228f939b391e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aabf7aff56622522181714c76a7a2ae7

SHA1
9b4c1189cdd7df578dee5c6a8d585c4e24e8876c

SHA256
e55fccc39fcb5c599502735ea07433ae1cdf4bd9828fbfd6a916c3a92c217997

SHA512
216ca4fe10dad2953a5292ff29a6636bf903bb21b73fcdc08bda219b7ba268b00ccc0497b80bfbd0ae25b8af4277b5fa238cd732d159e269c8ece7c68db5e101

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dc6bacdfbf91e40ce211c6e497537217

SHA1
7f865ef74104f1151435b57dcf5240f7be3c5770

SHA256
533b1799dad356772300afa4d4d4af4c2c45fab3dad024e21dea1b710a6cdcca

SHA512
cfcd7597a2efad236eb259362fce1b91cf38e31e6f72c75dc1edc16e3b91a87534ae09cc36108bbd33dc0463ab572a9cad0eb60c85bf611a0b777d885b8bc328

Download Submit