6b4359b51d9ba6d708ead5c88ad782f664fc1991eb0b832710a81793ab402caa

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26e022c31238ba24dae4457917973126_JaffaCakes118.html
Size

22KB
MD5

26e022c31238ba24dae4457917973126
SHA1

09b3e5f8b51a3112abc667518d9f67a209ce0307
SHA256

6b4359b51d9ba6d708ead5c88ad782f664fc1991eb0b832710a81793ab402caa
SHA512

25b51ab0a45660089f332b7193c8efc077504b1824017db5446029cc1897f9ad5782169590f10e80c49a1a135c19968c4899faf9be92928270ce5c6e9f06bdf9
SSDEEP

384:baneR9APhsLimyVUqiSiDfQ3akZT1FgeFv6u0OnwDwpVAV06tyV6yV6yVQAhyV9a:baneR94hsLimyVY7DfQFdLf7nVAV/yV3

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
2324	msedge.exe
2324	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 500	2324	msedge.exe	80
PID 2324 wrote to memory of 500	2324	msedge.exe	80
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 1780	2324	msedge.exe	81
PID 2324 wrote to memory of 4068	2324	msedge.exe	82
PID 2324 wrote to memory of 4068	2324	msedge.exe	82
PID 2324 wrote to memory of 4436	2324	msedge.exe	83
PID 2324 wrote to memory of 4436	2324	msedge.exe	83
PID 2324 wrote to memory of 4436	2324	msedge.exe	83
PID 2324 wrote to memory of 4436	2324	msedge.exe	83
PID 2324 wrote to memory of 4436	2324	msedge.exe	83
PID 2324 wrote to memory of 4436	2324	msedge.exe	83
PID 2324 wrote to memory of 4436	2324	msedge.exe	83
PID 2324 wrote to memory of 4436	2324	msedge.exe	83
PID 2324 wrote to memory of 4436	2324	msedge.exe	83
PID 2324 wrote to memory of 4436	2324	msedge.exe	83
PID 2324 wrote to memory of 4436	2324	msedge.exe	83
PID 2324 wrote to memory of 4436	2324	msedge.exe	83
PID 2324 wrote to memory of 4436	2324	msedge.exe	83
PID 2324 wrote to memory of 4436	2324	msedge.exe	83
PID 2324 wrote to memory of 4436	2324	msedge.exe	83
PID 2324 wrote to memory of 4436	2324	msedge.exe	83
PID 2324 wrote to memory of 4436	2324	msedge.exe	83
PID 2324 wrote to memory of 4436	2324	msedge.exe	83
PID 2324 wrote to memory of 4436	2324	msedge.exe	83
PID 2324 wrote to memory of 4436	2324	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\26e022c31238ba24dae4457917973126_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa7cf46f8,0x7fffa7cf4708,0x7fffa7cf4718
  2⤵
  PID:500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,12890327275253918026,9332082347583240486,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,12890327275253918026,9332082347583240486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,12890327275253918026,9332082347583240486,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12890327275253918026,9332082347583240486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12890327275253918026,9332082347583240486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12890327275253918026,9332082347583240486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1988 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12890327275253918026,9332082347583240486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12890327275253918026,9332082347583240486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12890327275253918026,9332082347583240486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12890327275253918026,9332082347583240486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,12890327275253918026,9332082347583240486,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
744B

MD5
1ceca91bdfd388f81daa16faacf14a13

SHA1
b71a8ffbd530dccbba3692e7cd81cd5a1cdc8932

SHA256
d5e22e45520cc08679518f1b4c15bda4e51a17620cbbf906998b13afb746ee6a

SHA512
27711ca4ffb81232d8565ab261ec81c738930608383c4a9a75e7c8c9fc65e8719cc714047cf1416a0930d7cc5fedee61e683e4f42ec98fbd9d7fa4583d0ec55f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
15aacb9a126cbdd9ab278c336cce72ba

SHA1
dc318b1c600b5f486267d4884a12f02e1f61ca0c

SHA256
dbbd2cd28d52966ffeb4178a5c024b42b5ab3131ba021238366d6c5c55945592

SHA512
aa644741ed89d113fd7c865f845ad398816ff06d07d28c0793171c1e6250edbd23fc124f239be992bbde143eab35567465a1075f9db6e674a646d75e104b84cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
67d69ad2e631255d80603c23f8c25dec

SHA1
631687a08a17eb73fdc607b4c757c129f37b69a6

SHA256
f8893c0e6f740753f07cbc7a247cb703b79f03e6674e9c527ab63a0036d428f8

SHA512
b70e4f572d0a1402c4890347b312cd7b05d057325ce938478962e0e2dfb7054c057d8718e83758cb2d08cbf1f423ab627be31eba796886c6c154144df49c05c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
64475903c0c6d9dea6409b5c732d16f7

SHA1
ae145413f639878de3d1353108a1cb0ce9851d35

SHA256
9e7067800d7a5c04b52105bd0f742ceae1f3979163bf4daaa090593425abdd44

SHA512
7d27576f673e75c4a640f8f70db73a38f08fad7508b4443fc967ec9727dc8821d078312251eb2df61e8e03de4a64c4f2a274feb15c182908a998e5dcf3910db8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6eb5385f7a71d0ab643bde68cbefd270

SHA1
91bef3039bdf41731fc69a21db4cc1d6517ae5a8

SHA256
230f8d3b2614204fd57ad8a3a7fe5e4b29319926641c391f58032e570fa235d0

SHA512
44c09df14f5a614a56f492411fb64575d80eab5d4a83cd8f20783c34d4c3b38b7896123d096427791ddfdd2d9068eee68401bdb56046ba9133446e3fd10e2ceb

Download Submit