a5cd0eeebf1326506bcdc146e4bc9e51c92b2bf581542a5efd22000f71861d59

Analysis

max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 12:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1601e94964c0524470d35e084e53d836_JaffaCakes118.html
Size

1KB
MD5

1601e94964c0524470d35e084e53d836
SHA1

c212918fd1cae7caad76f392d7d7b8ff3f2e2cc4
SHA256

a5cd0eeebf1326506bcdc146e4bc9e51c92b2bf581542a5efd22000f71861d59
SHA512

99b3e1e5212c1eda44e23679ff31b367f6a5f81c2a8d9ee5561044a9b75e3a4cdf6dc28ff12969063bfd991252e3307b5cc1686bbf0087627a1886d28df8b188

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3492	msedge.exe
3492	msedge.exe
3448	msedge.exe
3448	msedge.exe
2412	identity_helper.exe
2412	identity_helper.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 5088	3448	msedge.exe	85
PID 3448 wrote to memory of 5088	3448	msedge.exe	85
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 1144	3448	msedge.exe	86
PID 3448 wrote to memory of 3492	3448	msedge.exe	87
PID 3448 wrote to memory of 3492	3448	msedge.exe	87
PID 3448 wrote to memory of 2904	3448	msedge.exe	88
PID 3448 wrote to memory of 2904	3448	msedge.exe	88
PID 3448 wrote to memory of 2904	3448	msedge.exe	88
PID 3448 wrote to memory of 2904	3448	msedge.exe	88
PID 3448 wrote to memory of 2904	3448	msedge.exe	88
PID 3448 wrote to memory of 2904	3448	msedge.exe	88
PID 3448 wrote to memory of 2904	3448	msedge.exe	88
PID 3448 wrote to memory of 2904	3448	msedge.exe	88
PID 3448 wrote to memory of 2904	3448	msedge.exe	88
PID 3448 wrote to memory of 2904	3448	msedge.exe	88
PID 3448 wrote to memory of 2904	3448	msedge.exe	88
PID 3448 wrote to memory of 2904	3448	msedge.exe	88
PID 3448 wrote to memory of 2904	3448	msedge.exe	88
PID 3448 wrote to memory of 2904	3448	msedge.exe	88
PID 3448 wrote to memory of 2904	3448	msedge.exe	88
PID 3448 wrote to memory of 2904	3448	msedge.exe	88
PID 3448 wrote to memory of 2904	3448	msedge.exe	88
PID 3448 wrote to memory of 2904	3448	msedge.exe	88
PID 3448 wrote to memory of 2904	3448	msedge.exe	88
PID 3448 wrote to memory of 2904	3448	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1601e94964c0524470d35e084e53d836_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd892246f8,0x7ffd89224708,0x7ffd89224718
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,3798907543619912151,15507731155897083873,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,3798907543619912151,15507731155897083873,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2636 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,3798907543619912151,15507731155897083873,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3798907543619912151,15507731155897083873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3798907543619912151,15507731155897083873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3798907543619912151,15507731155897083873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,3798907543619912151,15507731155897083873,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,3798907543619912151,15507731155897083873,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3798907543619912151,15507731155897083873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3798907543619912151,15507731155897083873,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3798907543619912151,15507731155897083873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3798907543619912151,15507731155897083873,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,3798907543619912151,15507731155897083873,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5348 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
257c0005d0c4d0bb282cb470925e4376

SHA1
f9b8efb511ed64292568977c9f2ec255509e8f7d

SHA256
8185c36aaacfc71e42f94fad8e198fe7fb2d868398ceabb89261cae94341cb22

SHA512
2f3e8f352ed3ef88e8c28650390f93f98c92174d268330b886f3ebd1ba0163999051298ee12a054606b4986005452a241c6864cd292e69492d79c37d500556f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4819fbc4513c82d92618f50a379ee232

SHA1
ab618827ff269655283bf771fc957c8798ab51ee

SHA256
05e479e8ec96b7505e01e5ec757ccfe35cb73cd46b27ff4746dce90d43d9237c

SHA512
bc24fb972d04b55505101300e268f91b11e5833f1a18e925b5ded7e758b5e3e08bee1aa8f3a0b65514d6df981d0cbfa8798344db7f2a3675307df8de12ae475b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
980807eb0d8e7065a0a4cd1093fe8dd0

SHA1
e890ea3d03eafb0605b6e4ec9b384fe9fe435509

SHA256
990de8005a25676b7dc251fc850ad4a064f348d1dcc331d009c75bce5eb40df4

SHA512
5a7e639318c6c7e9a9c2007152e34860bd4b2fb0f4ac135f5e19c15ccf6efaaf0899f2e03ad9abd652cb4829b6c5fac938ba03850e679168ab6f7641e605d968

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e7b78e1aec17f8bab1223c8ee3830eb9

SHA1
413cd48ac73556fd64f40648cc2b6451fd35a488

SHA256
0066be790e92cddec1c5e2adf38171ca404d5cb6d10eac7f6b92e301e7714423

SHA512
00a618184ff2566ac73a2129643b098015a795bfab719e07ee029af38e70c683be09d890fc6f73efbd307e27e5403cd20c60bd669a753d048c10e18603cc3114

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
95cd1581c30a5c26f698a8210bcab430

SHA1
5e8e551a47dd682ec51a7d6808fe8e0f2af39e86

SHA256
d58162c5ae5e18fc06604c285e024c01686093d70994dc93b4ae9d85b4c3f7b9

SHA512
e49403df10177053634c431203a91d26df5dfb23cbbb88847459ecdf4b6107040d0944a3e84ee6bb26cb4e8017a35c8c31b658387cd1b6938ba4cb9f59606ece

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
37f9fab0e642661d983b9a1bbcb8cba7

SHA1
5075796165a485701cd08281b512563987523a30

SHA256
5b8d2af9ff5a0276f4e3f8fd0160bb18feb1902412f5f7ab8f2e8f43621a223c

SHA512
35715f16f2e8b61730efffd28ad7dd4c2284eeec6cf6233c9b14abfa7211dc694631f903a2e70c4039f14c6ae3d898c029442f00e2a41388e90e40e380cb92ab

Download Submit