aedf76007bb2b353f26adae8567f99b297ef576a1182931a499fd69cd7a04466

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b0577ae4b1c4153deea44d147d96859_JaffaCakes118.html
Size

17KB
MD5

7b0577ae4b1c4153deea44d147d96859
SHA1

55bf6d76c238fedb12e22717883042a24003be22
SHA256

aedf76007bb2b353f26adae8567f99b297ef576a1182931a499fd69cd7a04466
SHA512

84411ce2deeb10069b1e2dac5a5d1b076cbaacf5937b71856da593cdd80b3bca8f427e8b8a2e739bdb79af4ef783aaa394a172e4d044631603be039bd097c52c
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIH4tzUnjBhPB82qDB8:SIMd0I5nvH1svPKxDB8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
1100	msedge.exe
1100	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 3000	1100	msedge.exe	81
PID 1100 wrote to memory of 3000	1100	msedge.exe	81
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 1644	1100	msedge.exe	82
PID 1100 wrote to memory of 2416	1100	msedge.exe	83
PID 1100 wrote to memory of 2416	1100	msedge.exe	83
PID 1100 wrote to memory of 2324	1100	msedge.exe	84
PID 1100 wrote to memory of 2324	1100	msedge.exe	84
PID 1100 wrote to memory of 2324	1100	msedge.exe	84
PID 1100 wrote to memory of 2324	1100	msedge.exe	84
PID 1100 wrote to memory of 2324	1100	msedge.exe	84
PID 1100 wrote to memory of 2324	1100	msedge.exe	84
PID 1100 wrote to memory of 2324	1100	msedge.exe	84
PID 1100 wrote to memory of 2324	1100	msedge.exe	84
PID 1100 wrote to memory of 2324	1100	msedge.exe	84
PID 1100 wrote to memory of 2324	1100	msedge.exe	84
PID 1100 wrote to memory of 2324	1100	msedge.exe	84
PID 1100 wrote to memory of 2324	1100	msedge.exe	84
PID 1100 wrote to memory of 2324	1100	msedge.exe	84
PID 1100 wrote to memory of 2324	1100	msedge.exe	84
PID 1100 wrote to memory of 2324	1100	msedge.exe	84
PID 1100 wrote to memory of 2324	1100	msedge.exe	84
PID 1100 wrote to memory of 2324	1100	msedge.exe	84
PID 1100 wrote to memory of 2324	1100	msedge.exe	84
PID 1100 wrote to memory of 2324	1100	msedge.exe	84
PID 1100 wrote to memory of 2324	1100	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7b0577ae4b1c4153deea44d147d96859_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe24a846f8,0x7ffe24a84708,0x7ffe24a84718
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,7621500419709637609,14823683430919191084,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,7621500419709637609,14823683430919191084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,7621500419709637609,14823683430919191084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7621500419709637609,14823683430919191084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7621500419709637609,14823683430919191084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,7621500419709637609,14823683430919191084,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4884 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9e43c4cdd7b608a3458426624fb269f1

SHA1
d11881e893c4cc563a651fee769673fe85ad373e

SHA256
4e3792425bb0856bcda7321acbe1440a8959f7fe69bad7f6588b16fbba6b5906

SHA512
d5b070ef2552e5ed76c7e20ff988dd01fd13f3191a3bb42adc8b1a7a869dbcd7dec2190677af5d882c0ce202448adc02e0b54b1c0955acf3d5b57cbc37f74955

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
988e4040c21ff42f6fb598328c9a81c3

SHA1
11435d34428384dc92b858a93e1e7bd5ca4fc747

SHA256
59ff855f0dbded060859387d14142d28ddf48c308476d94a2e93d5787bc22543

SHA512
65a2bb656e9e3f97ad6453af1efe7838b1bf015167ef6e420e65cc0ced5c09a6f7f2635882c5232b606af630f1853c83499267349b6607c7b7996398f90820d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a7c9562f-a1d3-48eb-b82c-8af4d3b51713.tmp

Filesize
5KB

MD5
750b7de1d4f39ef292edc3e5e8e43259

SHA1
cf13556ff8c2b52048e85f46dce040ec617da1ea

SHA256
eaea2cf777f007cc1d91b227e05a5077053526713600b23332eb86d5933ec2ea

SHA512
8523912535c0a0cd2716b09f9ef563b11ec7afe180c464d7211df8c4318b9313806664441af5cbb9733dcec831f757e170fcb02a17c1def0010cd56693eee33c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c7dfa4e2022463b9d30c6e686d6b713a

SHA1
4f453ad94e985c81f74334ac0ae7e5d9cc66b8ee

SHA256
4280e93a224d2905acb9956b0ed2b266c9ad8834e0c0b0620d013f1537d1a9f7

SHA512
2c52ca9891f280124a78128e1890314c6a96825bdd9f49ced013bfb8cba0934a72c3eae17ea24ccd98929dc96149f5186404d0f0d60f032f8d7a228590b73711

Download Submit