51cbcf5dfedb291122f0faea0bbfd9a4213bbd5934c1384bc8abce04e2f44d16

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 19:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

880a532e5e23ef2c9fe94e0149b026ac_JaffaCakes118.html
Size

101KB
MD5

880a532e5e23ef2c9fe94e0149b026ac
SHA1

70bf1dbd1525f5b4003b842cdcaa37f05af41e31
SHA256

51cbcf5dfedb291122f0faea0bbfd9a4213bbd5934c1384bc8abce04e2f44d16
SHA512

0b234dfc1e72c02d5521ebe3c75775de2b7597e0f687d95dd1732b95c46a078b12b216ffab92cfcdf7c62a37a88cff76db87277734e2ba6168e61b2e1f22d494
SSDEEP

3072:l3kXzB4armwQULt+qR8poQItytVJBp8o+Xg9eUQtWuuYRCZGj5oT/QiJhKtbKhub:IzB4armwQULt+c8poQItytV3pJ+Xg9eF

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3084	msedge.exe
3084	msedge.exe
1796	msedge.exe
1796	msedge.exe
3600	identity_helper.exe
3600	identity_helper.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe
1796	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 372	1796	msedge.exe	83
PID 1796 wrote to memory of 372	1796	msedge.exe	83
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 2012	1796	msedge.exe	84
PID 1796 wrote to memory of 3084	1796	msedge.exe	85
PID 1796 wrote to memory of 3084	1796	msedge.exe	85
PID 1796 wrote to memory of 884	1796	msedge.exe	86
PID 1796 wrote to memory of 884	1796	msedge.exe	86
PID 1796 wrote to memory of 884	1796	msedge.exe	86
PID 1796 wrote to memory of 884	1796	msedge.exe	86
PID 1796 wrote to memory of 884	1796	msedge.exe	86
PID 1796 wrote to memory of 884	1796	msedge.exe	86
PID 1796 wrote to memory of 884	1796	msedge.exe	86
PID 1796 wrote to memory of 884	1796	msedge.exe	86
PID 1796 wrote to memory of 884	1796	msedge.exe	86
PID 1796 wrote to memory of 884	1796	msedge.exe	86
PID 1796 wrote to memory of 884	1796	msedge.exe	86
PID 1796 wrote to memory of 884	1796	msedge.exe	86
PID 1796 wrote to memory of 884	1796	msedge.exe	86
PID 1796 wrote to memory of 884	1796	msedge.exe	86
PID 1796 wrote to memory of 884	1796	msedge.exe	86
PID 1796 wrote to memory of 884	1796	msedge.exe	86
PID 1796 wrote to memory of 884	1796	msedge.exe	86
PID 1796 wrote to memory of 884	1796	msedge.exe	86
PID 1796 wrote to memory of 884	1796	msedge.exe	86
PID 1796 wrote to memory of 884	1796	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\880a532e5e23ef2c9fe94e0149b026ac_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa05d646f8,0x7ffa05d64708,0x7ffa05d64718
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,10641589652923028966,1448679792288450209,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,10641589652923028966,1448679792288450209,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,10641589652923028966,1448679792288450209,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,10641589652923028966,1448679792288450209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,10641589652923028966,1448679792288450209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,10641589652923028966,1448679792288450209,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,10641589652923028966,1448679792288450209,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,10641589652923028966,1448679792288450209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,10641589652923028966,1448679792288450209,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,10641589652923028966,1448679792288450209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,10641589652923028966,1448679792288450209,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,10641589652923028966,1448679792288450209,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
971B

MD5
bcfaf7f6add91806ff50cf65151136e6

SHA1
3efa3c55a5d7d8e79948586ce2f157aaea3bf28b

SHA256
dd4b8925c28a78c627d3e6e251fd37380201de9fea3c1eb08b9c466256088007

SHA512
0cc3954aa2ace883cd644a7a4da061808bcdf9583ac26a3bd98d31ada6fde891336c189c08b00ece6e21314f20171d6c5cff9407353c9e8c2d5f628a67f32b56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
89086041524784561232a0a4f1b8de7f

SHA1
840179d3aabd92faa38f24c8a33d01e54eaa5dfd

SHA256
062eaa63dac25c5d030cf74dfc163617f6dd565a5a1e1bea4787f32b2d6efddc

SHA512
4616b7807a41ed0e8456c71540e005838b46590f11c1c82b8a8a2eb4b8098461886b150e4f5a1538935bb9481da77684324e0507c8e206c1ab6e642c844b3694

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
978e2a1b2c627dbd62b2d5cca6980526

SHA1
3e953157d1d9409a75b5de493025081afdd854df

SHA256
f1a42927b19467ecde088eb3392eb5e2517cf2e51d96e40e7576f7cfe5b3913f

SHA512
677d53d389224d0ba1256728d458cd559ed801e506eca04da71d2d478f7a78defa8aa9f25b2d32b72539e088fe82c635c18ab0f9a84d58bf402797a6bd971be7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d7f17b9346567cea4b6b47fb5a7c9fc3

SHA1
8f8e4de10b39400843614f471e55af6c38892f0e

SHA256
3e9e3d96dd28d283ef13d7951846ee67abda64bb0e5be37876981cf50847af84

SHA512
1dd91962682065f175d660d38e13de321d72f7b617721e7f0327c895868034a17dad6c678332d7f6a238bda718f46da1d3382e27d3a7796b9d89feab0ca1cf32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
3fa97d47cc5e9c5d7d0e5dba6b22f1c7

SHA1
652c3d3f7db95f9235546c8018c1f003979afa3f

SHA256
a5b95c430900d1a6fb32cf93d14d3f31eaaa5e2c8608d1e67eccbe6c080e7d95

SHA512
3823d5e0fda098b7afa08238fe49c561e07d1666b45f18e64ef02528306aeb85162b7700b15fe7087a43521ca0e21e9c162fea035688c4e62eb5820113ed6f1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d8eb.TMP

Filesize
203B

MD5
404d7ca0aa185238936f23b32f10cc58

SHA1
0d33f290bf425297c09d597393a5e0467cf026d8

SHA256
727b33a2457694211dfeb6eabf663c9a62d09134d4b57ed3e710b0f780fd216e

SHA512
8678f79c9913efa15b2f8618852b4fb8fbd30a1aa9308bf854bb37db5bd3632656cb815bdba64ebb9955e17d21d568886a515a1edf572cf6fea3305c7da1bef5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8de5573d92e2220c28c27c497f005230

SHA1
89eaab11cc0d17b342a9b957b2e8563c44cf5c41

SHA256
d33264e2075301ad98f8c3b7fa98ba8015b69cd34774a5ccf6fbb75e2f2341b1

SHA512
769273968632e7a21ab5e4dbf8a7a2aac9ecda7d33193134844895c2baa9153d82766c0dcb9d8105fd321d87dd68b83b8d1657bbbd55dae5394dbd64f51472fd

Download Submit