7c7ef60f0e8fef533edb5c1f2f0a0e6308a5ab87dc4746fca7c35756b3259535

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 12:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91d7a74fb8937b86818c869277667652_JaffaCakes118.html
Size

19KB
MD5

91d7a74fb8937b86818c869277667652
SHA1

9fe0fe551080b2dfc4e2cbff8edee7c187a22224
SHA256

7c7ef60f0e8fef533edb5c1f2f0a0e6308a5ab87dc4746fca7c35756b3259535
SHA512

98f3c45d59dd211996d59be9c5671b2abc410ff8c2c28cbf060bafba2f5cd30bfdfd74e7782ae70d9d06355a22be7ce8557606dbad89bad5289839a9cd3f9e15
SSDEEP

192:SIM3tHBABQBSBZBWrI5fo9cOQivXQWxZxdkVSoAIl4pzUnjBh7t82qDB8:SIMdNI5nO9Hlsv7WxDB8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2900	msedge.exe
2900	msedge.exe
4136	msedge.exe
4136	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 2028	4136	msedge.exe	82
PID 4136 wrote to memory of 2028	4136	msedge.exe	82
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2120	4136	msedge.exe	83
PID 4136 wrote to memory of 2900	4136	msedge.exe	84
PID 4136 wrote to memory of 2900	4136	msedge.exe	84
PID 4136 wrote to memory of 4436	4136	msedge.exe	85
PID 4136 wrote to memory of 4436	4136	msedge.exe	85
PID 4136 wrote to memory of 4436	4136	msedge.exe	85
PID 4136 wrote to memory of 4436	4136	msedge.exe	85
PID 4136 wrote to memory of 4436	4136	msedge.exe	85
PID 4136 wrote to memory of 4436	4136	msedge.exe	85
PID 4136 wrote to memory of 4436	4136	msedge.exe	85
PID 4136 wrote to memory of 4436	4136	msedge.exe	85
PID 4136 wrote to memory of 4436	4136	msedge.exe	85
PID 4136 wrote to memory of 4436	4136	msedge.exe	85
PID 4136 wrote to memory of 4436	4136	msedge.exe	85
PID 4136 wrote to memory of 4436	4136	msedge.exe	85
PID 4136 wrote to memory of 4436	4136	msedge.exe	85
PID 4136 wrote to memory of 4436	4136	msedge.exe	85
PID 4136 wrote to memory of 4436	4136	msedge.exe	85
PID 4136 wrote to memory of 4436	4136	msedge.exe	85
PID 4136 wrote to memory of 4436	4136	msedge.exe	85
PID 4136 wrote to memory of 4436	4136	msedge.exe	85
PID 4136 wrote to memory of 4436	4136	msedge.exe	85
PID 4136 wrote to memory of 4436	4136	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91d7a74fb8937b86818c869277667652_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a1dd46f8,0x7ff9a1dd4708,0x7ff9a1dd4718
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,15913533034076053399,15192849554209439898,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,15913533034076053399,15192849554209439898,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,15913533034076053399,15192849554209439898,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15913533034076053399,15192849554209439898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15913533034076053399,15192849554209439898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,15913533034076053399,15192849554209439898,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6a920220aecd78c665750700e10db2b7

SHA1
682db482378c3349020e98b34e12623e75bb21a1

SHA256
f79b980836b03da345ea2a5f1973c462ed3e625f778bbb29a983ec33cb9f5eb7

SHA512
704eeda146cbf225f2baddb5276685ba300adf38e1e441a937e4391dba2e7cef6a9846f41ce244d4cbaeea10d2a5b1eb8d8339845f56cf33c86124c26a2c0b4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7d8bb635a57e6370b6c3707d37100b5e

SHA1
5c27e679544843f0d6072d418c149e7643712fe7

SHA256
173adbfd172bd694d30215c93ac39a0865956c91ce7a86593756a3b1c9c55d84

SHA512
fcc494e211d465c4df752452715d0a1c36ec20e9dfc5b469f748fbf08f9caf3f627b74ff1ca3c59d56c6144b8e5fefced1d6e9d9378226f6a5a22e920c80a069

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d544a26359b3030d72588fe30cb82cea

SHA1
8fcc4c97936246c6fa70c4746318e01d8be64e3c

SHA256
e59aed09c233515933aa54eea85d2ee995e8ff21f98a5f3e60302854c5de98eb

SHA512
ef5e3b860605421ddb50a25f5abc1e04f291629f235f8f9febbbd8ca5616151c9d5dcb9625931d877102a5b7b544d84956051594c38b547493d6bd39002daea5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
da37544f452436abd56e32ca65863431

SHA1
16f570069a89a8ef3dc80dcf9b069f3863ef3acc

SHA256
2b45be48ad8bd07531959d13a86f8f3874761be2bac56b8164f7125022c53f14

SHA512
15670425b0e04ca7dbd6158faf6a2962dbb57d86c108e5b2f418ed17f63653b939352014f9e43aa94cde3e64a8a428f4ee7b643cd766d250f4ea38db304babc1

Download Submit