d899809c1c836cbdd46822f5d32e3f2ca4311a515807baa519e82df3b427bf83

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 09:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc67b9446ea864f3041649c93f630b01_JaffaCakes118.html
Size

122KB
MD5

fc67b9446ea864f3041649c93f630b01
SHA1

26f1402b96d64c7dc6d77374401d5abce55d8d6c
SHA256

d899809c1c836cbdd46822f5d32e3f2ca4311a515807baa519e82df3b427bf83
SHA512

b7cad29ea4dfb34665f864e62f49aa8df41778e0a2e4dd3dd68be6308215c094f12b14a067cd54551ff5c8e9cbfa99bd71f1ac7e21e58230bb791c8b6886f6e9
SSDEEP

1536:0/GQkkXrQI7W9WDSFZxIw3ietHE2xYUjOBDC1p4rrGqqadVu:DmXcO6j1xH8rrrM

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3220	msedge.exe
3220	msedge.exe
716	msedge.exe
716	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 872	716	msedge.exe	84
PID 716 wrote to memory of 872	716	msedge.exe	84
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 4408	716	msedge.exe	85
PID 716 wrote to memory of 3220	716	msedge.exe	86
PID 716 wrote to memory of 3220	716	msedge.exe	86
PID 716 wrote to memory of 4580	716	msedge.exe	87
PID 716 wrote to memory of 4580	716	msedge.exe	87
PID 716 wrote to memory of 4580	716	msedge.exe	87
PID 716 wrote to memory of 4580	716	msedge.exe	87
PID 716 wrote to memory of 4580	716	msedge.exe	87
PID 716 wrote to memory of 4580	716	msedge.exe	87
PID 716 wrote to memory of 4580	716	msedge.exe	87
PID 716 wrote to memory of 4580	716	msedge.exe	87
PID 716 wrote to memory of 4580	716	msedge.exe	87
PID 716 wrote to memory of 4580	716	msedge.exe	87
PID 716 wrote to memory of 4580	716	msedge.exe	87
PID 716 wrote to memory of 4580	716	msedge.exe	87
PID 716 wrote to memory of 4580	716	msedge.exe	87
PID 716 wrote to memory of 4580	716	msedge.exe	87
PID 716 wrote to memory of 4580	716	msedge.exe	87
PID 716 wrote to memory of 4580	716	msedge.exe	87
PID 716 wrote to memory of 4580	716	msedge.exe	87
PID 716 wrote to memory of 4580	716	msedge.exe	87
PID 716 wrote to memory of 4580	716	msedge.exe	87
PID 716 wrote to memory of 4580	716	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fc67b9446ea864f3041649c93f630b01_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffada4c46f8,0x7ffada4c4708,0x7ffada4c4718
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,17185912996768793282,14109493165199027656,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,17185912996768793282,14109493165199027656,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,17185912996768793282,14109493165199027656,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17185912996768793282,14109493165199027656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17185912996768793282,14109493165199027656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17185912996768793282,14109493165199027656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17185912996768793282,14109493165199027656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17185912996768793282,14109493165199027656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,17185912996768793282,14109493165199027656,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4912 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9519bc058003dbea34765176083739e

SHA1
ef49b8790219eaddbdacb7fc97d3d05433b8575c

SHA256
e034683bc434a09f5d0293cb786e6a3943b902614f9211d42bed47759164d38b

SHA512
a1b67ccf313173c560ead25671c64de65e3e2599251926e33ce8399fde682fce5cb20f36ee330fcd8bb8f7a9c00ef432da56c9b02dfd7d3f02865f390c342b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb138796dbfb37877fcae3430bb1e2a7

SHA1
82bb82178c07530e42eca6caf3178d66527558bc

SHA256
50c55ba7baeebe1fa4573118edbca59010d659ea42761148618fb3af8a1c9bdd

SHA512
287471cccbe33e08015d6fc35e0bcdca0ec79bebc3a58f6a340b7747b5b2257b33651574bc83ed529aef2ba94be6e68968e59d2a8ef5f733dce9df6404ad7cc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1ff0d0c65522a71039a4b48e65b111bb

SHA1
7a9525e7c3f72004e1c2b8c54aa2dd798c569f81

SHA256
7220d63ae022bd18b3938f8e99a11a0c74c4d8376de9a62ad84c704773cb6c68

SHA512
b1b7f393ff7d5c476507a5a3957239f484fa6cf31e1c9af6f0b599007587733dbc683f7323fc47f3c379197520f6d2e7c9471c088673ae6eed027878d7b25db7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
14e2d33add4842e5eca27044af6c6ee6

SHA1
968d3104d678156363498f36daa4ccb6a22839b7

SHA256
83d5b4d9bccdd0da9fc1bbe92603f074f77966f39ef6c12136c6f615cf2e2f21

SHA512
346b22a3a20d3521d91bc7a50473d81eec1934f02a7eb10f02deb91c5a2862b01e9454291439368b586e2ab7e0198b6feb4c45685c3f19a5f215e2acbf13d687

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dc46edc559b8438ca88475113bcadf5c

SHA1
b90bcb62c2fc135a868854863f447679d1336279

SHA256
43147aac9194250c1584e66ff8ce3adad55143119034d0af8b6b5aa45ca33a8d

SHA512
e4366a31a1bfc2fb925dab85f6898a99572d97f8b7b945958331ea3e21839cab5bd4a39044c7789f93f1d0c9e48cb909c004143b058b01c2b6278927a94a6dae

Download Submit