006a1e84c1c4435a4916e3a09e5b8143482b73b4adcea5fc3aac7823887e3b44

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 00:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0ac0037d771b773272d177229126bc48_JaffaCakes118.html
Size

17KB
MD5

0ac0037d771b773272d177229126bc48
SHA1

b6e374720a18b3e6ac87959c8c0c10609f39c02a
SHA256

006a1e84c1c4435a4916e3a09e5b8143482b73b4adcea5fc3aac7823887e3b44
SHA512

a92d6061e733d4edbaae81186f6bd0493b38e99ffeedb6d1190c5c14a4740ec183fc3ca8f45fc346bf65a71328e3ff82e1f56044159055074954391f9e3d3e30
SSDEEP

192:SI9fDw+1Ssxta5kX/PEWxxCvmK9ltgBHGA1poNS/pj2F5hv+exIePbl87yGBF7w:SI9f3xt53X2RR8poN2IHJGy8FU

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2716	msedge.exe
2716	msedge.exe
340	msedge.exe
340	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
340	msedge.exe
340	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe
340	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 340 wrote to memory of 3664	340	msedge.exe	83
PID 340 wrote to memory of 3664	340	msedge.exe	83
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2000	340	msedge.exe	84
PID 340 wrote to memory of 2716	340	msedge.exe	85
PID 340 wrote to memory of 2716	340	msedge.exe	85
PID 340 wrote to memory of 1072	340	msedge.exe	86
PID 340 wrote to memory of 1072	340	msedge.exe	86
PID 340 wrote to memory of 1072	340	msedge.exe	86
PID 340 wrote to memory of 1072	340	msedge.exe	86
PID 340 wrote to memory of 1072	340	msedge.exe	86
PID 340 wrote to memory of 1072	340	msedge.exe	86
PID 340 wrote to memory of 1072	340	msedge.exe	86
PID 340 wrote to memory of 1072	340	msedge.exe	86
PID 340 wrote to memory of 1072	340	msedge.exe	86
PID 340 wrote to memory of 1072	340	msedge.exe	86
PID 340 wrote to memory of 1072	340	msedge.exe	86
PID 340 wrote to memory of 1072	340	msedge.exe	86
PID 340 wrote to memory of 1072	340	msedge.exe	86
PID 340 wrote to memory of 1072	340	msedge.exe	86
PID 340 wrote to memory of 1072	340	msedge.exe	86
PID 340 wrote to memory of 1072	340	msedge.exe	86
PID 340 wrote to memory of 1072	340	msedge.exe	86
PID 340 wrote to memory of 1072	340	msedge.exe	86
PID 340 wrote to memory of 1072	340	msedge.exe	86
PID 340 wrote to memory of 1072	340	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0ac0037d771b773272d177229126bc48_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xa4,0x108,0x7fff368d46f8,0x7fff368d4708,0x7fff368d4718
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,17296992077301191617,16375905780182689187,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,17296992077301191617,16375905780182689187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,17296992077301191617,16375905780182689187,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17296992077301191617,16375905780182689187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17296992077301191617,16375905780182689187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,17296992077301191617,16375905780182689187,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9dc60aef38e7832217e7fa02d6f0d9f6

SHA1
4f8539dc7d5739b36fe976a932338f459d066db6

SHA256
8a0ee0b6fafabb256571b691c2faf77c7244945faa749c72124d5eb43a197a32

SHA512
18371541811910992c2b84a8eae7e997e8627640bdb60b9e82751389e50931db9b3e206d31f4d9d2dc3ca25ea3a82c0be413ecb0ef3ac227a14e54f406eaa7e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7ac03b15b68af2d5cb5c8063057cc83e

SHA1
9b2d4db737f57322ff5c4bbddd765b3177f930ab

SHA256
b90d7596301470b389842eecb46bd3a8e614260b0d374d5c35a36afb9c71a700

SHA512
a5e9f40dd9040803046b0218fab6b058d49e5e2a3ada315e161fe9fc80ebb8d6d4442ccc1c98d19e561fc7c61bcf43d662fe2231cacacb447876a2113c2e3732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f701ac6011ff01c0c8de63d70f99c500

SHA1
a972e81765f6ccda0c72ebd62c58ce53520a0218

SHA256
92237f0f676ba8e12f903c3b637272817a449b57baa615fd1b036dd4383745d3

SHA512
8a1fcb0e38421633117258c210dc2b5edbe9b9a6b9feb59aeebe3f0c511d7b2652b1d13e6b8ff0c3ce4e39f8def917dc5ad33480c58de8b99b146bb74c410cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
776f5675f59bf406b4c6f848a31f165e

SHA1
a74b7154f496dd161db8550fff42e719bb106f96

SHA256
e8a05593112b6f5a0d3fc6a32f04a7b312f49ea6fa864afb69eaab76be8ed58d

SHA512
b26e57183ac456da861aa7bdd9bbc93255e6487694a940a54fb6ca0295b18e27e5d970a523f8f31a771616f868f7b568b1d8d6efcf8d3468fb8383f7a6347b2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c8d33ed31730ccfb603dacf67e85c6fa

SHA1
60d44161b3c2934a0ebb5d3dee4ba33bdfc1fbe7

SHA256
ed1ce02708825a13b070b94e2d527d46bad4552cee20cb48e191ac092021b7bc

SHA512
dbfeef99a7451555d2cb81d5565674cdf801ac371625d9e24b017743cc184a800382e6288f7c5ade94d7db7fe7658b7e111c3f4b35d489cba7c0ba6584849f96

Download Submit