1d2121c57166808df1e27daaff1182d8fdb34988df4058d27d9d24d9441250ef

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 11:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7cb90f960b957b2f6052a53d876c2b67_JaffaCakes118.html
Size

139KB
MD5

7cb90f960b957b2f6052a53d876c2b67
SHA1

6707480b6c328fbf0573fb00165a1a7987b97c9e
SHA256

1d2121c57166808df1e27daaff1182d8fdb34988df4058d27d9d24d9441250ef
SHA512

f6c700c08585cd1aff5f4acfd6d15a028b4f8bbce9fd7995fe676e571b9fba595606fcf3041a66a7b404bd0bd6dc37f44801bef6e1acf6a59de347b29bbc708e
SSDEEP

1536:SrLX8BFolpVyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:SrSYVyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2156	msedge.exe
2156	msedge.exe
1572	msedge.exe
1572	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1572	msedge.exe
1572	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 4604	1572	msedge.exe	82
PID 1572 wrote to memory of 4604	1572	msedge.exe	82
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 116	1572	msedge.exe	83
PID 1572 wrote to memory of 2156	1572	msedge.exe	84
PID 1572 wrote to memory of 2156	1572	msedge.exe	84
PID 1572 wrote to memory of 1508	1572	msedge.exe	85
PID 1572 wrote to memory of 1508	1572	msedge.exe	85
PID 1572 wrote to memory of 1508	1572	msedge.exe	85
PID 1572 wrote to memory of 1508	1572	msedge.exe	85
PID 1572 wrote to memory of 1508	1572	msedge.exe	85
PID 1572 wrote to memory of 1508	1572	msedge.exe	85
PID 1572 wrote to memory of 1508	1572	msedge.exe	85
PID 1572 wrote to memory of 1508	1572	msedge.exe	85
PID 1572 wrote to memory of 1508	1572	msedge.exe	85
PID 1572 wrote to memory of 1508	1572	msedge.exe	85
PID 1572 wrote to memory of 1508	1572	msedge.exe	85
PID 1572 wrote to memory of 1508	1572	msedge.exe	85
PID 1572 wrote to memory of 1508	1572	msedge.exe	85
PID 1572 wrote to memory of 1508	1572	msedge.exe	85
PID 1572 wrote to memory of 1508	1572	msedge.exe	85
PID 1572 wrote to memory of 1508	1572	msedge.exe	85
PID 1572 wrote to memory of 1508	1572	msedge.exe	85
PID 1572 wrote to memory of 1508	1572	msedge.exe	85
PID 1572 wrote to memory of 1508	1572	msedge.exe	85
PID 1572 wrote to memory of 1508	1572	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7cb90f960b957b2f6052a53d876c2b67_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9924846f8,0x7ff992484708,0x7ff992484718
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,8195461171067585925,1616418215464248483,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,8195461171067585925,1616418215464248483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,8195461171067585925,1616418215464248483,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8195461171067585925,1616418215464248483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8195461171067585925,1616418215464248483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,8195461171067585925,1616418215464248483,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4024 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\66557a90-e564-404c-8fb5-7ee1a13e75ce.tmp

Filesize
6KB

MD5
53421f2753d3076378756e76ec792717

SHA1
7fc56e9324c1a0d0b5d7e3a6f8ca075fbc51ba80

SHA256
283af3a5d40550451477eafe68b8b596fd839e7252bd73607df42b87e6a470e3

SHA512
8474580497889df136a8262ac2b076cf84de8e401270bf8102d0cf8fad09aeb472d5ab43aa852dd20ba641b94a463b00fb44121fd7ebeb1892ec35613a4d3577

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
16df5196043edd76c7f05605ca14b15d

SHA1
ac18bd4921ac3acf5b9716abc14d0e743a5c8036

SHA256
9aece5d7b1b6831dac83609bd2601256962157bcfcdfcdda5a60d48b6c697a75

SHA512
fecfb10f0b6eb20cddc01bf6e6bb50551082d65246d918c52a18b2586776a0c4dd46bb1cd979f71481ce20a6c7f3c14d818a3ea19661442d39271c1f8a77d172

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fb692e9c5126946b9f05b7917fbf8ab8

SHA1
e4e38917589bd01e8e2d42eff5997c9a4a9bbd60

SHA256
2bb7564d4b13e1b8ce86f878d45f1ccc39160441cc9239a5500b2bb4b114879a

SHA512
8045aff8da5a6ef639c0f57ee1cab3541c6030faff2209b95cd56abd1bfbd5f02ee6dcfec133580db6a020979bac72e772af70f7f7cd45dfb2a1e22feaa253ed

Download Submit