f0ab9f2b8671d4c24e947d53e39710b94848802415acffb0475decf91c7a3864

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b7bde0869905036d6357263ec4a251f_JaffaCakes118.html
Size

28KB
MD5

7b7bde0869905036d6357263ec4a251f
SHA1

c5a4dc04a119dd66cf1b9cc3d4e8bf9f73655c91
SHA256

f0ab9f2b8671d4c24e947d53e39710b94848802415acffb0475decf91c7a3864
SHA512

8979d7577d1601b966d90ea55d2208197f360a54f7f90a7135096486d2b6e8fdddd290a3b8d5afee3cbd00d112ee981a53b922a896daa7ba60069d7d60aed174
SSDEEP

384:S8vZ1vWYewbthA4PQZ22lDtjh8UzVKqneg9:S8vZ1vWVuhA4Onl1h3zPew

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe
4680	msedge.exe
4680	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 1876	4680	msedge.exe	83
PID 4680 wrote to memory of 1876	4680	msedge.exe	83
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 3820	4680	msedge.exe	84
PID 4680 wrote to memory of 2972	4680	msedge.exe	85
PID 4680 wrote to memory of 2972	4680	msedge.exe	85
PID 4680 wrote to memory of 3024	4680	msedge.exe	86
PID 4680 wrote to memory of 3024	4680	msedge.exe	86
PID 4680 wrote to memory of 3024	4680	msedge.exe	86
PID 4680 wrote to memory of 3024	4680	msedge.exe	86
PID 4680 wrote to memory of 3024	4680	msedge.exe	86
PID 4680 wrote to memory of 3024	4680	msedge.exe	86
PID 4680 wrote to memory of 3024	4680	msedge.exe	86
PID 4680 wrote to memory of 3024	4680	msedge.exe	86
PID 4680 wrote to memory of 3024	4680	msedge.exe	86
PID 4680 wrote to memory of 3024	4680	msedge.exe	86
PID 4680 wrote to memory of 3024	4680	msedge.exe	86
PID 4680 wrote to memory of 3024	4680	msedge.exe	86
PID 4680 wrote to memory of 3024	4680	msedge.exe	86
PID 4680 wrote to memory of 3024	4680	msedge.exe	86
PID 4680 wrote to memory of 3024	4680	msedge.exe	86
PID 4680 wrote to memory of 3024	4680	msedge.exe	86
PID 4680 wrote to memory of 3024	4680	msedge.exe	86
PID 4680 wrote to memory of 3024	4680	msedge.exe	86
PID 4680 wrote to memory of 3024	4680	msedge.exe	86
PID 4680 wrote to memory of 3024	4680	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7b7bde0869905036d6357263ec4a251f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea6ed46f8,0x7ffea6ed4708,0x7ffea6ed4718
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,13072454376982075506,15327302217491278943,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,13072454376982075506,15327302217491278943,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,13072454376982075506,15327302217491278943,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13072454376982075506,15327302217491278943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13072454376982075506,15327302217491278943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,13072454376982075506,15327302217491278943,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3168 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
09f6e1766b8ef687ac9e6bc2d0c02abd

SHA1
dda673e5f33bc9f0b941b3c7801148153e5ee846

SHA256
9a08bba426904be3d0a5b75aeed52813240c46dfda95c98b2a887cc71c3a7994

SHA512
424d1bd84e394113aba1a2d70b4782f64a2d8bca2d7476ac3c40efd93156fd6ed543d2e3604f9f2c2ee728a95a7283634e681e006b35b20682ab0cdf35d0d2f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5305a0fbb8fc4b6ff640c1c2e55a6ca6

SHA1
4995608b0f159db42a719d073cd74af6f49b88ab

SHA256
45bb2be8bb46e2ad0af77b3bb8a32c7cfb290d6902cdc35ff3c4424c242a7335

SHA512
5e35614e06b4441f769d59c81113a33ad804767782169ac97bd75d7b4a9b1235b1fcb5d51ade3e02bf8424e61e4d592b2f76b68f4d0da2b85eabdf8bbf06476d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
565297def17369f2321dbe637e55046f

SHA1
a440febcc56d1d81359cfa26fce0bd1af00e939f

SHA256
61a1fed03567f0fe275ebc577a9abbd0f2348fa2115a2793a87271a099330fb2

SHA512
af96b61d3ed97d89af3025b3f021615531fa497781ee3161f6b129453c719cf0fdebdf166830d567b77e93d41af5d1ec43cb3dcf5a516d85b2d34a44a74c530c

Download Submit