1db7c5220e82f6ac646ee10fc5983a9e8a58188210a09b0f32d2f91e35ab8761

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 00:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b1e7aaaf79a7080546f5f3117ca44cc_JaffaCakes118.html
Size

18KB
MD5

7b1e7aaaf79a7080546f5f3117ca44cc
SHA1

774e775f158c304f957738f12757d2238a7ffe3c
SHA256

1db7c5220e82f6ac646ee10fc5983a9e8a58188210a09b0f32d2f91e35ab8761
SHA512

cbd8b5f654d7997950551de439fe7a9d286dfa8f1a6d2882cba5fa67b568e3c286268182287ed78b917a4cd3f4f60a9b2f0f8d8a3d1434a21688ca2e3b219e0a
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIo4azUnjBhuQ82qDB8:SIMd0I5nvHXsvuTxDB8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3696	msedge.exe
3696	msedge.exe
3500	msedge.exe
3500	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 112	3500	msedge.exe	83
PID 3500 wrote to memory of 112	3500	msedge.exe	83
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3668	3500	msedge.exe	84
PID 3500 wrote to memory of 3696	3500	msedge.exe	85
PID 3500 wrote to memory of 3696	3500	msedge.exe	85
PID 3500 wrote to memory of 8	3500	msedge.exe	86
PID 3500 wrote to memory of 8	3500	msedge.exe	86
PID 3500 wrote to memory of 8	3500	msedge.exe	86
PID 3500 wrote to memory of 8	3500	msedge.exe	86
PID 3500 wrote to memory of 8	3500	msedge.exe	86
PID 3500 wrote to memory of 8	3500	msedge.exe	86
PID 3500 wrote to memory of 8	3500	msedge.exe	86
PID 3500 wrote to memory of 8	3500	msedge.exe	86
PID 3500 wrote to memory of 8	3500	msedge.exe	86
PID 3500 wrote to memory of 8	3500	msedge.exe	86
PID 3500 wrote to memory of 8	3500	msedge.exe	86
PID 3500 wrote to memory of 8	3500	msedge.exe	86
PID 3500 wrote to memory of 8	3500	msedge.exe	86
PID 3500 wrote to memory of 8	3500	msedge.exe	86
PID 3500 wrote to memory of 8	3500	msedge.exe	86
PID 3500 wrote to memory of 8	3500	msedge.exe	86
PID 3500 wrote to memory of 8	3500	msedge.exe	86
PID 3500 wrote to memory of 8	3500	msedge.exe	86
PID 3500 wrote to memory of 8	3500	msedge.exe	86
PID 3500 wrote to memory of 8	3500	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7b1e7aaaf79a7080546f5f3117ca44cc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb31e746f8,0x7ffb31e74708,0x7ffb31e74718
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,7992120049462826385,7484753565867593164,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,7992120049462826385,7484753565867593164,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,7992120049462826385,7484753565867593164,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7992120049462826385,7484753565867593164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7992120049462826385,7484753565867593164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,7992120049462826385,7484753565867593164,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5e2fd264a5b37ba49fd06c21256ab3a4

SHA1
9d6029abab4aa6bc3a0a715d48d3cff5bc5e46a8

SHA256
378555c1d3aa823743f1fc9b03c121189d114ca07e404e58aaa4c351d83c52b8

SHA512
1993e871f98a494aaf262f9ca0dd8dcaa8808e841e1722dc1ee15046594326a39a8771f14dcc30e788cae1f5ef13b90543da437bf8de62a5ff3872717ef261f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c69105297ec210ac19d18e4b04a50e7a

SHA1
010224e29d5fce43ac49d64bbcbfa299ca9f7956

SHA256
f9d364e9a8f6800c524bc1fbe107a863f186aecd83eff3ddefd007c9b20a1507

SHA512
47d68a4c69c23c1fb343eb7e40622e8ac24ea9199d00a8cc90e34d81ad3f2229da24fb83e1e4228cfe3769c67e736119b38cbc064ad903b146c3ff3062de4d54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
314b10ed9650d7cf3f6153e983516934

SHA1
e79deac26cf6a7a289aefb75f557f06e261b6aea

SHA256
e01146e2ce4c3c40ecd1b95409d6f7d355e163ef78c42715a8811a7be69c9045

SHA512
5129874b72d6a5fc7c614d11d2e70c05cf1ee9e13f04bccff6665675ab9defacd9760cc8bccd619021e82a6cd6ce909454fcde66c2e8425ffd8b3b2a2f374dbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3e8a48eaeb778e24c24daec2c98b702d

SHA1
b628523f9283e23f50572808cbea50e28a7b136b

SHA256
e305ad16140d72e5fa36bcd2beb262df28672fe20fcf390298cd8e84a86220a1

SHA512
96b911152883e769d0f31f45c83bec8e246143624884eb4a724b0297f6b0a14a36a2aba527c4903aeb4c8262dea3d51b64b58bf0aefbc8ca3f4eb4a9b5ac30d6

Download Submit