2312d15b72ca4cc038ba402295d48f75cd1036d2e2bf32f35d01a7e07fd104dd

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 19:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26497e8f39c67243e4c5d79ff3d1a434_JaffaCakes118.html
Size

139KB
MD5

26497e8f39c67243e4c5d79ff3d1a434
SHA1

f5aa7d140d63ba44bd45e23ba0016b368db7e953
SHA256

2312d15b72ca4cc038ba402295d48f75cd1036d2e2bf32f35d01a7e07fd104dd
SHA512

4fd4b4ed7e9120001ec6fee55656218025f5dbbef4a98ed1435c36f20f7c5fac3456543cede19e24f54c0ecd0eed6c89334fc187695431f041e55390c29cea53
SSDEEP

1536:S1hIdQlbyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy+:S1EyyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
3816	msedge.exe
3816	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 2080	3816	msedge.exe	82
PID 3816 wrote to memory of 2080	3816	msedge.exe	82
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 1408	3816	msedge.exe	83
PID 3816 wrote to memory of 4304	3816	msedge.exe	84
PID 3816 wrote to memory of 4304	3816	msedge.exe	84
PID 3816 wrote to memory of 1556	3816	msedge.exe	85
PID 3816 wrote to memory of 1556	3816	msedge.exe	85
PID 3816 wrote to memory of 1556	3816	msedge.exe	85
PID 3816 wrote to memory of 1556	3816	msedge.exe	85
PID 3816 wrote to memory of 1556	3816	msedge.exe	85
PID 3816 wrote to memory of 1556	3816	msedge.exe	85
PID 3816 wrote to memory of 1556	3816	msedge.exe	85
PID 3816 wrote to memory of 1556	3816	msedge.exe	85
PID 3816 wrote to memory of 1556	3816	msedge.exe	85
PID 3816 wrote to memory of 1556	3816	msedge.exe	85
PID 3816 wrote to memory of 1556	3816	msedge.exe	85
PID 3816 wrote to memory of 1556	3816	msedge.exe	85
PID 3816 wrote to memory of 1556	3816	msedge.exe	85
PID 3816 wrote to memory of 1556	3816	msedge.exe	85
PID 3816 wrote to memory of 1556	3816	msedge.exe	85
PID 3816 wrote to memory of 1556	3816	msedge.exe	85
PID 3816 wrote to memory of 1556	3816	msedge.exe	85
PID 3816 wrote to memory of 1556	3816	msedge.exe	85
PID 3816 wrote to memory of 1556	3816	msedge.exe	85
PID 3816 wrote to memory of 1556	3816	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\26497e8f39c67243e4c5d79ff3d1a434_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbac3746f8,0x7ffbac374708,0x7ffbac374718
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,17639926138114471413,5618729219517570721,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,17639926138114471413,5618729219517570721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,17639926138114471413,5618729219517570721,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,17639926138114471413,5618729219517570721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,17639926138114471413,5618729219517570721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,17639926138114471413,5618729219517570721,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4908 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e898d78052adea864da89de7f0753afc

SHA1
282b2cd6113309d3fb8281ac6e931bb5226d939e

SHA256
bfdd6402a91630ece7bd8d0f03b50f5fa1e1f251bf96eaacae8883a0e239c229

SHA512
4069834de447ea97684223084ecc5cf35133330a36646aaef87d9d6d567134e48fa37ada2619f1cd7df3fdd4f34caa5f78e5e412c672aedf748cc61ab49d7096

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8f7ebbfcc98aa9422fbeb025bc19a781

SHA1
4c99646b222ec382b558017b8ff802dfdf58bf3f

SHA256
cec2a58e67c05e48f32286c2e4f1029cc9fd13d7b2927e8f4520716b939763f8

SHA512
349f433f9c6d41593b525df56581a357d5ab06e744a21c070e168522755576b0680a51e3d6ac0aebbed0c314157f308afbbf3d517c6825e623bb79c181b2d928

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c8a1e0194124b2813c8530292d836dc5

SHA1
3666dcd4b58f910ed2d724122095b660fa8404ad

SHA256
dc9215ef2125f168401743bf7e37ef08108706db4a8be76aad89f29574ed5bd3

SHA512
b347a54096aa78154063c6d6cbb7c0069db236b8fcd48195b194eaa9e0f42f5acbafdbf5f90618fdcae7c39b1f28ec426bb74e18d2676ac7dc55c7cf34884585

Download Submit