5dd15c16a4fcfd1edeb28ec5d25ca0cb5b967c7852eb786f68d88510ac6c19a8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 15:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d87a7bbcbd5295a506e8a9e870b9f53_JaffaCakes118.html
Size

20KB
MD5

7d87a7bbcbd5295a506e8a9e870b9f53
SHA1

99433208fd21344a273ba1628e26d210f60ff9dd
SHA256

5dd15c16a4fcfd1edeb28ec5d25ca0cb5b967c7852eb786f68d88510ac6c19a8
SHA512

101df638fed9ad10672f4393b322b2108436d0d6ee2a016500f634304eeafb9d247293cf4097b4e0697975ebaba420a731c269d91a528febe0bfaac856dc9186
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIO4gzUnjBhcm82qDB8:SIMd0I5nO9HrsvclxDB8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
1008	msedge.exe
1008	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1008	msedge.exe
1008	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 4616	1008	msedge.exe	84
PID 1008 wrote to memory of 4616	1008	msedge.exe	84
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 4016	1008	msedge.exe	85
PID 1008 wrote to memory of 3732	1008	msedge.exe	86
PID 1008 wrote to memory of 3732	1008	msedge.exe	86
PID 1008 wrote to memory of 748	1008	msedge.exe	87
PID 1008 wrote to memory of 748	1008	msedge.exe	87
PID 1008 wrote to memory of 748	1008	msedge.exe	87
PID 1008 wrote to memory of 748	1008	msedge.exe	87
PID 1008 wrote to memory of 748	1008	msedge.exe	87
PID 1008 wrote to memory of 748	1008	msedge.exe	87
PID 1008 wrote to memory of 748	1008	msedge.exe	87
PID 1008 wrote to memory of 748	1008	msedge.exe	87
PID 1008 wrote to memory of 748	1008	msedge.exe	87
PID 1008 wrote to memory of 748	1008	msedge.exe	87
PID 1008 wrote to memory of 748	1008	msedge.exe	87
PID 1008 wrote to memory of 748	1008	msedge.exe	87
PID 1008 wrote to memory of 748	1008	msedge.exe	87
PID 1008 wrote to memory of 748	1008	msedge.exe	87
PID 1008 wrote to memory of 748	1008	msedge.exe	87
PID 1008 wrote to memory of 748	1008	msedge.exe	87
PID 1008 wrote to memory of 748	1008	msedge.exe	87
PID 1008 wrote to memory of 748	1008	msedge.exe	87
PID 1008 wrote to memory of 748	1008	msedge.exe	87
PID 1008 wrote to memory of 748	1008	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7d87a7bbcbd5295a506e8a9e870b9f53_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff28d446f8,0x7fff28d44708,0x7fff28d44718
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,13051279952490650163,287765027370255792,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,13051279952490650163,287765027370255792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,13051279952490650163,287765027370255792,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13051279952490650163,287765027370255792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,13051279952490650163,287765027370255792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,13051279952490650163,287765027370255792,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df78ead806b6062ee1fb59cc89b165e1

SHA1
e262148215b7b865099ff7e094ac0c1f9b90f1ee

SHA256
6af52bf32a36d5c63e88c4906a8a08aae1172c2936d87d8b61b24aec13ce146c

SHA512
a241e3e1a24caac1f8de58343c1b540aa298c77835bb4217a42a3ef1cb51be766eae2d886782086b3caf8ea96077d666ba83eaa228b7c74c2fac34ebd20a852e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
388491c017db8cba1d3c58cd986e3fcb

SHA1
3667d14deb1a2f16cf73c891ae5bfb03bb27083b

SHA256
61e3726368c9c4b9939c3df9ecfb9550706e2593865a9837cd1695445034160d

SHA512
85d21ca8fcc86d189f0dce2db8f113298dfd8beef5f11a42cf82254a2976222b709bca97f8c3cc9ee01758d152280afa6fc498ab7686ca5f605819fb844fe2a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3b621852d64fa244b993c7e79eb532f7

SHA1
c518ac2e354caa214a891f907adebbee85933953

SHA256
ab7c8e84c1c40b45c5cf89b24618f7fbaf771d13acdf8295326c370948b0d43a

SHA512
76f8de5c70d243433d5aa52843f1bd0732bed697640957b44994448771258b3f5239c96a13d0bb08c47f4efe1424d96280aef66b885feba81fa2ac83c49ec9ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4cefb155b69e5ab2f98050bf16dc51ff

SHA1
8537050297ae5650c94c191b98cb43afcd0a9800

SHA256
d82b22cf515750448746b62813202c773e33ff9633df7c72889372d77e7b9dcc

SHA512
2a7329dd5f117f87ec6f5700a4fb043b05f0b4b63c28ed367d06a176e3adb8ab7e2ebf01ff82f9bbdc4b03cb3bb6056fbbfb4470f35325d743f9df75cecef943

Download Submit