95bf567ba880eb302e232969eb9db4a9d511f9d5125694a1dd76039f811a677a

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 08:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

291d2de7c781e0607f8d40b46968939e_JaffaCakes118.html
Size

104KB
MD5

291d2de7c781e0607f8d40b46968939e
SHA1

38ba560518c98e5ff5fe0a787bb11250d99b6035
SHA256

95bf567ba880eb302e232969eb9db4a9d511f9d5125694a1dd76039f811a677a
SHA512

5d212e50a31130e4cc4016d4325b0be08dec807e446acea3c212fee6c092b353784e9e191868eedcd4788b9d9b7347f2315053a1103d9df3ce99bdde6f49e65d
SSDEEP

1536:f03h0GMR3+4Y4x3emS1Rap8TARSwb9Ezif6d9ig:sm384msRG

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2584	msedge.exe
2584	msedge.exe
3256	msedge.exe
3256	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 4336	3256	msedge.exe	85
PID 3256 wrote to memory of 4336	3256	msedge.exe	85
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 4656	3256	msedge.exe	88
PID 3256 wrote to memory of 2584	3256	msedge.exe	89
PID 3256 wrote to memory of 2584	3256	msedge.exe	89
PID 3256 wrote to memory of 2160	3256	msedge.exe	90
PID 3256 wrote to memory of 2160	3256	msedge.exe	90
PID 3256 wrote to memory of 2160	3256	msedge.exe	90
PID 3256 wrote to memory of 2160	3256	msedge.exe	90
PID 3256 wrote to memory of 2160	3256	msedge.exe	90
PID 3256 wrote to memory of 2160	3256	msedge.exe	90
PID 3256 wrote to memory of 2160	3256	msedge.exe	90
PID 3256 wrote to memory of 2160	3256	msedge.exe	90
PID 3256 wrote to memory of 2160	3256	msedge.exe	90
PID 3256 wrote to memory of 2160	3256	msedge.exe	90
PID 3256 wrote to memory of 2160	3256	msedge.exe	90
PID 3256 wrote to memory of 2160	3256	msedge.exe	90
PID 3256 wrote to memory of 2160	3256	msedge.exe	90
PID 3256 wrote to memory of 2160	3256	msedge.exe	90
PID 3256 wrote to memory of 2160	3256	msedge.exe	90
PID 3256 wrote to memory of 2160	3256	msedge.exe	90
PID 3256 wrote to memory of 2160	3256	msedge.exe	90
PID 3256 wrote to memory of 2160	3256	msedge.exe	90
PID 3256 wrote to memory of 2160	3256	msedge.exe	90
PID 3256 wrote to memory of 2160	3256	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\291d2de7c781e0607f8d40b46968939e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa006e46f8,0x7ffa006e4708,0x7ffa006e4718
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,7366925901371396016,11354837608726450601,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,7366925901371396016,11354837608726450601,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,7366925901371396016,11354837608726450601,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7366925901371396016,11354837608726450601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7366925901371396016,11354837608726450601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,7366925901371396016,11354837608726450601,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2724 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
123ba1b4b4c89b0a4495e1afdf126740

SHA1
4edcc9c3e28128a9d2a73a31d86b7e73c7b2bbb9

SHA256
118fbcf3b066b13841e52fcb3d8da59dfe9ab7643c036d93eb64f42f73069c79

SHA512
20bcf050d4322a52534cfbb5142b4d36586c672ff820d81285d62ed23e48e16336dc5bbb9b71df58805a9c27773558f7b9946363982918cd33c3c0585b256524

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
abe12dd91152784c0e4c30408bb7b758

SHA1
25154bcc60f110a122fcaa71c27f9603a007b789

SHA256
07c9b0da44b50412cbd45badf02b8c3da9566cf320655e27cb1a68be19fbd1cd

SHA512
e00d6e31d05f78375deec03c90ab6e600c2d1ff0acd4fe02f4178e0fb262bd57269b9ce0a0ed36eb495bdde11f6a4d99a5cd8dcff07443f217735eeace405869

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
ad1144f205880cc9105354617fed1592

SHA1
e60f38883b9edf404571ff4ae783f262391d1b71

SHA256
ced732c357d9346f5dc57c0dd9dc0361ace15d8bc55be3dab64ae1d5da5e146e

SHA512
cd2a85298772c413c52776613e0d1b7238e72b2b6672ce633f1234c393d0dfc670dac4151bd24f2a25aabc328eb088923ff8ccdd4ffa76bf79215907c1e716b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fa5e.TMP

Filesize
203B

MD5
bf24c5278d832abe8bbec64c40107083

SHA1
e768d2e1df6fb87c0e9395c99ed9f720bec367f8

SHA256
38bf456af969822538e82b3cab0ed2c6e6b13167dfda163560d9521d90af70c0

SHA512
21cecde8819a078fa8e868fad8d79802807abc39f036cdab6436faf14edc2ecef627865cc812fc13f3e64c85ef73c4c8beb72c586ac8bcb016d734d0fbffec76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f2fd9f73-2aa1-4361-b5fe-dac077355fc7.tmp

Filesize
6KB

MD5
3f94c952d6c9aac23c452f3659c4424e

SHA1
a5060745ee9bbb9445024dce21d17631d6ac1af8

SHA256
e0b058755d61cc1c7e0cb93d0ffe61457cf7408738b1f387a1899027060b4af5

SHA512
ff356b4a2f190f6e8baa8591d0354e2a627511b2d251275ecb5cba289de7afaa74c7bd2eebee9fae7d911c2b2a1a8f8989c4c97435017d06414d8af9766f9fcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2b23f92d5bede59d239a1ca485d4ab60

SHA1
df7031fbba5fe4558e2220844573515f38a04a02

SHA256
64223515579b82cd10ceea855e0920e8b211a90a402090a7512fd56458fdf3f8

SHA512
3f2c2ecddeb52c326f703bfabd19a71594d08e34c1f5be257d077ff7322c10b860f2e36fc0e168616c988f56c6b2044e52f34af09c05723f4cb93aea3796371e

Download Submit