f61696f69b39861b1571c787707b637d6fec4881777498cd8555ce26da156291

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

21309cd792a73685c22db283d4ebc490_JaffaCakes118.html
Size

138KB
MD5

21309cd792a73685c22db283d4ebc490
SHA1

c0b54106c0541ea4aeb828d934f712a3a85a6822
SHA256

f61696f69b39861b1571c787707b637d6fec4881777498cd8555ce26da156291
SHA512

3543b4d2cf2cb683f2dd969de57c60ed1f20e619a11a803149c9f145579e39e6e76560f6121c4b40e7c563e5b98b0168897a0880eda98c817da0d32d7f91a192
SSDEEP

1536:Sn9EeplxPRPyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:SnHZPyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
5060	msedge.exe
5060	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5060	msedge.exe
5060	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 4152	5060	msedge.exe	84
PID 5060 wrote to memory of 4152	5060	msedge.exe	84
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 2936	5060	msedge.exe	85
PID 5060 wrote to memory of 3924	5060	msedge.exe	86
PID 5060 wrote to memory of 3924	5060	msedge.exe	86
PID 5060 wrote to memory of 1324	5060	msedge.exe	87
PID 5060 wrote to memory of 1324	5060	msedge.exe	87
PID 5060 wrote to memory of 1324	5060	msedge.exe	87
PID 5060 wrote to memory of 1324	5060	msedge.exe	87
PID 5060 wrote to memory of 1324	5060	msedge.exe	87
PID 5060 wrote to memory of 1324	5060	msedge.exe	87
PID 5060 wrote to memory of 1324	5060	msedge.exe	87
PID 5060 wrote to memory of 1324	5060	msedge.exe	87
PID 5060 wrote to memory of 1324	5060	msedge.exe	87
PID 5060 wrote to memory of 1324	5060	msedge.exe	87
PID 5060 wrote to memory of 1324	5060	msedge.exe	87
PID 5060 wrote to memory of 1324	5060	msedge.exe	87
PID 5060 wrote to memory of 1324	5060	msedge.exe	87
PID 5060 wrote to memory of 1324	5060	msedge.exe	87
PID 5060 wrote to memory of 1324	5060	msedge.exe	87
PID 5060 wrote to memory of 1324	5060	msedge.exe	87
PID 5060 wrote to memory of 1324	5060	msedge.exe	87
PID 5060 wrote to memory of 1324	5060	msedge.exe	87
PID 5060 wrote to memory of 1324	5060	msedge.exe	87
PID 5060 wrote to memory of 1324	5060	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\21309cd792a73685c22db283d4ebc490_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f8ab46f8,0x7ff8f8ab4708,0x7ff8f8ab4718
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,2689297642885965166,13887707687751128441,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,2689297642885965166,13887707687751128441,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,2689297642885965166,13887707687751128441,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2689297642885965166,13887707687751128441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2689297642885965166,13887707687751128441,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,2689297642885965166,13887707687751128441,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4780 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ddf9835544397358d07eee84737b4455

SHA1
b4054b3a716731b119fab0597757ecef38aa58aa

SHA256
d0af03a943ac0000bf1715bc1988348897f20b554d1820878cf26ac4adf45f1a

SHA512
f14ea556ceb52706500b882859759591ce4e99cd1e9eec7052d932814a5bdbd8c1023172a7511a0f4675eeb0820f0cb3600c542c8011ca0bfc553c96f7d66b99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d2ec256a0df1a70ee51cdecf91b52a56

SHA1
aefbfa26712e93f72238792f81f71f371aedecfd

SHA256
b43e9812591d8620b94d8abd17f70bfb4bfe0bab5e796fbcc37b1bbadf7171ec

SHA512
5008600692ae54f4a396065eb44c7ef3e33765dd934e0ae922349c610ba69390e92dd49287fae8cc8df77730b8cc4e430e65bef3ba748c473cedcd95300b2816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6d4a6fc5183318ce2830485923861ddb

SHA1
db38cb75fa1ee5724755faafb6b307f34617e9c7

SHA256
a3aa6e105fdc2d25261c98cf4254cfbd94bf510c2bf5742e49081e55a8fd8f29

SHA512
d1899b90ad544f43f1ea600cf47c5a42e1c3ace93a4bd4394a31f8e664bc713ec09d8f277afec50500354c5e4ac10d32c342d963f95b7f5d48d4ee8a4decb771

Download Submit