323dd907bbec0979569607ec77b054c821a400ffac700bf8931d18e2de3d166c

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 07:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7fffdd1adf6d8d96872af8c1948d50f2_JaffaCakes118.html
Size

57KB
MD5

7fffdd1adf6d8d96872af8c1948d50f2
SHA1

7877dd08726f4fc0dbef6036922837d60dd68dcd
SHA256

323dd907bbec0979569607ec77b054c821a400ffac700bf8931d18e2de3d166c
SHA512

c03eb5b2b90304b958a176ac6c4f6288d24eec998ccce10eaf5e0865d2ef44e3d5eb90971397697c3e036e58f3ad9214de00ac6d67a11969a6836d1d20eea5a3
SSDEEP

1536:U0i6BHm0bVB/zmw3+MeWxFuYD/9w7/fWOtNJ/QofZQ6hg+kcqNtnY73+g6q3UZM0:U0i6BLB/zm9MeWxFuYr9w7DtG78U2uNh

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
5092	msedge.exe
5092	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 1892	5092	msedge.exe	82
PID 5092 wrote to memory of 1892	5092	msedge.exe	82
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4740	5092	msedge.exe	83
PID 5092 wrote to memory of 4572	5092	msedge.exe	84
PID 5092 wrote to memory of 4572	5092	msedge.exe	84
PID 5092 wrote to memory of 1388	5092	msedge.exe	85
PID 5092 wrote to memory of 1388	5092	msedge.exe	85
PID 5092 wrote to memory of 1388	5092	msedge.exe	85
PID 5092 wrote to memory of 1388	5092	msedge.exe	85
PID 5092 wrote to memory of 1388	5092	msedge.exe	85
PID 5092 wrote to memory of 1388	5092	msedge.exe	85
PID 5092 wrote to memory of 1388	5092	msedge.exe	85
PID 5092 wrote to memory of 1388	5092	msedge.exe	85
PID 5092 wrote to memory of 1388	5092	msedge.exe	85
PID 5092 wrote to memory of 1388	5092	msedge.exe	85
PID 5092 wrote to memory of 1388	5092	msedge.exe	85
PID 5092 wrote to memory of 1388	5092	msedge.exe	85
PID 5092 wrote to memory of 1388	5092	msedge.exe	85
PID 5092 wrote to memory of 1388	5092	msedge.exe	85
PID 5092 wrote to memory of 1388	5092	msedge.exe	85
PID 5092 wrote to memory of 1388	5092	msedge.exe	85
PID 5092 wrote to memory of 1388	5092	msedge.exe	85
PID 5092 wrote to memory of 1388	5092	msedge.exe	85
PID 5092 wrote to memory of 1388	5092	msedge.exe	85
PID 5092 wrote to memory of 1388	5092	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7fffdd1adf6d8d96872af8c1948d50f2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb6a6b46f8,0x7ffb6a6b4708,0x7ffb6a6b4718
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,15801066305037562559,13160702553256376419,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,15801066305037562559,13160702553256376419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,15801066305037562559,13160702553256376419,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2976 /prefetch:8
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15801066305037562559,13160702553256376419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15801066305037562559,13160702553256376419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,15801066305037562559,13160702553256376419,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5200 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0ecfcbf1-e118-4f13-8dd8-49e909feb4f1.tmp

Filesize
10KB

MD5
6968e326deb3edf87ba6a3e9d855bdc1

SHA1
52f1c080d6d9fdfed2ba55078aef00987ef6ff18

SHA256
4c666deeada6ffb1f37a080e448315922d13e6bcfc23672ed49f94ad7773f1c9

SHA512
9fdb23e6524c3e487186fc9b30a630d3b3b659b17ce508f0a32a61fab43262ef93a7b0bc9087eb90a0fa41db5c8876d38122b82073a2e0bedd67dcb61e9c703d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3d722e9096a576f653fb2fd70860550e

SHA1
5c4f9ee7f16d95a2cbb12b36fbf084c7143d9b80

SHA256
cb5debcbcd6e159b0ed68821837eeb26324ebeba9fc383639356650a17044c0f

SHA512
24cc4767bdd0505667eb73422f5aabc17b68f6abd29fce129d9ae0773c4fce9779e19cd8f064e5dde26049864da932042807cb0224a4e1c28a74828708514dd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1dad84f6b972cfb065367f02207858c9

SHA1
4cbb288f9cdddaaa41a9e8f83bb86a712e48b558

SHA256
61e1e1dd2642128f4033955e2ad6c3f628c8e797fbf6e8e1dae05a827bb646d5

SHA512
bf831001968c09e548af70d635c0b3a87c7d6e4daf1d11f1fe7b179c5de45b5dac4bbae8b6d57a023fa7aaf457c487ebb6ed26c661e886091ffceca6df1d986d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
46f605b2ad3147a28d35a6d2c444c1e0

SHA1
971837c19112cb535cc96d3fa603f3a49daea91e

SHA256
1295193295a3023078adb40b57298dcb2c35c761b58b4f30b182187f91679253

SHA512
576fdff1b3bad1e2f0ce8e98b49191cbd3d2176e729a45e813ec1b60710893706c0632c85aa397f598dd3a738a18959d0d80faf4daa3574f1e7d12d8eec16664

Download Submit