60ffc1d12dd7a35be4214c72016b4db057be47c3efa908c66878032fa1bdaf4d

Analysis

max time kernel
135s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 00:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7eecdc91a905c7a7e59af04d62ed0762_JaffaCakes118.html
Size

30KB
MD5

7eecdc91a905c7a7e59af04d62ed0762
SHA1

216da2929bb1a03b96058557d1ead229c58726e1
SHA256

60ffc1d12dd7a35be4214c72016b4db057be47c3efa908c66878032fa1bdaf4d
SHA512

3c898340aefb301097f452bd952ff1842952db6d7634ec51ab119e08f8e01c7bb5e35b0eb4464ef2e044b227aa70269bcd3c25c5d7568110194b6aa068dbcc6a
SSDEEP

192:uWv7b5nBm7TnQjxn5Q/RnQieENnq8nQOkEntPfnQTbnpnQcXCjAv9EHkcwqHAM5b:FQ/sXuX15XL

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3772	msedge.exe
3772	msedge.exe
712	msedge.exe
712	msedge.exe
5072	identity_helper.exe
5072	identity_helper.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 712 wrote to memory of 764	712	msedge.exe	82
PID 712 wrote to memory of 764	712	msedge.exe	82
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3476	712	msedge.exe	83
PID 712 wrote to memory of 3772	712	msedge.exe	84
PID 712 wrote to memory of 3772	712	msedge.exe	84
PID 712 wrote to memory of 4244	712	msedge.exe	85
PID 712 wrote to memory of 4244	712	msedge.exe	85
PID 712 wrote to memory of 4244	712	msedge.exe	85
PID 712 wrote to memory of 4244	712	msedge.exe	85
PID 712 wrote to memory of 4244	712	msedge.exe	85
PID 712 wrote to memory of 4244	712	msedge.exe	85
PID 712 wrote to memory of 4244	712	msedge.exe	85
PID 712 wrote to memory of 4244	712	msedge.exe	85
PID 712 wrote to memory of 4244	712	msedge.exe	85
PID 712 wrote to memory of 4244	712	msedge.exe	85
PID 712 wrote to memory of 4244	712	msedge.exe	85
PID 712 wrote to memory of 4244	712	msedge.exe	85
PID 712 wrote to memory of 4244	712	msedge.exe	85
PID 712 wrote to memory of 4244	712	msedge.exe	85
PID 712 wrote to memory of 4244	712	msedge.exe	85
PID 712 wrote to memory of 4244	712	msedge.exe	85
PID 712 wrote to memory of 4244	712	msedge.exe	85
PID 712 wrote to memory of 4244	712	msedge.exe	85
PID 712 wrote to memory of 4244	712	msedge.exe	85
PID 712 wrote to memory of 4244	712	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7eecdc91a905c7a7e59af04d62ed0762_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8c3c46f8,0x7fff8c3c4708,0x7fff8c3c4718
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,8676868935104978881,6589173112098282089,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,8676868935104978881,6589173112098282089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,8676868935104978881,6589173112098282089,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8676868935104978881,6589173112098282089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8676868935104978881,6589173112098282089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,8676868935104978881,6589173112098282089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,8676868935104978881,6589173112098282089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8676868935104978881,6589173112098282089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8676868935104978881,6589173112098282089,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8676868935104978881,6589173112098282089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8676868935104978881,6589173112098282089,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,8676868935104978881,6589173112098282089,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4724 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6c14be1685301e4df4269db7db2a2416

SHA1
eb95fe62b6d9a7246dab00871c5b125e5cf405ff

SHA256
b7476c729fb43db6089e618b4b306f68ba0a29c50546be056df6fa736168451d

SHA512
a2f4ee9f0c0fbc4c534ff2579111fb10eda88e009b06c3c6d8e4960e474e5cb0cf488a2cf3b345d1994ff8eb6472928383d833175b1db9b95bda53957fb897db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ca88be66693c4dd0e22761e7bfcd301f

SHA1
05daa14ea4aabb083b40b2738bf32659d178d64c

SHA256
6ca7bf80fc56fdf92bfcb2c54a7dc01a34f112eb36fc72dd724d8b14d55421ec

SHA512
c3871ab8cc3964290fbb43e659f28d5d21c82a7e2bb19c4f9495a1ff08884d80e8d2fdc14c5baf4f0c2d6e85f6d6ef952190b4fb59972be6e9f5fe93a358de0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a7f48fc1356250f0fb52c18588b471ae

SHA1
c05d7b4c5fc6a06656571e0f929b870252f3a655

SHA256
da8ea2219bc23acf9d81cb4903610429259fcfab8f6a8e008da10c17962ba12d

SHA512
bb8ef1e46d05147a2e02803806bf50206f9ad346ba268f6027f90096393b5bff29758c328e3122335628313ee948ce29cbd0c0186e1d7604f97890b4fd15e1ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a7e47813d40efbdcaacf58dcd4907d41

SHA1
dff676453e3da12417f43c889acd4ebfadef903e

SHA256
68b9edfae952e8ab1349c0ee887b542b149991b311189166ad514d441c91f79a

SHA512
b954f7f9ae0489df7732811a992df754858386b78982df28bc6f831f5e2cbfd570e9b020ff606d75307c264995baa6990246ef6d2a0c855bbdc21fce61eda37b

Download Submit