6c22f81f4dcd0b827026e3756ad5bc09622c404e7eae7532818011407769b034

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 17:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30352d207c4ccdadcfa9999e5cbe40c9_JaffaCakes118.html
Size

137KB
MD5

30352d207c4ccdadcfa9999e5cbe40c9
SHA1

dba982d814ff686b9cda3e77b68a1473ff3cc2c3
SHA256

6c22f81f4dcd0b827026e3756ad5bc09622c404e7eae7532818011407769b034
SHA512

13491298346fac6d6cec0e5a3605d9be5fa87025a95af44118dea792536727527afe72dbe07380143f71bf98b809bdb94c544bad2a43b46f8e84856006c2cc64
SSDEEP

3072:S13vnMx7dyfkMY+BES09JXAnyrZalI+YQ:S13vnMx7osMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
384	msedge.exe
384	msedge.exe
1928	msedge.exe
1928	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1928	msedge.exe
1928	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 376	1928	msedge.exe	81
PID 1928 wrote to memory of 376	1928	msedge.exe	81
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 800	1928	msedge.exe	82
PID 1928 wrote to memory of 384	1928	msedge.exe	83
PID 1928 wrote to memory of 384	1928	msedge.exe	83
PID 1928 wrote to memory of 2348	1928	msedge.exe	84
PID 1928 wrote to memory of 2348	1928	msedge.exe	84
PID 1928 wrote to memory of 2348	1928	msedge.exe	84
PID 1928 wrote to memory of 2348	1928	msedge.exe	84
PID 1928 wrote to memory of 2348	1928	msedge.exe	84
PID 1928 wrote to memory of 2348	1928	msedge.exe	84
PID 1928 wrote to memory of 2348	1928	msedge.exe	84
PID 1928 wrote to memory of 2348	1928	msedge.exe	84
PID 1928 wrote to memory of 2348	1928	msedge.exe	84
PID 1928 wrote to memory of 2348	1928	msedge.exe	84
PID 1928 wrote to memory of 2348	1928	msedge.exe	84
PID 1928 wrote to memory of 2348	1928	msedge.exe	84
PID 1928 wrote to memory of 2348	1928	msedge.exe	84
PID 1928 wrote to memory of 2348	1928	msedge.exe	84
PID 1928 wrote to memory of 2348	1928	msedge.exe	84
PID 1928 wrote to memory of 2348	1928	msedge.exe	84
PID 1928 wrote to memory of 2348	1928	msedge.exe	84
PID 1928 wrote to memory of 2348	1928	msedge.exe	84
PID 1928 wrote to memory of 2348	1928	msedge.exe	84
PID 1928 wrote to memory of 2348	1928	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\30352d207c4ccdadcfa9999e5cbe40c9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff912ed46f8,0x7ff912ed4708,0x7ff912ed4718
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1500,1444706035202039625,13422364196714045167,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1500,1444706035202039625,13422364196714045167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1500,1444706035202039625,13422364196714045167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,1444706035202039625,13422364196714045167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,1444706035202039625,13422364196714045167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1500,1444706035202039625,13422364196714045167,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4840 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a8d3417c463b8da35557e36b16580cc7

SHA1
eb3e481662fdd201e7247f74c91d34b35c0ea3f9

SHA256
411cbe0e47053cb39c7a740a4e1c2a434dfdda447328ac918e30fa6a32f325ca

SHA512
e3077fbd7a6e4d7a8e403d8e142faf64f688d96c60c77ec6c9131b1f6040519e6ee0ed0c006d250aac55baec08a22f17d5ba3bc180800f667779904a77fe8e2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
04e01a7ac7dc43e629266ec80f94b082

SHA1
6bba6dff0cf0e709510b96f1b00eb1e6ea419d1e

SHA256
a3a08a20283963a90b440e0a5e665a938f6c98df305c19334d00e77595d5e8d9

SHA512
89702df19ff1671cd61fc40bc09e76bab0fb2c11e2977780cbcbf5273ff1c5d18375be3813e6597780cda16e4b4e1b771c1e307cce5f1b7eefa2c1489e586741

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7f5238e302935c5ed36835316097f3a7

SHA1
3e691139cad9408ab7951331b2b3021bd0e7b47d

SHA256
48d841f7db548986dc4d225dfe8505f137da875a84678148d58462d60f1c307f

SHA512
b22dcfafdbf9ddcfb47d257360be471f5762ac04cca238210691ca9dbdbbafbb53b99329ae04a045bc997dd1ae0c950099e308fb49aff10d3dbb18dfb9acac88

Download Submit