5b627a5709a39b7bac2246175e25dae41b8a7b504423859e181122ec06c32c13

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 07:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

90f6fc53f77acbeaae15888e77cb711b_JaffaCakes118.html
Size

14KB
MD5

90f6fc53f77acbeaae15888e77cb711b
SHA1

05d78eb3cd74c43d7ff2a593d4485d2c8f3a3c3f
SHA256

5b627a5709a39b7bac2246175e25dae41b8a7b504423859e181122ec06c32c13
SHA512

1705e4e3ec0986ebdc45183e18e71ae9bd26a25bf7bfe4f0d4640ccc25ccd57bb82cb56b49fc7626f900df3afc5e2c2854c96d93a81012df3fe700b8426a5a7d
SSDEEP

192:SZ61Y/0InkdHdQsQVbgULG0iiuo7YXj8NvZJvdVCFpUvIRNDuv:SgvIVii57YXjYFkFSvIRND8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3272	msedge.exe
3272	msedge.exe
940	msedge.exe
940	msedge.exe
324	identity_helper.exe
324	identity_helper.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 4456	940	msedge.exe	83
PID 940 wrote to memory of 4456	940	msedge.exe	83
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 4248	940	msedge.exe	84
PID 940 wrote to memory of 3272	940	msedge.exe	85
PID 940 wrote to memory of 3272	940	msedge.exe	85
PID 940 wrote to memory of 3104	940	msedge.exe	86
PID 940 wrote to memory of 3104	940	msedge.exe	86
PID 940 wrote to memory of 3104	940	msedge.exe	86
PID 940 wrote to memory of 3104	940	msedge.exe	86
PID 940 wrote to memory of 3104	940	msedge.exe	86
PID 940 wrote to memory of 3104	940	msedge.exe	86
PID 940 wrote to memory of 3104	940	msedge.exe	86
PID 940 wrote to memory of 3104	940	msedge.exe	86
PID 940 wrote to memory of 3104	940	msedge.exe	86
PID 940 wrote to memory of 3104	940	msedge.exe	86
PID 940 wrote to memory of 3104	940	msedge.exe	86
PID 940 wrote to memory of 3104	940	msedge.exe	86
PID 940 wrote to memory of 3104	940	msedge.exe	86
PID 940 wrote to memory of 3104	940	msedge.exe	86
PID 940 wrote to memory of 3104	940	msedge.exe	86
PID 940 wrote to memory of 3104	940	msedge.exe	86
PID 940 wrote to memory of 3104	940	msedge.exe	86
PID 940 wrote to memory of 3104	940	msedge.exe	86
PID 940 wrote to memory of 3104	940	msedge.exe	86
PID 940 wrote to memory of 3104	940	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\90f6fc53f77acbeaae15888e77cb711b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea6ed46f8,0x7ffea6ed4708,0x7ffea6ed4718
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,15930391593694254761,3123853759361588281,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,15930391593694254761,3123853759361588281,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,15930391593694254761,3123853759361588281,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15930391593694254761,3123853759361588281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15930391593694254761,3123853759361588281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,15930391593694254761,3123853759361588281,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,15930391593694254761,3123853759361588281,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15930391593694254761,3123853759361588281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15930391593694254761,3123853759361588281,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15930391593694254761,3123853759361588281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15930391593694254761,3123853759361588281,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,15930391593694254761,3123853759361588281,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4696 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
193B

MD5
d4d6c603aa797eac0f0bbc32242de972

SHA1
51ab2bd1961649d6b0d83391e60227be196d1d96

SHA256
96a20090b5b90faeaac4ebfa4caec106eb29c171cf7523bbd14a9d6b0dc223d0

SHA512
4ea98eddf4400399b7f81700085e554c9c4266f5f89843b8af8c41a8cc61d8ead50106247b1db770d8799e8b57fd842e3cb058c56c47766808cf74b4843144bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2eded28a63a64495317d84f54bfc7e53

SHA1
7bac82b8f4827707bb209e093b64aec755832a1c

SHA256
51dba7199c3cda0551a0ab534c27350c99b319d22d14852a1e293ca280fd37fe

SHA512
897610226eff690da5485fc4b771f709b2373057cbcf58317697232c47f1841fec516021430a3d584c893d9caf7955c60b36a0097c6e3dd333657923a117d724

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7f8df10a381595685dbebfa443835ac6

SHA1
ee1c5b98a6357361501168ab585e94a2cbe58df5

SHA256
c200124a4b5805267c5abed2d55a0dac3f7dc71331e4a49fae32516f1eb0f669

SHA512
3f1a974f90a5a494354ca44757f99d210348f488e56d66fcff76a74b082a157f5d0ed1c789f0c15b7e7a5806cbae9665a9f521ce84aa3d71da4187f86c0a32a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9dc71b17a7e905cd734076e86f719ebc

SHA1
6d5a30d860c9305140ddb6a23bbaf1dab58e0395

SHA256
b262647118722778da4bf5722e1a7e5010057b0383dd505bdbe1a608c139d8ed

SHA512
d95f216619e496b5fe25c22d1c014215c3c018aef1b8334f2fa5ff2c665df39d4b463784192ab0645db8551494769679d3bcdac0e5bd27dc67c6de9c8c5836a1

Download Submit