c06b9ff94d31345ddd5bdf62c2b607209856bc4c1c291acd39b579f4148028d5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

203e6a6491fb2fc26ff33ccf1a9b63fa_JaffaCakes118.html
Size

213KB
MD5

203e6a6491fb2fc26ff33ccf1a9b63fa
SHA1

5201dcf5c77e938ff255f442ed444c50357ecd75
SHA256

c06b9ff94d31345ddd5bdf62c2b607209856bc4c1c291acd39b579f4148028d5
SHA512

ac7dd97c066561a9b2bcf9779ea7c2c5873e0e49a14a44bb2e55c7fbde57dae8565fcc28e294f3af29c7cc874cf0ab5383bc9272282f6d68dadde8ba785a731b
SSDEEP

3072:SkChngjKwb12KyfkMY+BES09JXAnyrZalI+YQ:Skx4vsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
4740	msedge.exe
4740	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 2876	4740	msedge.exe	83
PID 4740 wrote to memory of 2876	4740	msedge.exe	83
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 3316	4740	msedge.exe	84
PID 4740 wrote to memory of 2252	4740	msedge.exe	85
PID 4740 wrote to memory of 2252	4740	msedge.exe	85
PID 4740 wrote to memory of 2724	4740	msedge.exe	86
PID 4740 wrote to memory of 2724	4740	msedge.exe	86
PID 4740 wrote to memory of 2724	4740	msedge.exe	86
PID 4740 wrote to memory of 2724	4740	msedge.exe	86
PID 4740 wrote to memory of 2724	4740	msedge.exe	86
PID 4740 wrote to memory of 2724	4740	msedge.exe	86
PID 4740 wrote to memory of 2724	4740	msedge.exe	86
PID 4740 wrote to memory of 2724	4740	msedge.exe	86
PID 4740 wrote to memory of 2724	4740	msedge.exe	86
PID 4740 wrote to memory of 2724	4740	msedge.exe	86
PID 4740 wrote to memory of 2724	4740	msedge.exe	86
PID 4740 wrote to memory of 2724	4740	msedge.exe	86
PID 4740 wrote to memory of 2724	4740	msedge.exe	86
PID 4740 wrote to memory of 2724	4740	msedge.exe	86
PID 4740 wrote to memory of 2724	4740	msedge.exe	86
PID 4740 wrote to memory of 2724	4740	msedge.exe	86
PID 4740 wrote to memory of 2724	4740	msedge.exe	86
PID 4740 wrote to memory of 2724	4740	msedge.exe	86
PID 4740 wrote to memory of 2724	4740	msedge.exe	86
PID 4740 wrote to memory of 2724	4740	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\203e6a6491fb2fc26ff33ccf1a9b63fa_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3af846f8,0x7ffe3af84708,0x7ffe3af84718
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,9683226486692090736,13483209273986495396,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,9683226486692090736,13483209273986495396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,9683226486692090736,13483209273986495396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9683226486692090736,13483209273986495396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9683226486692090736,13483209273986495396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,9683226486692090736,13483209273986495396,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3596 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3cde8a1bb57d4bc7e76fdc65a9737870

SHA1
30537a9d623b708a8630b2aeb2dda3430ab9ecec

SHA256
9d9cc17ca302a852a936afa89af70c01fae8619f90f901dfa02367206264d2a8

SHA512
1312ff88707201b1e797fa1503a5a76e5943e718b8ede02fad72f357eea8bcb6e868f4bc69937eaf66d980a5b3b8e3eb50b7f536b71d152ecd313e0b26619d61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a9f4254b093eb8a9df159ea5202a1255

SHA1
6ab18044bf9947ed3729889e1bcead1abe67f590

SHA256
6a51faa57c57da75734d46d621f19d26191b8b6f0540baea6e3dc8fe756c1322

SHA512
069839bd7266005991ea63390a1a2848c0d581d04a288279e5718aa646849881766c7abfade984bfa254caacad83ed74d7953efef7a48ad00f3c3e9936c332f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
570026f396d73756255e94eaef776564

SHA1
5d7afa89e58fc91e66d68367800ae19e37d43ec2

SHA256
6e234afdf1aee20710c8b2bac624bdf1b4c653f4620bd9fe8a4ceb7d0bdf6b22

SHA512
00e92a1f2707218435eafdc8973c82eed60078a6e38571367977a7392b2acb652c762c566f8fe6c2c508b608bcd8b7af90c991f7cedc37d270de86b80ffc7020

Download Submit