5d7cce6cfa13e468b78197431547a39ee4bb4fdcd50fafb23197b8f5ee3cc8e5

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 03:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f4eb02fe0c21d251dcbe4832c12a3e2_JaffaCakes118.html
Size

36KB
MD5

7f4eb02fe0c21d251dcbe4832c12a3e2
SHA1

4483c03b87cc6fe43a63b2bb9b5b1c8fe89fd5fd
SHA256

5d7cce6cfa13e468b78197431547a39ee4bb4fdcd50fafb23197b8f5ee3cc8e5
SHA512

2c5307b9b08b12bbbcfc46993bf9020f52863c179d78ace94e07628fce562e2954076688bed907b806c5a5959f1ed6118d580cb5433cb3b4ff96577bbaa4ef51
SSDEEP

768:zwx/MDTHGY88hAR1ZPXoE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6Tsdr6f9U56lLRcB:Q/jbJxNVWufSM/s8QK

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2836	msedge.exe
2836	msedge.exe
1808	msedge.exe
1808	msedge.exe
4640	identity_helper.exe
4640	identity_helper.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 1804	1808	msedge.exe	81
PID 1808 wrote to memory of 1804	1808	msedge.exe	81
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 4564	1808	msedge.exe	82
PID 1808 wrote to memory of 2836	1808	msedge.exe	83
PID 1808 wrote to memory of 2836	1808	msedge.exe	83
PID 1808 wrote to memory of 520	1808	msedge.exe	84
PID 1808 wrote to memory of 520	1808	msedge.exe	84
PID 1808 wrote to memory of 520	1808	msedge.exe	84
PID 1808 wrote to memory of 520	1808	msedge.exe	84
PID 1808 wrote to memory of 520	1808	msedge.exe	84
PID 1808 wrote to memory of 520	1808	msedge.exe	84
PID 1808 wrote to memory of 520	1808	msedge.exe	84
PID 1808 wrote to memory of 520	1808	msedge.exe	84
PID 1808 wrote to memory of 520	1808	msedge.exe	84
PID 1808 wrote to memory of 520	1808	msedge.exe	84
PID 1808 wrote to memory of 520	1808	msedge.exe	84
PID 1808 wrote to memory of 520	1808	msedge.exe	84
PID 1808 wrote to memory of 520	1808	msedge.exe	84
PID 1808 wrote to memory of 520	1808	msedge.exe	84
PID 1808 wrote to memory of 520	1808	msedge.exe	84
PID 1808 wrote to memory of 520	1808	msedge.exe	84
PID 1808 wrote to memory of 520	1808	msedge.exe	84
PID 1808 wrote to memory of 520	1808	msedge.exe	84
PID 1808 wrote to memory of 520	1808	msedge.exe	84
PID 1808 wrote to memory of 520	1808	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7f4eb02fe0c21d251dcbe4832c12a3e2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd92e046f8,0x7ffd92e04708,0x7ffd92e04718
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,14136856658118512657,15290179193176403192,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,14136856658118512657,15290179193176403192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,14136856658118512657,15290179193176403192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14136856658118512657,15290179193176403192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14136856658118512657,15290179193176403192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,14136856658118512657,15290179193176403192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,14136856658118512657,15290179193176403192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14136856658118512657,15290179193176403192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14136856658118512657,15290179193176403192,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14136856658118512657,15290179193176403192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14136856658118512657,15290179193176403192,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,14136856658118512657,15290179193176403192,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4752 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
613B

MD5
355eac310db8f73b6335b9e304063e54

SHA1
1635f1ac8f7a55acbf296dffbca87bf74d62c5ce

SHA256
c837cdae57586fa58f98a02521866cae87435e3c18594db5f1d5bc6dba767265

SHA512
835e6333e530f07a730755c74f82e7b6de02febe6b278b6e4f596b532315e85e3e73c7fd407e230d7362a0b8291720a264c6119c32ec4a3d8fccfce54e2f9710

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2a540a0da472d129784202daa6be31dc

SHA1
2bdb10f016ec7fab951cc3271c65af5282efd58c

SHA256
2242113b98b959a8f111b6e2ce4a828f1cd091f24730539dc624dbe8703ecb1a

SHA512
21cc1770306c27aef57470cd875f1a781467e2303278699e0967b2b1fc122a72a66b92ac1adeec17f7a0654cebf99c572ba9022befa40c2af4f8282784d5d0a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4e31c178ee1e0df07e374cc3cf6db8b3

SHA1
8c397346ab01e683a5d72e2a33e7874e4d4ecc88

SHA256
acfba310b25a44bc574f05dae4ced6e87dfb08588ef14dd416745234094a749c

SHA512
4c2416e915861d766beeb44757eed580316fce20ec73c4df5fa6482068bd74d7a500668dfb9d62c5d6dcea8841dcefb02160cfe5474086f1d8242582aa1694fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d0483d910e18e88756a666b3e0711e78

SHA1
0ca3ef59ff7555281abd0daf82bb0edb102c10db

SHA256
86a2def26469ed6ef2b3d1a390d57e0119c1362ac64d974cad3db6dcc308a11a

SHA512
a15cb26b0eb5a7b6c88f68f0269f4ad13981ec1c34ad93fff284bb6c88086df264368e1e828e1422b7a5dad4fa8f3c0f87152b3da8acf3bd2e0eb553788bcdde

Download Submit