85be0b7154aec76b554d8e5fd3a4919e60104a31b97ca38e959025b0900776ea

Analysis

max time kernel
106s
max time network
63s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 10:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b30cb754b2a2f18e3bfc1832738968dd_JaffaCakes118.html
Size

156KB
MD5

b30cb754b2a2f18e3bfc1832738968dd
SHA1

609c5494c63b2ebf20c884c0f1ffcc88adf691e1
SHA256

85be0b7154aec76b554d8e5fd3a4919e60104a31b97ca38e959025b0900776ea
SHA512

1d64a9fcd4624352693c2c256d08614b1099c701e2c317a447187a244a7093f479230016028848bda1c909a5ddf77f794ff049d678bdb7a3b23c95274f38a897
SSDEEP

3072:DFTSF3B2UP13G4k5QhLpOatVrPmz/fNbYaaLStR/ikNy3ZScxWUu/v66sbsGon4g:52N3G4k5QhL8atVefNbYaaLStR5MxWUY

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
1584	msedge.exe
1584	msedge.exe
2240	identity_helper.exe
2240	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 1664	1584	msedge.exe	82
PID 1584 wrote to memory of 1664	1584	msedge.exe	82
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 2348	1584	msedge.exe	83
PID 1584 wrote to memory of 4844	1584	msedge.exe	84
PID 1584 wrote to memory of 4844	1584	msedge.exe	84
PID 1584 wrote to memory of 852	1584	msedge.exe	85
PID 1584 wrote to memory of 852	1584	msedge.exe	85
PID 1584 wrote to memory of 852	1584	msedge.exe	85
PID 1584 wrote to memory of 852	1584	msedge.exe	85
PID 1584 wrote to memory of 852	1584	msedge.exe	85
PID 1584 wrote to memory of 852	1584	msedge.exe	85
PID 1584 wrote to memory of 852	1584	msedge.exe	85
PID 1584 wrote to memory of 852	1584	msedge.exe	85
PID 1584 wrote to memory of 852	1584	msedge.exe	85
PID 1584 wrote to memory of 852	1584	msedge.exe	85
PID 1584 wrote to memory of 852	1584	msedge.exe	85
PID 1584 wrote to memory of 852	1584	msedge.exe	85
PID 1584 wrote to memory of 852	1584	msedge.exe	85
PID 1584 wrote to memory of 852	1584	msedge.exe	85
PID 1584 wrote to memory of 852	1584	msedge.exe	85
PID 1584 wrote to memory of 852	1584	msedge.exe	85
PID 1584 wrote to memory of 852	1584	msedge.exe	85
PID 1584 wrote to memory of 852	1584	msedge.exe	85
PID 1584 wrote to memory of 852	1584	msedge.exe	85
PID 1584 wrote to memory of 852	1584	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b30cb754b2a2f18e3bfc1832738968dd_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed44d46f8,0x7ffed44d4708,0x7ffed44d4718
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,10414457956189281,10683284252130861727,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,10414457956189281,10683284252130861727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,10414457956189281,10683284252130861727,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10414457956189281,10683284252130861727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10414457956189281,10683284252130861727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,10414457956189281,10683284252130861727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,10414457956189281,10683284252130861727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10414457956189281,10683284252130861727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10414457956189281,10683284252130861727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10414457956189281,10683284252130861727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10414457956189281,10683284252130861727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10414457956189281,10683284252130861727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10414457956189281,10683284252130861727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:2732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
3b96b438537eb9d3276423d2ce43cb07

SHA1
8cd70fb76cd8cf07e39f19e926a0197775c4d8e5

SHA256
4c2f188529b4bce51a0630337506f52d665b13ad569f6b22e420aaf849946003

SHA512
73ebb7b669b88d606cceb1b8e37fb10a8b40ebd88975e983f2f89f041fb85ccc336dcd259bac94f29b7e24ef224d974ebe5ab8611da6cea78e0d32f63d71ed93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a27c4cbfc1ced2ed7d91d2cc18833fed

SHA1
e695d9e68fa75ce0699eb4e06d009de97b31cb3c

SHA256
d1dd792bcaa18ef3baf137251840a2233c42c842f0d1ba03c0889abdd5ef04fe

SHA512
446d676ae75dd7a82a818283d7aba88fe4c54c46166d629b1f7323ba17e89a4a53f9b6c5ff604c827a54efe9876c2bf9dbdafdf3169d8f9fdcffec6178c94924

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
90122e4c802529481cc08dd08d355144

SHA1
d03d106ab2f747ffa0fbb7f4e0598a09039da195

SHA256
33a726fd5938a82e70bb4f0c3f8bec5ee354c6b9532005c49994b404bf031b99

SHA512
d455852fac782901394203c99c478f57f7cddb8ffe8acd858e0a259fe168c9e4d8ded956f33af2fd59759ecd58d83504f539ef5f2d2a90cbab0256401eebc9e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
b4f9eca09f108d890684677f3dff605f

SHA1
71a69c62935a26642260fb4953f0961aee217441

SHA256
71544ccfc1993aff05aeddebfd9d816c88be8a235ecaa14d96e2e5f9c6152001

SHA512
af146525d90121268a9ac59a7df400bf219c66c03ca4a203cffc6f4583f1cb4c40fff2de626c2b04b237530dbad2768c4b08f3e6b8d87d571c819ef7891690c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
a6569b6c9cd9abedbc724c750da4ab0f

SHA1
3aa4b5678dab93065348e7cf0d96041dc373cc64

SHA256
7c654c18a1e62b8085f79efbc7c03608d0a90b2283a013d722fe227063a623be

SHA512
72adba4ff8a967d485596d4c5318327b6799bb1ace5c7a018fd0f42227a148ea418d326b2f25110c8566d8a7918a85564077a6853724a84d7ee29befcb16e05f

Download Submit