f0bb600ea466e2561ff16294392052d9f068444a71849a6cbfd15975c903abb1

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e071063c7cdb993eb54dc24ffa54d73_JaffaCakes118.html
Size

40KB
MD5

7e071063c7cdb993eb54dc24ffa54d73
SHA1

4a44b7cdf068589692f8de14a836eaeb8e10377f
SHA256

f0bb600ea466e2561ff16294392052d9f068444a71849a6cbfd15975c903abb1
SHA512

01fcdc45ee024885b19a02bbe5f41aa743e15f28916b8943c2c678e14a5c4f94ecc7cbb2eba07ee871f69933fb7e72a134a1886c9c4e73f1dff4233be83f8c80
SSDEEP

768:V21oHPFWmTJq4jIjVpnUuJAgcWBGbleEtNudimk5lrD1iPPepSLIdL:VwoHPFWmTJq4jIppnUuJAgcWBG8EtNu8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2688	msedge.exe
2688	msedge.exe
1800	msedge.exe
1800	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1800	msedge.exe
1800	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 4844	1800	msedge.exe	83
PID 1800 wrote to memory of 4844	1800	msedge.exe	83
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 4596	1800	msedge.exe	84
PID 1800 wrote to memory of 2688	1800	msedge.exe	85
PID 1800 wrote to memory of 2688	1800	msedge.exe	85
PID 1800 wrote to memory of 1584	1800	msedge.exe	86
PID 1800 wrote to memory of 1584	1800	msedge.exe	86
PID 1800 wrote to memory of 1584	1800	msedge.exe	86
PID 1800 wrote to memory of 1584	1800	msedge.exe	86
PID 1800 wrote to memory of 1584	1800	msedge.exe	86
PID 1800 wrote to memory of 1584	1800	msedge.exe	86
PID 1800 wrote to memory of 1584	1800	msedge.exe	86
PID 1800 wrote to memory of 1584	1800	msedge.exe	86
PID 1800 wrote to memory of 1584	1800	msedge.exe	86
PID 1800 wrote to memory of 1584	1800	msedge.exe	86
PID 1800 wrote to memory of 1584	1800	msedge.exe	86
PID 1800 wrote to memory of 1584	1800	msedge.exe	86
PID 1800 wrote to memory of 1584	1800	msedge.exe	86
PID 1800 wrote to memory of 1584	1800	msedge.exe	86
PID 1800 wrote to memory of 1584	1800	msedge.exe	86
PID 1800 wrote to memory of 1584	1800	msedge.exe	86
PID 1800 wrote to memory of 1584	1800	msedge.exe	86
PID 1800 wrote to memory of 1584	1800	msedge.exe	86
PID 1800 wrote to memory of 1584	1800	msedge.exe	86
PID 1800 wrote to memory of 1584	1800	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7e071063c7cdb993eb54dc24ffa54d73_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc19cc46f8,0x7ffc19cc4708,0x7ffc19cc4718
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16709905190673208237,10294879698762131345,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,16709905190673208237,10294879698762131345,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,16709905190673208237,10294879698762131345,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16709905190673208237,10294879698762131345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16709905190673208237,10294879698762131345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16709905190673208237,10294879698762131345,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4648 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
309B

MD5
5913d49af80919d4dcff5e81d2cb5e98

SHA1
90d30f25a327fdb32044ee83560d4f40443380ff

SHA256
9832be2f6eb5e1dbc8a1ce26ea226b77b32037826b71a0a81402541ebea88c72

SHA512
955a29dfb6a7c1cccd8c3584c701180bd9442187933a037fb549e52d36c09ee08d456ad6c192f0a6eb972a9aa535eef9584c925a5c3180f54dfdb54a8002d5e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f5a827131c78879f28e2528b252e9763

SHA1
03755c2178bc4b0970cfd4fba47ffd9695a05e3e

SHA256
d65b73cec0cbc58ee902a0ccccaddf67c6f783f70f2aa4843c1debf24dcd84aa

SHA512
365ac79939966ecf1c3a8920b23d9a536d9f0c96ca380b39417ae77946ac4480a23bcce999f2b9a06ed3a1eeb5ae28b5864b9e74a86c071a12bb43334aad2aa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
63b1a7d78e5602edcffdc272c3bc23b6

SHA1
dbbc1227b96813a89aa96f013b3dc7e5d6d4210d

SHA256
277c2f4746a19a6d3d1c2edeac2deafb9f830347b044c371efb1cfdd706bd279

SHA512
fe65817086b10b6e7618f353c20bb63041dcfac0ded437633feb2953029a45a92e3a460188e431ac880fb82c83bba7ad19443392a1ac92f1af12bec6098536ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
effacc6cbe51d2283a3213c962111e59

SHA1
7954eb9e36b432692b854a7583a466c9793dc65c

SHA256
9479e726711483fe666a19413ea0a53ed6d88c29a5a08c6e760c2c16c73a7016

SHA512
08b3efaf1cb9f5cd6fc9fbf85fedcc21f1dca97faa5c0fea970f9fb632724b83f8f9cd6b9a75eebbe9db7afae2d11934745d69d67203db0e65cd5dc2522186fc

Download Submit