67a29ac0b40db442b9714b2c718202128a71bc89eddcc677906bd0078e73f55c

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 20:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a5da5eeafe1f7e3f4a0b511ac09c8f8_JaffaCakes118.html
Size

26KB
MD5

7a5da5eeafe1f7e3f4a0b511ac09c8f8
SHA1

17d2a327f0297c49b82ecc03cd600e9a0892af63
SHA256

67a29ac0b40db442b9714b2c718202128a71bc89eddcc677906bd0078e73f55c
SHA512

e1ebeaa795d8883ac9bf9ab4621ffcbc726ee9ac9c4a9ff14103343a9d225f8d15326a1bf17ba79dc2b1a24d427d5b93a73fffedcc0a4f6e5f7cb2830c5d20c4
SSDEEP

192:RSIowTBb5n+nQjLntQ/RnQieln4nQOkrntPcnQTbnCnQT+Gtm6CrEY0eQl7M7nFL:UIo0JQ/ulzXaN05O

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
4436	msedge.exe
4436	msedge.exe
4552	identity_helper.exe
4552	identity_helper.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 4992	4436	msedge.exe	83
PID 4436 wrote to memory of 4992	4436	msedge.exe	83
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 2264	4436	msedge.exe	84
PID 4436 wrote to memory of 3224	4436	msedge.exe	85
PID 4436 wrote to memory of 3224	4436	msedge.exe	85
PID 4436 wrote to memory of 1396	4436	msedge.exe	86
PID 4436 wrote to memory of 1396	4436	msedge.exe	86
PID 4436 wrote to memory of 1396	4436	msedge.exe	86
PID 4436 wrote to memory of 1396	4436	msedge.exe	86
PID 4436 wrote to memory of 1396	4436	msedge.exe	86
PID 4436 wrote to memory of 1396	4436	msedge.exe	86
PID 4436 wrote to memory of 1396	4436	msedge.exe	86
PID 4436 wrote to memory of 1396	4436	msedge.exe	86
PID 4436 wrote to memory of 1396	4436	msedge.exe	86
PID 4436 wrote to memory of 1396	4436	msedge.exe	86
PID 4436 wrote to memory of 1396	4436	msedge.exe	86
PID 4436 wrote to memory of 1396	4436	msedge.exe	86
PID 4436 wrote to memory of 1396	4436	msedge.exe	86
PID 4436 wrote to memory of 1396	4436	msedge.exe	86
PID 4436 wrote to memory of 1396	4436	msedge.exe	86
PID 4436 wrote to memory of 1396	4436	msedge.exe	86
PID 4436 wrote to memory of 1396	4436	msedge.exe	86
PID 4436 wrote to memory of 1396	4436	msedge.exe	86
PID 4436 wrote to memory of 1396	4436	msedge.exe	86
PID 4436 wrote to memory of 1396	4436	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7a5da5eeafe1f7e3f4a0b511ac09c8f8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97d9546f8,0x7ff97d954708,0x7ff97d954718
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,6075755931247232502,8089740268142435591,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,6075755931247232502,8089740268142435591,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,6075755931247232502,8089740268142435591,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6075755931247232502,8089740268142435591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6075755931247232502,8089740268142435591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,6075755931247232502,8089740268142435591,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1736 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,6075755931247232502,8089740268142435591,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6075755931247232502,8089740268142435591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1332 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6075755931247232502,8089740268142435591,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1308 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6075755931247232502,8089740268142435591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6075755931247232502,8089740268142435591,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,6075755931247232502,8089740268142435591,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5168 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ed31fcbb4e7b0b1341572f74fb0a2857

SHA1
e098b76baeaa7882d6e46b88c0787271bd1eaed3

SHA256
bf5223dd5bc02180492d56172035b7a2004e76ca32983bb10379e8ce4443c31c

SHA512
f45e9ccf377c6ca4125d1f8a42d347b2ff8a58ded00bdbe86db379a94ed16b769eff86b77f5282229749c4d315cfddb212d7f01bb492b0749e52fd51d32f295c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7a54832ef3af4d3e0a74d5871e5e21b7

SHA1
efa751d953c3bc265ab8a1300cf9208d5dcddadc

SHA256
7bbb73ccc77881c7da1354ce84e814ad43248f5359d0f837c07ef92d28c88787

SHA512
b12396da5f049ebf025b7454b068a04152199b60d77284a50bc5af6643c58d8a2f732c58d4646581c65eb8e1f4dbe10611b87e9687108fef3597ae0be9a6589f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
605e7f7927b343de6343c20c72c9a5b0

SHA1
6e71a49c9ab6593e08f69bce2ce9f108ab7f16cd

SHA256
16109d558e1dff33d87e2e238e049b4d805c80478456afddf1272bc5d8ea5fb3

SHA512
9734010c2621fc6488cfb6af021610bc59e6422ebce827981df878e1d3b1ffbb1238ca426ead1851a730b2f20e1f0942699217ebb785f049e95750686de23c3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1646a0938536784ac7b5853b504ebc42

SHA1
1ae5e3647e346f80577e0347e728eef39b15a366

SHA256
4550b60a689e28ad57d3525edf074a3d9371714a9c235887113bca7b6daaa021

SHA512
f85507714143066a78c40d4e4a8b9602a1572b49dc7ea0d1900f0daea5dea4ddcb5eadbae52535b0ca1e167099e1d727a7d6205328a0168d467d60077571a7d9

Download Submit