a57b0a66a7b8ee1b78d13c5579d3abf6fb98e5bf4d693c64d209e858aa207af2

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

011fcc595af8fbe50db429c0b0de9cc6_JaffaCakes118.html
Size

139KB
MD5

011fcc595af8fbe50db429c0b0de9cc6
SHA1

be93ea2fc2699654d4e12be9a73f2c763671f207
SHA256

a57b0a66a7b8ee1b78d13c5579d3abf6fb98e5bf4d693c64d209e858aa207af2
SHA512

06430c5dedb40f91dfcb05722866ede66c2f6721e3b9534d11cb6b4aae7b46636a3e87d4d6183aa44e90d8191602b5b2532cedabfcf751dc7d34f56492056486
SSDEEP

3072:SNusqzw1HByfkMY+BES09JXAnyrZalI+YQ:SNusqECsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
2296	msedge.exe
2296	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe
3684	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 452	2296	msedge.exe	82
PID 2296 wrote to memory of 452	2296	msedge.exe	82
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 392	2296	msedge.exe	83
PID 2296 wrote to memory of 4572	2296	msedge.exe	84
PID 2296 wrote to memory of 4572	2296	msedge.exe	84
PID 2296 wrote to memory of 2904	2296	msedge.exe	85
PID 2296 wrote to memory of 2904	2296	msedge.exe	85
PID 2296 wrote to memory of 2904	2296	msedge.exe	85
PID 2296 wrote to memory of 2904	2296	msedge.exe	85
PID 2296 wrote to memory of 2904	2296	msedge.exe	85
PID 2296 wrote to memory of 2904	2296	msedge.exe	85
PID 2296 wrote to memory of 2904	2296	msedge.exe	85
PID 2296 wrote to memory of 2904	2296	msedge.exe	85
PID 2296 wrote to memory of 2904	2296	msedge.exe	85
PID 2296 wrote to memory of 2904	2296	msedge.exe	85
PID 2296 wrote to memory of 2904	2296	msedge.exe	85
PID 2296 wrote to memory of 2904	2296	msedge.exe	85
PID 2296 wrote to memory of 2904	2296	msedge.exe	85
PID 2296 wrote to memory of 2904	2296	msedge.exe	85
PID 2296 wrote to memory of 2904	2296	msedge.exe	85
PID 2296 wrote to memory of 2904	2296	msedge.exe	85
PID 2296 wrote to memory of 2904	2296	msedge.exe	85
PID 2296 wrote to memory of 2904	2296	msedge.exe	85
PID 2296 wrote to memory of 2904	2296	msedge.exe	85
PID 2296 wrote to memory of 2904	2296	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\011fcc595af8fbe50db429c0b0de9cc6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffffc5d46f8,0x7ffffc5d4708,0x7ffffc5d4718
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,8771621675375597831,7978449196439750774,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,8771621675375597831,7978449196439750774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,8771621675375597831,7978449196439750774,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,8771621675375597831,7978449196439750774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3036 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,8771621675375597831,7978449196439750774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3048 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,8771621675375597831,7978449196439750774,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5d5793f23a51b4ed4fcac007d3760c89

SHA1
87b54f7a1d46dc150699647c3adca0fdb5006e33

SHA256
c1f084be7a6aa9533c085be48d345f10c9a47664d5c5e61c69d659aecf62ed39

SHA512
e11b44b266270a903fe7e8b6984ef3ecd6e2abe2b5fde9f618a536d86624469f39e42529cee801009dd3feebec06dfbf1f4eee6dbb365f3b7c29a6333b9f67b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6b67fee1c8cba9af669d9c77e14e525f

SHA1
0a50f631291bb7e425493a2fe87144fe335d3f84

SHA256
a0ebee38d8eefa5d17e66839bb50308c550c92509399897af270a543f42df36e

SHA512
92bc0378d9214257329acb74a53c96f36784e139196bbf2797df3ce1b63251d2f0c90ade5838b7463575b57618a7c0169a3284a142786681ca801baf7e78fe4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b89be08355e05bcacb846607ab1dbd60

SHA1
b52eb14083794a1a3b065f6cc71d6cd5fb6024f0

SHA256
245b0bce135de12c9102296eb938de6d5c7ea345890fe15a1b25cc6dfc9486d3

SHA512
690f8fd3b67b40ca326daa02cf614dca10ac7fa41724aca8e43d027484adeefc44d269f9051a9d9d74a3e8a814151039f369b4cfedbbe47f02001d1fa319419e

Download Submit