6c1e821abfe075aacfe2904ff157dbe85f3e8e3ae7e993847ed2d248c476fae3

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04-05-2024 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

139a9775035006ebcba02b23771db2c6_JaffaCakes118.html
Size

139KB
MD5

139a9775035006ebcba02b23771db2c6
SHA1

a301934c8263e87e7082bcfacb3dfb5575901c2f
SHA256

6c1e821abfe075aacfe2904ff157dbe85f3e8e3ae7e993847ed2d248c476fae3
SHA512

4a110cebf970b960dc4ac5694bc41aa2d342327f2a13f382d7b6821737b1aa5a1fe45b00f449708c1f2ac402f03d3bcaf37358324ea84209485c0b62a2847b22
SSDEEP

1536:SmFKcYUlYo0yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:SmL0yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1188	msedge.exe
1188	msedge.exe
4904	msedge.exe
4904	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4904	msedge.exe
4904	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 3396	4904	msedge.exe	83
PID 4904 wrote to memory of 3396	4904	msedge.exe	83
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 8	4904	msedge.exe	84
PID 4904 wrote to memory of 1188	4904	msedge.exe	85
PID 4904 wrote to memory of 1188	4904	msedge.exe	85
PID 4904 wrote to memory of 1020	4904	msedge.exe	86
PID 4904 wrote to memory of 1020	4904	msedge.exe	86
PID 4904 wrote to memory of 1020	4904	msedge.exe	86
PID 4904 wrote to memory of 1020	4904	msedge.exe	86
PID 4904 wrote to memory of 1020	4904	msedge.exe	86
PID 4904 wrote to memory of 1020	4904	msedge.exe	86
PID 4904 wrote to memory of 1020	4904	msedge.exe	86
PID 4904 wrote to memory of 1020	4904	msedge.exe	86
PID 4904 wrote to memory of 1020	4904	msedge.exe	86
PID 4904 wrote to memory of 1020	4904	msedge.exe	86
PID 4904 wrote to memory of 1020	4904	msedge.exe	86
PID 4904 wrote to memory of 1020	4904	msedge.exe	86
PID 4904 wrote to memory of 1020	4904	msedge.exe	86
PID 4904 wrote to memory of 1020	4904	msedge.exe	86
PID 4904 wrote to memory of 1020	4904	msedge.exe	86
PID 4904 wrote to memory of 1020	4904	msedge.exe	86
PID 4904 wrote to memory of 1020	4904	msedge.exe	86
PID 4904 wrote to memory of 1020	4904	msedge.exe	86
PID 4904 wrote to memory of 1020	4904	msedge.exe	86
PID 4904 wrote to memory of 1020	4904	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\139a9775035006ebcba02b23771db2c6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9475d46f8,0x7ff9475d4708,0x7ff9475d4718
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,7732119128683565788,14897019385571868220,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,7732119128683565788,14897019385571868220,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,7732119128683565788,14897019385571868220,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7732119128683565788,14897019385571868220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,7732119128683565788,14897019385571868220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,7732119128683565788,14897019385571868220,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4d4395cc8c04a51d8f015acdb2cb5fb1

SHA1
7b0bcc6ff65bc0008ddbd7d6a90e5722e1dde55d

SHA256
92a77d41d21a3b71ceef98fcdf8b9eac807cf857f6a71fbebad453d6e45e58f7

SHA512
598806b0a5de7de133b48749958fee316df5a0c87ee43f0099e943577c6ec2dc29bd806f3a16edcfc123f978b4fda73d1ac9cfe02a1e4c86f0fe7e5848aad5ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b1a1a7d6cd96ced8da3f9c840498e538

SHA1
74ad46793b35016d7f771265ea428cd19e95c3a4

SHA256
849e1845d7b807c9a0bdfabbd7070f37eb4ed707f4891ecd94b62ca945bac718

SHA512
3b64637c3114e2bef0224daedfdba53beeec661f324106a4535011655306231aa3257e127a5b9a809e163c7218f3c09dbee09b03b88195744aa36f241ccca20c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3ebbc9690274f3bad34be351d82f9839

SHA1
de9b62f51658e197101c2cd11ee6e7c7278a1b5f

SHA256
e1f63f516824c04bdcabaaa204fe64cb8a0736e20b10bcdae44e2b324ab42be2

SHA512
08247f6ad49f28272080732c9ea82c96b513da5ff8cf07c23811ecef390f1662bbaf9fe78ee8f5306260fc2b9d705730ab62bf81d0b1f8592fc3159f4bd79a79

Download Submit