9d75c31aaa884a265f3922e394b5e79de242e442a7ed5853cf031c4d8f3a5770

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 12:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80b19f56b1fe0f42749e5a387727a8dd_JaffaCakes118.html
Size

42KB
MD5

80b19f56b1fe0f42749e5a387727a8dd
SHA1

74db331c533491504c5bb20e2c6325cf3acb59d9
SHA256

9d75c31aaa884a265f3922e394b5e79de242e442a7ed5853cf031c4d8f3a5770
SHA512

c32f4eed07eb24fac12590b96449ec06b15424483ad4ae253853053a65d37fe4acf4ea3ffe090254db0ca6ebbd10d3d7d3e6dc92244b0085a547fc421306418a
SSDEEP

768:Tm4m/mdmcmDmjmZmFmIm3mSmBQ1XmHd1Mmkmom7mAmpmUmjmUmrmLmjm6mJpX:TxQSjucEMXubcQ1Xed1MbFe/Ujkt0co4

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2536	msedge.exe
2536	msedge.exe
4200	msedge.exe
4200	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4200	msedge.exe
4200	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 900	4200	msedge.exe	85
PID 4200 wrote to memory of 900	4200	msedge.exe	85
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2140	4200	msedge.exe	86
PID 4200 wrote to memory of 2536	4200	msedge.exe	87
PID 4200 wrote to memory of 2536	4200	msedge.exe	87
PID 4200 wrote to memory of 4372	4200	msedge.exe	88
PID 4200 wrote to memory of 4372	4200	msedge.exe	88
PID 4200 wrote to memory of 4372	4200	msedge.exe	88
PID 4200 wrote to memory of 4372	4200	msedge.exe	88
PID 4200 wrote to memory of 4372	4200	msedge.exe	88
PID 4200 wrote to memory of 4372	4200	msedge.exe	88
PID 4200 wrote to memory of 4372	4200	msedge.exe	88
PID 4200 wrote to memory of 4372	4200	msedge.exe	88
PID 4200 wrote to memory of 4372	4200	msedge.exe	88
PID 4200 wrote to memory of 4372	4200	msedge.exe	88
PID 4200 wrote to memory of 4372	4200	msedge.exe	88
PID 4200 wrote to memory of 4372	4200	msedge.exe	88
PID 4200 wrote to memory of 4372	4200	msedge.exe	88
PID 4200 wrote to memory of 4372	4200	msedge.exe	88
PID 4200 wrote to memory of 4372	4200	msedge.exe	88
PID 4200 wrote to memory of 4372	4200	msedge.exe	88
PID 4200 wrote to memory of 4372	4200	msedge.exe	88
PID 4200 wrote to memory of 4372	4200	msedge.exe	88
PID 4200 wrote to memory of 4372	4200	msedge.exe	88
PID 4200 wrote to memory of 4372	4200	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\80b19f56b1fe0f42749e5a387727a8dd_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff76e346f8,0x7fff76e34708,0x7fff76e34718
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,9310346762646589585,13862173641767033940,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,9310346762646589585,13862173641767033940,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,9310346762646589585,13862173641767033940,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9310346762646589585,13862173641767033940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9310346762646589585,13862173641767033940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,9310346762646589585,13862173641767033940,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,9310346762646589585,13862173641767033940,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1996 /prefetch:8
  2⤵
  PID:1500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6319c5da5f6c20cd1bfa6736cd59c1d8

SHA1
9d58aaa4153df4f3d9ddc8f1a369e1eaeb8fa628

SHA256
48b488628ba2fbeb9206f7ecc84f19d0bfd3510060d9f68c6041ad5c529e219b

SHA512
83ae7e4724b17dff3578f790df6174d752cfe17285d6603936727b85ba3ae3677904cb722ec52cbd1239aadf7a5ebe1d81420bbf46b28b97a47b601ae71e71c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ff9274125065df9eca3d530ff46c7992

SHA1
e5252da5a5f1736b6dace16cf886d67901ca3695

SHA256
6ab752dc423c441deba30241553230d32ab74c1661f6d83e3bf69a7b7ec7e378

SHA512
f5b89e9fdf1425acd26e3cdeda3bd7733f45f1c0487fbd36dbffe88e66e4b3995f1ab07e1becf44ea1badf3b47488e0f1799e886365cf5af09143e1bd8d2bdad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6d667b381ea9c4e6331a5c29c5e72283

SHA1
6e65e61e200f8005e3c057485a9bdbfa41361be2

SHA256
84c9f2ef323672b698839a1a7882a55d91d8cb0a73884c79ed9e0d0c38677c4f

SHA512
1eb33ec404de42ad6bef425bb693d8e7a890ee126b3da39a1afa17cc4458c4fd8851e29a173fb65c58b052a52abc443473221ca209ab5d38acc33c3eae407d5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fdf044c42fd4b7c327d58a3253b5821b

SHA1
8a99fbe8f425e5127875bc0204872eee11f26e89

SHA256
d38b5d3bfca9a92d8506f74fcefa75fa176c6019483901a093af6a5fec07759c

SHA512
4988333d438e6ec481ea0a77ee981f33a6388f505f191915d314dc76e91d0e278afc66811f4d2315af4e231ffc474e3fecded1aa4ea86b01b60997c94cf803b6

Download Submit