9c5a09ce690bfa057c29df229d5ec9cb8ce16978f0606312fd31a7f50d36b880

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 20:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7a5ea7d327ce083d694f3c4589a95b90_JaffaCakes118.html
Size

139KB
MD5

7a5ea7d327ce083d694f3c4589a95b90
SHA1

efe0e39a25c06f54f719a08f4a645cb0601f3089
SHA256

9c5a09ce690bfa057c29df229d5ec9cb8ce16978f0606312fd31a7f50d36b880
SHA512

242f5823d45d35b3095cde4d46128d053406f199dc67f5c5421e0cb2bf2626ff4fd0860d10701a2de06ad53d8c075543ea89fb234cb5404b85157dff4466ec2d
SSDEEP

1536:SzTFZrlhLyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOZ:Sz3LyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3836	msedge.exe
3836	msedge.exe
2440	msedge.exe
2440	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2440	msedge.exe
2440	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 4484	2440	msedge.exe	83
PID 2440 wrote to memory of 4484	2440	msedge.exe	83
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3932	2440	msedge.exe	84
PID 2440 wrote to memory of 3836	2440	msedge.exe	85
PID 2440 wrote to memory of 3836	2440	msedge.exe	85
PID 2440 wrote to memory of 4816	2440	msedge.exe	86
PID 2440 wrote to memory of 4816	2440	msedge.exe	86
PID 2440 wrote to memory of 4816	2440	msedge.exe	86
PID 2440 wrote to memory of 4816	2440	msedge.exe	86
PID 2440 wrote to memory of 4816	2440	msedge.exe	86
PID 2440 wrote to memory of 4816	2440	msedge.exe	86
PID 2440 wrote to memory of 4816	2440	msedge.exe	86
PID 2440 wrote to memory of 4816	2440	msedge.exe	86
PID 2440 wrote to memory of 4816	2440	msedge.exe	86
PID 2440 wrote to memory of 4816	2440	msedge.exe	86
PID 2440 wrote to memory of 4816	2440	msedge.exe	86
PID 2440 wrote to memory of 4816	2440	msedge.exe	86
PID 2440 wrote to memory of 4816	2440	msedge.exe	86
PID 2440 wrote to memory of 4816	2440	msedge.exe	86
PID 2440 wrote to memory of 4816	2440	msedge.exe	86
PID 2440 wrote to memory of 4816	2440	msedge.exe	86
PID 2440 wrote to memory of 4816	2440	msedge.exe	86
PID 2440 wrote to memory of 4816	2440	msedge.exe	86
PID 2440 wrote to memory of 4816	2440	msedge.exe	86
PID 2440 wrote to memory of 4816	2440	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7a5ea7d327ce083d694f3c4589a95b90_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe48be46f8,0x7ffe48be4708,0x7ffe48be4718
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,12270961953006388224,1906646137947466223,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,12270961953006388224,1906646137947466223,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,12270961953006388224,1906646137947466223,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12270961953006388224,1906646137947466223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12270961953006388224,1906646137947466223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,12270961953006388224,1906646137947466223,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4748 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fef1b15dcb610c0ce142965231455b2e

SHA1
194b583c727b6e0662d79af113b00544e9e1f86d

SHA256
20af31edb54eee3a39184cbe1816d2742c1b786ab10cbf9d7fd2cfaf6c3db78f

SHA512
4d4147e7acfb9df98e06a79c4ca93c3b69f7b2840c92728d89bafa6d926ea21732f28d83fa6acffc4df6f2d6a3b0402b83d8e0fcdb6ded69dfc59a83b078c65d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
adec893aa96f5aae720aa3d5e4101174

SHA1
b12c4b394ef5e560d244bfd7fb4ac81e7243e30f

SHA256
6d6d58ccd850edcc1fb6b00603f0db5eb0b06ca4efc5707dc01045b2e3a41ffa

SHA512
2aee8b82cf05893a1fbf384fcae67f769e3a787fd1675f063f11a2519b1ef8c2a17777eea2dfe0a8f03810006259e1592ce00750d0ed2f6bb7cf8ba27437ffe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
497caebf9bfa044fa17236d9296d8b01

SHA1
5c978737df91a1d39de2fe6a2197587b2474ce96

SHA256
ae47cee5e238ec08954c0912984d239146d5294db8cb62543a3b6712751dfde1

SHA512
ca00e1edde1959444c895709b9f1b87fa6871079e752f1ef8c034f4e77339d3f5c9b39d8c722be431a2688726b623d5e8b3a336bf63e75b68f103141bb778ae6

Download Submit