5388cb7e4b5216a6bc1987f19ffdf6eb1a715fdaa43bc7579e51eb86a154476d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 03:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11658cf3e2e232423460129c67f077ec_JaffaCakes118.html
Size

214KB
MD5

11658cf3e2e232423460129c67f077ec
SHA1

bd8a3ff3ca2c52a50940f03896718600c3381e9c
SHA256

5388cb7e4b5216a6bc1987f19ffdf6eb1a715fdaa43bc7579e51eb86a154476d
SHA512

39813a7326cc4f74fe85f7445f9ac13b9c1359d527aabb107539c409183ed8fccb8f7351583a2065b52465173c76357635d9c938e754e45e2124d80ab770784a
SSDEEP

3072:OrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJ5:2z9VxLY7iAVLTBQJl5

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1520	msedge.exe
1520	msedge.exe
3576	msedge.exe
3576	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 3608	3576	msedge.exe	83
PID 3576 wrote to memory of 3608	3576	msedge.exe	83
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 3172	3576	msedge.exe	84
PID 3576 wrote to memory of 1520	3576	msedge.exe	85
PID 3576 wrote to memory of 1520	3576	msedge.exe	85
PID 3576 wrote to memory of 2864	3576	msedge.exe	86
PID 3576 wrote to memory of 2864	3576	msedge.exe	86
PID 3576 wrote to memory of 2864	3576	msedge.exe	86
PID 3576 wrote to memory of 2864	3576	msedge.exe	86
PID 3576 wrote to memory of 2864	3576	msedge.exe	86
PID 3576 wrote to memory of 2864	3576	msedge.exe	86
PID 3576 wrote to memory of 2864	3576	msedge.exe	86
PID 3576 wrote to memory of 2864	3576	msedge.exe	86
PID 3576 wrote to memory of 2864	3576	msedge.exe	86
PID 3576 wrote to memory of 2864	3576	msedge.exe	86
PID 3576 wrote to memory of 2864	3576	msedge.exe	86
PID 3576 wrote to memory of 2864	3576	msedge.exe	86
PID 3576 wrote to memory of 2864	3576	msedge.exe	86
PID 3576 wrote to memory of 2864	3576	msedge.exe	86
PID 3576 wrote to memory of 2864	3576	msedge.exe	86
PID 3576 wrote to memory of 2864	3576	msedge.exe	86
PID 3576 wrote to memory of 2864	3576	msedge.exe	86
PID 3576 wrote to memory of 2864	3576	msedge.exe	86
PID 3576 wrote to memory of 2864	3576	msedge.exe	86
PID 3576 wrote to memory of 2864	3576	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\11658cf3e2e232423460129c67f077ec_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff44ee46f8,0x7fff44ee4708,0x7fff44ee4718
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,5464437311814614939,13881343291330067522,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,5464437311814614939,13881343291330067522,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,5464437311814614939,13881343291330067522,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,5464437311814614939,13881343291330067522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,5464437311814614939,13881343291330067522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,5464437311814614939,13881343291330067522,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4920 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62c02dda2bf22d702a9b3a1c547c5f6a

SHA1
8f42966df96bd2e8c1f6b31b37c9a19beb6394d6

SHA256
cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b

SHA512
a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c32e09fbb785189638d94a8565ee94f4

SHA1
59d34b51eed1b2a928c6fcedc36c9d437d607325

SHA256
b04c71e6a3a0e4015d4d60c402678788d03b08660b8cfa048a8630d9b6522467

SHA512
d7db8efb864446ad022b31b212a3960566517e961f74a20e7c16a73cff48b4c824f10c0675350cd64ac6841389dc076df94a487eeb05be6494b22511d7998ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0ed4b081a741c8131099ca3ffbf284fc

SHA1
274d92069fc4856f5a1f4940e9bfa139c4246b21

SHA256
4fa87bcb92103e380867f52420252333467e9678aaaf0f58e7902166c87f43d9

SHA512
026a2b7cb57bf5262d3d12a35366858535472bbae63f93c97029d0a0eca7a7a84a0b009b312290ce4af6e4e61f0af2ea0084528f2246009182496aa09a17986f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7dda294169dc7a214056375900c9240a

SHA1
cc145188a0977bf2510d469912447a0bad712a42

SHA256
5952d324965b49036bf11e727bc93315bf8b0e74d8d5d8fc2a773467471b194d

SHA512
cf556f3964185e7a1776a9e197386825862da0c1e43f0c19a6ac8d74cf4b9abd9020d3f34b15c03f163b86b2e8b41a18106a6839f38b47637d4e4d54c1424a39

Download Submit