a164691e4b45e0bc933479894b44b209c17461e0c9fdecf8e446c29a05a8ec68

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 08:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

291dd9f1442f10e20d9e775c3b053524_JaffaCakes118.html
Size

139KB
MD5

291dd9f1442f10e20d9e775c3b053524
SHA1

062c5286221e9e517db3cfc539813c069383c8dc
SHA256

a164691e4b45e0bc933479894b44b209c17461e0c9fdecf8e446c29a05a8ec68
SHA512

ed45994156564f8d10f20d9540843d39f977c7d8daa1fbb5680872efa9cf27ff145e977294a0fda5af16fff8c7052b60045e583f6c90cb2ca39c79e86b2706c1
SSDEEP

1536:SnNohWdILlbyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:SnddIxyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
1912	msedge.exe
1912	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 804	1912	msedge.exe	83
PID 1912 wrote to memory of 804	1912	msedge.exe	83
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 3036	1912	msedge.exe	84
PID 1912 wrote to memory of 4064	1912	msedge.exe	85
PID 1912 wrote to memory of 4064	1912	msedge.exe	85
PID 1912 wrote to memory of 3884	1912	msedge.exe	86
PID 1912 wrote to memory of 3884	1912	msedge.exe	86
PID 1912 wrote to memory of 3884	1912	msedge.exe	86
PID 1912 wrote to memory of 3884	1912	msedge.exe	86
PID 1912 wrote to memory of 3884	1912	msedge.exe	86
PID 1912 wrote to memory of 3884	1912	msedge.exe	86
PID 1912 wrote to memory of 3884	1912	msedge.exe	86
PID 1912 wrote to memory of 3884	1912	msedge.exe	86
PID 1912 wrote to memory of 3884	1912	msedge.exe	86
PID 1912 wrote to memory of 3884	1912	msedge.exe	86
PID 1912 wrote to memory of 3884	1912	msedge.exe	86
PID 1912 wrote to memory of 3884	1912	msedge.exe	86
PID 1912 wrote to memory of 3884	1912	msedge.exe	86
PID 1912 wrote to memory of 3884	1912	msedge.exe	86
PID 1912 wrote to memory of 3884	1912	msedge.exe	86
PID 1912 wrote to memory of 3884	1912	msedge.exe	86
PID 1912 wrote to memory of 3884	1912	msedge.exe	86
PID 1912 wrote to memory of 3884	1912	msedge.exe	86
PID 1912 wrote to memory of 3884	1912	msedge.exe	86
PID 1912 wrote to memory of 3884	1912	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\291dd9f1442f10e20d9e775c3b053524_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbdcb646f8,0x7ffbdcb64708,0x7ffbdcb64718
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2556516372653044858,7544736571303514005,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,2556516372653044858,7544736571303514005,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,2556516372653044858,7544736571303514005,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2556516372653044858,7544736571303514005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3096 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2556516372653044858,7544736571303514005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2556516372653044858,7544736571303514005,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0695a841a1c44aca50d83e04c386edaf

SHA1
30ea93dfe2e02e98893ab270cdd3ede12ef15e5f

SHA256
f5f07d4a708a528a8248a22a8d2d234cdc36ffa07c5376bc7c3a05ff0b85ee10

SHA512
a66b00499fb65538fd4de0f5853c4209c228df476c73f838141bf268280f072deac25bf7ac7e4f75c871267ed1badada3e95f50cc062779c4695c7b35c72525d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bf6151514e6cdd29b0002a4db915a669

SHA1
66554fce5b8affdb63ae499b5d93f393bc089888

SHA256
aa4b4e752863d081ec6fede52e8f72ede911cb877bc6a2c7df6224d69e3fe360

SHA512
5820891aa11660e23b9c91caa72df9750032a391a6981de94f776cecdd6626c7c31242ceacfc81fc905e5283dda34a6f341803baa328a9ebd91294668b1295b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4a13aa3767a6ae6adc37b18090c892d1

SHA1
f9899a02c465de98f5981f1ffc6f4fe5a5c6a2bd

SHA256
78e4783fac5d938539814291ba21d33895b8342b31e07ceea9242548852d5946

SHA512
1cefdd0319796b5f2cff26bf534acf60ea4aed514fb3a386f6893ab58cfcf02a6ad8d347d3aa24b311266d8f8980a7808d6e1260f6ce697d1ccc351e8f3dc52c

Download Submit