9c382e0e2936deb1a382da220e6b06d2e40dd27e440df9ffbd0a7ba1ad62a575

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 13:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17dcd1ae3d198a873701c977287d26a0_JaffaCakes118.html
Size

20KB
MD5

17dcd1ae3d198a873701c977287d26a0
SHA1

3f9ef4009f43a768aac86f526bf54e7d9d9effac
SHA256

9c382e0e2936deb1a382da220e6b06d2e40dd27e440df9ffbd0a7ba1ad62a575
SHA512

c4d5f547be9700d624d855641a9f13d97262915d294749f3f0d551160b76a75f892b1eb29a4ef0a490af2bf7bcb9c586a5b9207af5b5d368af771cf520c03c81
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIh4lzUnjBhnZ82qDB8:SIMd0I5nO9H9svnyxDB8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3696	msedge.exe
3696	msedge.exe
2044	msedge.exe
2044	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2044	msedge.exe
2044	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1936	2044	msedge.exe	88
PID 2044 wrote to memory of 1936	2044	msedge.exe	88
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 956	2044	msedge.exe	89
PID 2044 wrote to memory of 3696	2044	msedge.exe	90
PID 2044 wrote to memory of 3696	2044	msedge.exe	90
PID 2044 wrote to memory of 3628	2044	msedge.exe	91
PID 2044 wrote to memory of 3628	2044	msedge.exe	91
PID 2044 wrote to memory of 3628	2044	msedge.exe	91
PID 2044 wrote to memory of 3628	2044	msedge.exe	91
PID 2044 wrote to memory of 3628	2044	msedge.exe	91
PID 2044 wrote to memory of 3628	2044	msedge.exe	91
PID 2044 wrote to memory of 3628	2044	msedge.exe	91
PID 2044 wrote to memory of 3628	2044	msedge.exe	91
PID 2044 wrote to memory of 3628	2044	msedge.exe	91
PID 2044 wrote to memory of 3628	2044	msedge.exe	91
PID 2044 wrote to memory of 3628	2044	msedge.exe	91
PID 2044 wrote to memory of 3628	2044	msedge.exe	91
PID 2044 wrote to memory of 3628	2044	msedge.exe	91
PID 2044 wrote to memory of 3628	2044	msedge.exe	91
PID 2044 wrote to memory of 3628	2044	msedge.exe	91
PID 2044 wrote to memory of 3628	2044	msedge.exe	91
PID 2044 wrote to memory of 3628	2044	msedge.exe	91
PID 2044 wrote to memory of 3628	2044	msedge.exe	91
PID 2044 wrote to memory of 3628	2044	msedge.exe	91
PID 2044 wrote to memory of 3628	2044	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\17dcd1ae3d198a873701c977287d26a0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe429c46f8,0x7ffe429c4708,0x7ffe429c4718
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,10923162050531048329,3586252022120737467,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,10923162050531048329,3586252022120737467,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,10923162050531048329,3586252022120737467,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10923162050531048329,3586252022120737467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10923162050531048329,3586252022120737467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,10923162050531048329,3586252022120737467,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62c02dda2bf22d702a9b3a1c547c5f6a

SHA1
8f42966df96bd2e8c1f6b31b37c9a19beb6394d6

SHA256
cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b

SHA512
a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
144980f3f8d59db00d053ea630c19b2b

SHA1
481b00164e548e88a20789d99e2c5f788bc9dd37

SHA256
4ba1487a1c425ac0ab90d35b1094e289671aa23eb8a87661200f24c900c48f4d

SHA512
300bb4bcc5295557ecc447b7f0f0c5708fb29e7a62e27efe12874a4b474cd23832a0360283205bd6e7d1c1be9ba1e2782334d29f9c5564246ed0e8b0f5e64e48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
77fa5853d6364a681630eb89d6dc1e72

SHA1
8b7b3d30cb5345f8b72c8e6c6f463557139d2ac7

SHA256
352212e0301abff307968e06176719992d13e606e24ddf6d80d2b280aa5b945b

SHA512
49161c07a63a2bcdc5737f2868e7ff8c84cd31f13a3757cd64b6877947a22eb31c023a08027ffc5b99657d670a7ef0d69a58341b72a6dd59d166d6ac3dc02bb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
81feba4ecec54642b637616a4563fbd1

SHA1
5a9650d5827a4410d9a0b583484797e90dd637cc

SHA256
02565f9653baa16c3877c84f2cd39604bc8e7e46f89113803361c03a971763fc

SHA512
8e67bc39037570c54acfd122c9d2e18e9c2176af05ad044d4f71a2afdcd41287e46edc1f9060d99b87e55d323f4c005b4a03bbddedc2b90545def73bd0d4d147

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
348bb42298e524aa68a5f4b7407ac117

SHA1
71c65a8f325a9aaf81ab78a9750beba2d57a239e

SHA256
c83c976b76ef8ffb4351153a813f99c172bc1b3ee0e3fb966c4dda6c49e0e83f

SHA512
f8b43506b1faef687acedc700e3ac7ad6c439bf0ad765c14ea4c2d1621d360fab676ec41ec5d1b039c74579dc32550a8e33d4333c8a5c48f2013b3f284fc810d

Download Submit