90178ef4445a249630dc09ad75dafc38ea0f6d3bff179f4c95d2e92614b92be9

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 08:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

240650b2e743fe0dd172a307d8742fe3_JaffaCakes118.html
Size

213KB
MD5

240650b2e743fe0dd172a307d8742fe3
SHA1

fcd590b3c5d43edfb2f39f0f19cf7058d6dc3afa
SHA256

90178ef4445a249630dc09ad75dafc38ea0f6d3bff179f4c95d2e92614b92be9
SHA512

e943255dfc82aafe17e5ce6ccda4aad286741308b225175672959c3195e97be0a72aa7f6958b04be937f61951356d8924ca680bd0fd6d4a4995d51170501a770
SSDEEP

3072:SI14oypH2ZByfkMY+BES09JXAnyrZalI+YQ:SIOsEsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
2444	msedge.exe
2444	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 3416	2444	msedge.exe	83
PID 2444 wrote to memory of 3416	2444	msedge.exe	83
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4856	2444	msedge.exe	84
PID 2444 wrote to memory of 4828	2444	msedge.exe	85
PID 2444 wrote to memory of 4828	2444	msedge.exe	85
PID 2444 wrote to memory of 5080	2444	msedge.exe	86
PID 2444 wrote to memory of 5080	2444	msedge.exe	86
PID 2444 wrote to memory of 5080	2444	msedge.exe	86
PID 2444 wrote to memory of 5080	2444	msedge.exe	86
PID 2444 wrote to memory of 5080	2444	msedge.exe	86
PID 2444 wrote to memory of 5080	2444	msedge.exe	86
PID 2444 wrote to memory of 5080	2444	msedge.exe	86
PID 2444 wrote to memory of 5080	2444	msedge.exe	86
PID 2444 wrote to memory of 5080	2444	msedge.exe	86
PID 2444 wrote to memory of 5080	2444	msedge.exe	86
PID 2444 wrote to memory of 5080	2444	msedge.exe	86
PID 2444 wrote to memory of 5080	2444	msedge.exe	86
PID 2444 wrote to memory of 5080	2444	msedge.exe	86
PID 2444 wrote to memory of 5080	2444	msedge.exe	86
PID 2444 wrote to memory of 5080	2444	msedge.exe	86
PID 2444 wrote to memory of 5080	2444	msedge.exe	86
PID 2444 wrote to memory of 5080	2444	msedge.exe	86
PID 2444 wrote to memory of 5080	2444	msedge.exe	86
PID 2444 wrote to memory of 5080	2444	msedge.exe	86
PID 2444 wrote to memory of 5080	2444	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\240650b2e743fe0dd172a307d8742fe3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5c2346f8,0x7ffa5c234708,0x7ffa5c234718
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,7776086508582070300,9235138217681421715,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,7776086508582070300,9235138217681421715,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,7776086508582070300,9235138217681421715,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7776086508582070300,9235138217681421715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7776086508582070300,9235138217681421715,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,7776086508582070300,9235138217681421715,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6ef34f8b5c8e4400ae1c60208258168f

SHA1
8ec84e88b909addf6cb49ffaab3c506cd5da38f0

SHA256
61bc9e0fd580eb9a8b57256cc2defca7a2a8d90e5f5bd8d76d651e3e84b1e3fe

SHA512
ad6a1e9f854adfa98c3b2003cd49d57e445e72e9a404855dc612f56b8e343a8fd0927d3dd270d89289ea5ab918d7d892b3aa7a2fdcf67a5f700a3944a0e59c63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6896dcea82089f77f1eb8d6a7d6fab74

SHA1
d19443c1d5ff99fb709e5f9cd1483dca9d90e59e

SHA256
b21a4b38a97b753aa9cd760c9555137a7db65b0f6bcccbe968b6914acff00bc3

SHA512
55b6fd87b271a8b1e0f2492564bea1b77d7c5bbec3962907f5671e29c8543cfc81a3803e178e5da5a36323bcc68b1b874238df746181c9fc8c4e3fb05c6ca981

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fadf2a964bb867dc003dcabc5272e08c

SHA1
1e1c1a79ce5985be19bfa2ada3307bda03ca0d75

SHA256
dc58bf6f870a3e9988f56313f47e6d3e586c2793911cd141f0e7521322f6eee3

SHA512
a4e3543c5d6f47b655a0d0a4f7bc47f030f0010ee0ac0e8b9d51b273f48ccf8ebe72407525532e5793f99e5bedc65c0c5d63c41cd15ee1988ed74812dd619b0e

Download Submit