0c1293cc106bde2e9224197ccb98536cf05f78ea0ea5b8ff07ce561b673ebf70

Analysis

max time kernel
145s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 03:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f6af1254b0c3038ce9472dff2291ead_JaffaCakes118.html
Size

286KB
MD5

7f6af1254b0c3038ce9472dff2291ead
SHA1

1a6e46224836eb9fb3a885ce7281cb2316fb2fbc
SHA256

0c1293cc106bde2e9224197ccb98536cf05f78ea0ea5b8ff07ce561b673ebf70
SHA512

5ee96700faf2ead9266919b9c04ad5bd93b321c1e18ca99b75af29f490126a07968be96c87fc522b1e33f0e178207acbc397fd734a9b62189dd743f446b558b9
SSDEEP

3072:SxSyfkMY+BES09JXAnyrZalI+Ydb34zKcyfkMY+BES09JXAnyrZalI+YQ:S9sMYod+X3oI+YdboCsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
4632	msedge.exe
4632	msedge.exe
5488	identity_helper.exe
5488	identity_helper.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 1124	4632	msedge.exe	83
PID 4632 wrote to memory of 1124	4632	msedge.exe	83
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 4932	4632	msedge.exe	84
PID 4632 wrote to memory of 3096	4632	msedge.exe	85
PID 4632 wrote to memory of 3096	4632	msedge.exe	85
PID 4632 wrote to memory of 1568	4632	msedge.exe	86
PID 4632 wrote to memory of 1568	4632	msedge.exe	86
PID 4632 wrote to memory of 1568	4632	msedge.exe	86
PID 4632 wrote to memory of 1568	4632	msedge.exe	86
PID 4632 wrote to memory of 1568	4632	msedge.exe	86
PID 4632 wrote to memory of 1568	4632	msedge.exe	86
PID 4632 wrote to memory of 1568	4632	msedge.exe	86
PID 4632 wrote to memory of 1568	4632	msedge.exe	86
PID 4632 wrote to memory of 1568	4632	msedge.exe	86
PID 4632 wrote to memory of 1568	4632	msedge.exe	86
PID 4632 wrote to memory of 1568	4632	msedge.exe	86
PID 4632 wrote to memory of 1568	4632	msedge.exe	86
PID 4632 wrote to memory of 1568	4632	msedge.exe	86
PID 4632 wrote to memory of 1568	4632	msedge.exe	86
PID 4632 wrote to memory of 1568	4632	msedge.exe	86
PID 4632 wrote to memory of 1568	4632	msedge.exe	86
PID 4632 wrote to memory of 1568	4632	msedge.exe	86
PID 4632 wrote to memory of 1568	4632	msedge.exe	86
PID 4632 wrote to memory of 1568	4632	msedge.exe	86
PID 4632 wrote to memory of 1568	4632	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7f6af1254b0c3038ce9472dff2291ead_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa12ce46f8,0x7ffa12ce4708,0x7ffa12ce4718
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,18304798014005226116,16419109945389847420,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,18304798014005226116,16419109945389847420,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,18304798014005226116,16419109945389847420,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,18304798014005226116,16419109945389847420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,18304798014005226116,16419109945389847420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,18304798014005226116,16419109945389847420,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,18304798014005226116,16419109945389847420,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,18304798014005226116,16419109945389847420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,18304798014005226116,16419109945389847420,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,18304798014005226116,16419109945389847420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,18304798014005226116,16419109945389847420,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,18304798014005226116,16419109945389847420,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4820 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2e24d25c7b6bf0ed7ba1ae38b080b57e

SHA1
d9bbf679f2b21b6f385b00dc6a8b3df1769c4417

SHA256
d3e133f6e207eaa30b7b48a69a82130f1a079ff0dc98bdb6b223d5f90ad8b9c8

SHA512
fba8a6fa6d85e098f9c08258cff019461b9b0b9ea5120fe5ab8cb0b1bbf4bce2fd23b257bb14fc76a6571d4c7d8d0a96c4d625edf8932e22f5c0ead5fb6c2f22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fb6a0390ba945d3ef3464143cc07afce

SHA1
15b19425dae1cd94a06cca0ce274138041ae0dc8

SHA256
a4d32751e2c9aed4e89ee898363c4d4acc548e774e328b7435c97b3c26e99405

SHA512
32647bc76dd87026feb41fb20d5aa33e414c75a70b53fb64702d5707971f624acc70f7474ffd72ee4d5e9f55e8f2f2c37d5c9f950d3c6077a21fffcef5c709af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f793a20286b7ae8044c953fdb3b928a7

SHA1
610dc06cd39cfc0315c6c6c3e47381e5c9ce7c26

SHA256
76c665fd362ca52e71241c03b0cd71f9fc1ae61ca64784df9a3ebb73aadcc851

SHA512
293453be09e3f950437f68bca6a837ac717a522a2dcd232226875aa3517c87955d84575163a70823b7842916d51112ed04b03a8bb3f0110fb9babe056e301fde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b3dbd332-5351-458a-8356-323412cc2f82.tmp

Filesize
11KB

MD5
efa4033b8055f24fecfade99f3933fcb

SHA1
9af38597058a8e080ce89f7e5ecba244665c588f

SHA256
01fd6a1b390640879dc1d1dc1b190fe58f17b79ff20a8ca9d8373f22a1b11634

SHA512
e814f8e0e33a24c5326d8ec405cff223603692894ad6e22ab52a03c53fe35c8df1e234e35a73789e3aaec0a138251215bbead030951596a06919d029e079cf00

Download Submit