277f80626880763dc911ff3846f036c9bae715cf708664eeddf86a57411e4c55

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 23:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2744775b99c0ae5cc989e7a74bc14ca6_JaffaCakes118.html
Size

218KB
MD5

2744775b99c0ae5cc989e7a74bc14ca6
SHA1

c9af3990c23565376f47bf4b19208276a5f3c820
SHA256

277f80626880763dc911ff3846f036c9bae715cf708664eeddf86a57411e4c55
SHA512

0e2f430b056a87c5b5c731c04c690e4941eb19cb4d5525ff661f982071d1aceab6fd69a8461512c67d9716d5bc1b74424a1c1e05ce14150b8e443a5671f3251a
SSDEEP

3072:SoqDiAAcS/ef5FVpyfkMY+BES09JXAnyrZalI+YQ:SoqvAcpBFisMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
1352	msedge.exe
1352	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1352	msedge.exe
1352	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 3472	1352	msedge.exe	80
PID 1352 wrote to memory of 3472	1352	msedge.exe	80
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 400	1352	msedge.exe	81
PID 1352 wrote to memory of 2000	1352	msedge.exe	82
PID 1352 wrote to memory of 2000	1352	msedge.exe	82
PID 1352 wrote to memory of 1524	1352	msedge.exe	83
PID 1352 wrote to memory of 1524	1352	msedge.exe	83
PID 1352 wrote to memory of 1524	1352	msedge.exe	83
PID 1352 wrote to memory of 1524	1352	msedge.exe	83
PID 1352 wrote to memory of 1524	1352	msedge.exe	83
PID 1352 wrote to memory of 1524	1352	msedge.exe	83
PID 1352 wrote to memory of 1524	1352	msedge.exe	83
PID 1352 wrote to memory of 1524	1352	msedge.exe	83
PID 1352 wrote to memory of 1524	1352	msedge.exe	83
PID 1352 wrote to memory of 1524	1352	msedge.exe	83
PID 1352 wrote to memory of 1524	1352	msedge.exe	83
PID 1352 wrote to memory of 1524	1352	msedge.exe	83
PID 1352 wrote to memory of 1524	1352	msedge.exe	83
PID 1352 wrote to memory of 1524	1352	msedge.exe	83
PID 1352 wrote to memory of 1524	1352	msedge.exe	83
PID 1352 wrote to memory of 1524	1352	msedge.exe	83
PID 1352 wrote to memory of 1524	1352	msedge.exe	83
PID 1352 wrote to memory of 1524	1352	msedge.exe	83
PID 1352 wrote to memory of 1524	1352	msedge.exe	83
PID 1352 wrote to memory of 1524	1352	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2744775b99c0ae5cc989e7a74bc14ca6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf58f46f8,0x7ffdf58f4708,0x7ffdf58f4718
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9017339919388626324,11267677739459363665,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,9017339919388626324,11267677739459363665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2480 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,9017339919388626324,11267677739459363665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9017339919388626324,11267677739459363665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9017339919388626324,11267677739459363665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9017339919388626324,11267677739459363665,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2656 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6849ecec71a19492f8a3711dbbc41ad9

SHA1
8b4eed472b87e61f8c548548e6c52136f51592f0

SHA256
d87bef8a933651eef87b2e723803eb9cb8d7c9e6b68d173d73b67c3672b0e1df

SHA512
a92df976ed955e8ef2aebeea64bc9a89175670081a33e0629ef168032197f136c495ad5c49641bef1963bf515da716e31899b19ff5348f69d5c5253dfd429b57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
95a581607766019ffff2248c16d19585

SHA1
5571e9a7c7510237bd42bf5dd6972742a07d4e08

SHA256
fc9731be19f77eae8df82a0062b83e1fa84c2e87f8fa5012865654730aea8e07

SHA512
1ece6963daade4e6481392e5dc070020658645d9298af5346c0b1a8ac9b29593720e80d0f13fe7f0fd4ac3501263892588b6e94a9c6297923e752686ccdc75c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
97ecdb8fe964c9b783e63f0edce86e84

SHA1
a960b943a5db7c9b34df66fbbac870617adff3b1

SHA256
ef3bf088a5d2663e03230af031236b7e30526b0575c86e3b27283d1edb94704e

SHA512
8a75f344cbb1e559e53ccdcf955842c8e0d337162d0bc5bd72b85277610c47becf8b3d4947190dce8974807ff756365691b27ae810b43643e714c82ab44ea35d

Download Submit