dcc93817cd038305137f08f17bbcaff6999cc24edc100e69a70a45d97c037e8c

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 20:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7a7ab3091b03620f150217d51caba2bb_JaffaCakes118.html
Size

9KB
MD5

7a7ab3091b03620f150217d51caba2bb
SHA1

78c61b2c2e7f6606bdb80c04dd8240cdf444956b
SHA256

dcc93817cd038305137f08f17bbcaff6999cc24edc100e69a70a45d97c037e8c
SHA512

7babe2a86526e9eb37a3d4d74a65da1f63b43404bff8628a406707ee3257114a47e8c731b7bafe86abf9571a6c54ce6681d4e4d19952569b7e4d7b0fe85d0762
SSDEEP

192:aHst3Oefcfdma1CBcFL397NdcAGRoOQiP8G:3fclma1COFL397TcAmoOnh

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2720	msedge.exe
2720	msedge.exe
3204	identity_helper.exe
3204	identity_helper.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 3120	2720	msedge.exe	83
PID 2720 wrote to memory of 3120	2720	msedge.exe	83
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 1664	2720	msedge.exe	84
PID 2720 wrote to memory of 2444	2720	msedge.exe	85
PID 2720 wrote to memory of 2444	2720	msedge.exe	85
PID 2720 wrote to memory of 4640	2720	msedge.exe	86
PID 2720 wrote to memory of 4640	2720	msedge.exe	86
PID 2720 wrote to memory of 4640	2720	msedge.exe	86
PID 2720 wrote to memory of 4640	2720	msedge.exe	86
PID 2720 wrote to memory of 4640	2720	msedge.exe	86
PID 2720 wrote to memory of 4640	2720	msedge.exe	86
PID 2720 wrote to memory of 4640	2720	msedge.exe	86
PID 2720 wrote to memory of 4640	2720	msedge.exe	86
PID 2720 wrote to memory of 4640	2720	msedge.exe	86
PID 2720 wrote to memory of 4640	2720	msedge.exe	86
PID 2720 wrote to memory of 4640	2720	msedge.exe	86
PID 2720 wrote to memory of 4640	2720	msedge.exe	86
PID 2720 wrote to memory of 4640	2720	msedge.exe	86
PID 2720 wrote to memory of 4640	2720	msedge.exe	86
PID 2720 wrote to memory of 4640	2720	msedge.exe	86
PID 2720 wrote to memory of 4640	2720	msedge.exe	86
PID 2720 wrote to memory of 4640	2720	msedge.exe	86
PID 2720 wrote to memory of 4640	2720	msedge.exe	86
PID 2720 wrote to memory of 4640	2720	msedge.exe	86
PID 2720 wrote to memory of 4640	2720	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7a7ab3091b03620f150217d51caba2bb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe69fb46f8,0x7ffe69fb4708,0x7ffe69fb4718
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,6337356492345820036,3265355085187757379,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,6337356492345820036,3265355085187757379,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,6337356492345820036,3265355085187757379,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6337356492345820036,3265355085187757379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6337356492345820036,3265355085187757379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,6337356492345820036,3265355085187757379,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,6337356492345820036,3265355085187757379,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6337356492345820036,3265355085187757379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6337356492345820036,3265355085187757379,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6337356492345820036,3265355085187757379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6337356492345820036,3265355085187757379,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,6337356492345820036,3265355085187757379,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2756 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
71c7eb82e60403b142aee6f96d69cfca

SHA1
5dde77537f2c8da0201654bcfb502a2aeb48298b

SHA256
0771f3977abb8674fada1baf3795c67a9f0b4c306506dbb7c3da0200a39c390e

SHA512
f2ba06da06ba0564af0c009218de0dc743c65268264a7e50ce00664681e72ad7d3adc3597e0244996da70f343cebdecad741a1f0633cc0c2aa8a342d51cf915b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4e780736acf8ce77b8299fb3f351f125

SHA1
2e557541c22c2d647486feb16c3f54c9380c6fe6

SHA256
23e5f5c34094ed8ca99b53c6c031cf27b17d8388c9109cfcf57385f65347d10d

SHA512
40a8ff5897f0e6d7bac5cf2882f34118311481918a797e40439cb5d27474c27cf37883a024e47dfbdf0b2c06a5b3ed682049aba14c62e58703d389433aecfe99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
463e6951ae3f0b2142424bb859dd2fee

SHA1
89fdb8a8914814913e9f3040a9ef2ceb9f21f892

SHA256
001db3a7c159f3c5e9cff59267c5bdb6efe6b4c5048ab4f024b16583891639fa

SHA512
2da71cf940b3d4bceb05e24f50f9f01e4d10db03af1c18f2b908b23b0add469e10d97a8a4b03180f848c511157056f4797301ed0a111fa6bbd2da33e65cf354c

Download Submit