751b339dff0d4f2b2c24bea2e37e8afe400e93be540e344eb2d431586282bc23

Analysis

max time kernel
145s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b1b5014bbf687a991ae758b4597c821_JaffaCakes118.html
Size

23KB
MD5

7b1b5014bbf687a991ae758b4597c821
SHA1

dd360286ed268b5a4d8fbe6f1965729f55c85a24
SHA256

751b339dff0d4f2b2c24bea2e37e8afe400e93be540e344eb2d431586282bc23
SHA512

deb5b877e985e2f0e7975bd1a4d1d49820175a91fb97bd5ba871af484710ae816fe10910361b5a699c34f6d1211bf0324b6f4f262cbc6d7e3358f458e4ad7c46
SSDEEP

192:uwzFb5nf0pgnQjxn5Q/3nQieuNn2sfnQOkEnthVnQTbndnQKdjsvMBOqnYnQ7tnz:KQ/AscD7V

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2772	msedge.exe
2772	msedge.exe
3144	msedge.exe
3144	msedge.exe
3016	identity_helper.exe
3016	identity_helper.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 2808	3144	msedge.exe	82
PID 3144 wrote to memory of 2808	3144	msedge.exe	82
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 3152	3144	msedge.exe	83
PID 3144 wrote to memory of 2772	3144	msedge.exe	84
PID 3144 wrote to memory of 2772	3144	msedge.exe	84
PID 3144 wrote to memory of 552	3144	msedge.exe	85
PID 3144 wrote to memory of 552	3144	msedge.exe	85
PID 3144 wrote to memory of 552	3144	msedge.exe	85
PID 3144 wrote to memory of 552	3144	msedge.exe	85
PID 3144 wrote to memory of 552	3144	msedge.exe	85
PID 3144 wrote to memory of 552	3144	msedge.exe	85
PID 3144 wrote to memory of 552	3144	msedge.exe	85
PID 3144 wrote to memory of 552	3144	msedge.exe	85
PID 3144 wrote to memory of 552	3144	msedge.exe	85
PID 3144 wrote to memory of 552	3144	msedge.exe	85
PID 3144 wrote to memory of 552	3144	msedge.exe	85
PID 3144 wrote to memory of 552	3144	msedge.exe	85
PID 3144 wrote to memory of 552	3144	msedge.exe	85
PID 3144 wrote to memory of 552	3144	msedge.exe	85
PID 3144 wrote to memory of 552	3144	msedge.exe	85
PID 3144 wrote to memory of 552	3144	msedge.exe	85
PID 3144 wrote to memory of 552	3144	msedge.exe	85
PID 3144 wrote to memory of 552	3144	msedge.exe	85
PID 3144 wrote to memory of 552	3144	msedge.exe	85
PID 3144 wrote to memory of 552	3144	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7b1b5014bbf687a991ae758b4597c821_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffc752146f8,0x7ffc75214708,0x7ffc75214718
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,6095514461916897246,960754387499713138,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,6095514461916897246,960754387499713138,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,6095514461916897246,960754387499713138,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6095514461916897246,960754387499713138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6095514461916897246,960754387499713138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,6095514461916897246,960754387499713138,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,6095514461916897246,960754387499713138,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6095514461916897246,960754387499713138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6095514461916897246,960754387499713138,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6095514461916897246,960754387499713138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6095514461916897246,960754387499713138,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,6095514461916897246,960754387499713138,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4676 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8c212ddfa5759ae80f6991035af3faa3

SHA1
060d7ffaabbe35eb4312b35d1ee9b50e6200ca26

SHA256
bdca796ee760dcee8854855534914e7cf2dc6cb5b66eeea16b5cd6806a5c703f

SHA512
f259c9ee955768f51ac2171ba94985115a17f485677142f24db5e7eedbfe204fb5d92d978aa91c3f903fe2e095b9b647776cbbcbab2b92dfa12aeec85b8491c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
65e80d1c50234ed2bc8b4c3d5c189968

SHA1
2cff8d698afa0b9723edc955c96bc998bd30808d

SHA256
3e3b7f496513004d9a0313d59454ade8f33aebf59c5696bd646415e77ff42f0d

SHA512
f6cd86f0b5e6612a9944c6be3557b5fc54d3eb298d65306dffe02c38fe244c291ce1ca068d61f4b5ceac9d90061e217c72b71601f0c7f451f9206cba9f6af301

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
84b9bfeaab40c28385404909f7a66312

SHA1
65ac9e7d63289c90115f2c01c148a9de1a04822f

SHA256
328a995fb49df30489dd57dc8ad5b1d971aa09f5e5a703661cba0987c060a1e8

SHA512
34d944c0f206e177c146e946263dec666d134032d5558c2e4d0808eb838b97845b6b5dd192b469915efb3dfdf9c7faff2f474285f2a411d7fbd431cf6ba9ce89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f04b7260b275debab7bc8309a969b27f

SHA1
093e40f1c0661fa59b79cb8300646e43c1263734

SHA256
b870750cc3b283389f3f1214a980821b76fa3377983b98fa6e23f9ec45d31e8f

SHA512
2ea3c12a8c322fe76f89ef4f2b03d984532edf561bbc64ac56438c156803b21c7b835a75a077100ec620abd07c279897e9948b257ab0b6f7c29e5be17416f12a

Download Submit