41e5d20709e79d15991935a93704094356205d59d9d1c1db17cd94b2ffa3af80

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 05:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2888033f4d5972be21161f8d152d40fc_JaffaCakes118.html
Size

19KB
MD5

2888033f4d5972be21161f8d152d40fc
SHA1

3821c4ba3af829445109f030be7ac316f99bf9a6
SHA256

41e5d20709e79d15991935a93704094356205d59d9d1c1db17cd94b2ffa3af80
SHA512

b2ff4f5488e9f0c6d945ddb234942fd640209d4361c6b4dce9637fcfe9a586bce2a7a24c4f9b8475f7139fde60860fa6bcdcab2edb64ba777ce76759eec4de5c
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAI44qzUnjBheA82qDB8:SIMd0I5nO9HPsveDxDB8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
448	msedge.exe
448	msedge.exe
5016	msedge.exe
5016	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 4480	5016	msedge.exe	80
PID 5016 wrote to memory of 4480	5016	msedge.exe	80
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 3444	5016	msedge.exe	82
PID 5016 wrote to memory of 448	5016	msedge.exe	83
PID 5016 wrote to memory of 448	5016	msedge.exe	83
PID 5016 wrote to memory of 5012	5016	msedge.exe	84
PID 5016 wrote to memory of 5012	5016	msedge.exe	84
PID 5016 wrote to memory of 5012	5016	msedge.exe	84
PID 5016 wrote to memory of 5012	5016	msedge.exe	84
PID 5016 wrote to memory of 5012	5016	msedge.exe	84
PID 5016 wrote to memory of 5012	5016	msedge.exe	84
PID 5016 wrote to memory of 5012	5016	msedge.exe	84
PID 5016 wrote to memory of 5012	5016	msedge.exe	84
PID 5016 wrote to memory of 5012	5016	msedge.exe	84
PID 5016 wrote to memory of 5012	5016	msedge.exe	84
PID 5016 wrote to memory of 5012	5016	msedge.exe	84
PID 5016 wrote to memory of 5012	5016	msedge.exe	84
PID 5016 wrote to memory of 5012	5016	msedge.exe	84
PID 5016 wrote to memory of 5012	5016	msedge.exe	84
PID 5016 wrote to memory of 5012	5016	msedge.exe	84
PID 5016 wrote to memory of 5012	5016	msedge.exe	84
PID 5016 wrote to memory of 5012	5016	msedge.exe	84
PID 5016 wrote to memory of 5012	5016	msedge.exe	84
PID 5016 wrote to memory of 5012	5016	msedge.exe	84
PID 5016 wrote to memory of 5012	5016	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2888033f4d5972be21161f8d152d40fc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae9a446f8,0x7ffae9a44708,0x7ffae9a44718
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,847806202897335763,483595218968094610,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,847806202897335763,483595218968094610,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,847806202897335763,483595218968094610,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,847806202897335763,483595218968094610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,847806202897335763,483595218968094610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,847806202897335763,483595218968094610,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cbca365fa4b0881ca03beb8a13221b14

SHA1
ac4e87cdee671309e72bfbaf756cf5af7e5357cb

SHA256
8c1a7b40867683de437bc4f1e77ebcd91a99e3d5a4096e5f4f67e038d59774f3

SHA512
9cb9be5f98bec22cda08196822ce247074525fdb70974d5143fafa88484ae4c07cd7f4d8e29d484c6712e51b4cc793a812e503aa504399adbe7fa4290cf6f902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8e3e0f2a7c5ecf4718a4dedc47f41e14

SHA1
4f48d81a4322149f024a60d82db42edcf91e2627

SHA256
e44c1a9317f218471f615b565dfad5550ad6498a0f03942e7d418cb87429d22c

SHA512
04e32e6fcaf1dbaf41f283914abf7046be61d947ef4bb8265eadab53a4d92b81e6be6a39fd1f508f039772f07e0419d6419f06054f9be937dcfaad14fe4dc932

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
270efec8159b20e52df9381a3f0878e0

SHA1
cd7c8f093e843f42cac9dfd528c56a0f9c99b539

SHA256
a635b4f389df5022b1729709c32c7bf20036db6fdfe293c58abd42c98acc0023

SHA512
d8cf221997307daa75e6b048067f5d3838b2d064197b8166aa1440cafd42c976c0f9e2399f43b0e4fe2cff21bb07ab28c795e3d329fe2f4eb2e98aacfab1b43b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b7ac92d9d1d47b4bd1f01ce42eed4311

SHA1
9fd433cea5ed0d2c10674c4904e8d9d653ccc500

SHA256
90b4e7da19ede543bdf79a2b2fa5e2a888412249a5299f3cf316939e53ee0b88

SHA512
1545eea6c061f6a150a4085dce0457820ab1a6405c453c718c40d57db807ac7968d991b20ce42830060f177c019cdd51b996707fe66ad0f9b33efe08d23235eb

Download Submit
\??\pipe\LOCAL\crashpad_5016_WLJDHLUNDUXJSKST

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit