2b1771a91145ca427350065d6fe8485f23bf2e963a4ecb531521123a9b29737b

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0cb43dc29bfd9efe045b061493a25298_JaffaCakes118.html
Size

383KB
MD5

0cb43dc29bfd9efe045b061493a25298
SHA1

e33467bc8ae3e925f48676735a99bac0bf81329b
SHA256

2b1771a91145ca427350065d6fe8485f23bf2e963a4ecb531521123a9b29737b
SHA512

9ad37dd633326737ff36a073e887a0db4f067804f40081cfdd765a70f6b1c7d9f66c52158ba567b1c85fca57f54ee0ad863a7a1eed4bde52873bb67a16e08737
SSDEEP

6144:gxsMYod+X3oI+Yn86/U9jFigsMYod+X3oI+Yn86/U9jFie:i5d+X3R8mU9jFh5d+X3R8mU9jFf

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
1720	msedge.exe
1720	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2084	1720	msedge.exe	82
PID 1720 wrote to memory of 2084	1720	msedge.exe	82
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2036	1720	msedge.exe	83
PID 1720 wrote to memory of 2484	1720	msedge.exe	84
PID 1720 wrote to memory of 2484	1720	msedge.exe	84
PID 1720 wrote to memory of 4956	1720	msedge.exe	85
PID 1720 wrote to memory of 4956	1720	msedge.exe	85
PID 1720 wrote to memory of 4956	1720	msedge.exe	85
PID 1720 wrote to memory of 4956	1720	msedge.exe	85
PID 1720 wrote to memory of 4956	1720	msedge.exe	85
PID 1720 wrote to memory of 4956	1720	msedge.exe	85
PID 1720 wrote to memory of 4956	1720	msedge.exe	85
PID 1720 wrote to memory of 4956	1720	msedge.exe	85
PID 1720 wrote to memory of 4956	1720	msedge.exe	85
PID 1720 wrote to memory of 4956	1720	msedge.exe	85
PID 1720 wrote to memory of 4956	1720	msedge.exe	85
PID 1720 wrote to memory of 4956	1720	msedge.exe	85
PID 1720 wrote to memory of 4956	1720	msedge.exe	85
PID 1720 wrote to memory of 4956	1720	msedge.exe	85
PID 1720 wrote to memory of 4956	1720	msedge.exe	85
PID 1720 wrote to memory of 4956	1720	msedge.exe	85
PID 1720 wrote to memory of 4956	1720	msedge.exe	85
PID 1720 wrote to memory of 4956	1720	msedge.exe	85
PID 1720 wrote to memory of 4956	1720	msedge.exe	85
PID 1720 wrote to memory of 4956	1720	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0cb43dc29bfd9efe045b061493a25298_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d05046f8,0x7ff8d0504708,0x7ff8d0504718
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13754834448574593040,5235449197509283663,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,13754834448574593040,5235449197509283663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,13754834448574593040,5235449197509283663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13754834448574593040,5235449197509283663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13754834448574593040,5235449197509283663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13754834448574593040,5235449197509283663,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
25ef4c76f444de85fb2edd94307f670b

SHA1
0c11376115dcd21de3d9586f35cf85417a1741ac

SHA256
86d0f5aed38edfc1d85a0897e16898c9112954b4d0c4ddf45d8901477ceff8b5

SHA512
d38a4d1e1e7b8a96cdbd31001ad6cc1f95af4a5a95132ff5a9769a7558f26c46f30543122a85d27a6071ae54abc230220fd50cb2042136a3f90e1c8f4cb30f6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f3723cc8b2e0d54e3437e80876e47fc5

SHA1
75d1cd5e45a65578c100010f5edc115e84480e7b

SHA256
eeb9f549f92b8d75a2337e8f74c85977123a5beba14097b412b12652e6050c70

SHA512
5b6fb18e32e5d727f6d27662da74a676d9f38cf3fd4ba07d4e81a8622c9774ac200304d5cf53fce4235f4124474e0c9e87c12e67ad6a4cf49b05e2d96759fded

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b4dc5ae027322e9db333bec6de603df6

SHA1
e55524bf33a87968e36c5baf6ee24cce9f74463e

SHA256
eb8dc94e79cad70fda5ee657e11591d33b743b1293ddb6b92ef5d5971898414f

SHA512
0d7b2b6aa0510d97553713505d07983cf6e4c21577aedea188dd1fe318fe5afd142165e462de40b2f2aaee02333912db6b54de362c4ad49f6230916bc2df4553

Download Submit