6cb58e9483531ca04f7c77f354208bcccd7ea15caf13d21607a7bf6de6126bf5

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32486c7119bd88eeb83240721cb6fe45_JaffaCakes118.html
Size

158KB
MD5

32486c7119bd88eeb83240721cb6fe45
SHA1

07121db55d3b34d81d4742e4a259c3af2639fa1e
SHA256

6cb58e9483531ca04f7c77f354208bcccd7ea15caf13d21607a7bf6de6126bf5
SHA512

e208ffd7d832f7546bcb9e44541b94a30cc69261d143749ae072cf5ff4f55455487d0c59616dcf73c12caded042fb9ef251c17e1f76802941007e386da3bb0e6
SSDEEP

3072:S2/kac1ChcCdUyfkMY+BES09JXAnyrZalI+YQ:S2/kac1ChcCdZsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5056	msedge.exe
5056	msedge.exe
1692	msedge.exe
1692	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2976	1692	msedge.exe	82
PID 1692 wrote to memory of 2976	1692	msedge.exe	82
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 3432	1692	msedge.exe	83
PID 1692 wrote to memory of 5056	1692	msedge.exe	84
PID 1692 wrote to memory of 5056	1692	msedge.exe	84
PID 1692 wrote to memory of 4044	1692	msedge.exe	85
PID 1692 wrote to memory of 4044	1692	msedge.exe	85
PID 1692 wrote to memory of 4044	1692	msedge.exe	85
PID 1692 wrote to memory of 4044	1692	msedge.exe	85
PID 1692 wrote to memory of 4044	1692	msedge.exe	85
PID 1692 wrote to memory of 4044	1692	msedge.exe	85
PID 1692 wrote to memory of 4044	1692	msedge.exe	85
PID 1692 wrote to memory of 4044	1692	msedge.exe	85
PID 1692 wrote to memory of 4044	1692	msedge.exe	85
PID 1692 wrote to memory of 4044	1692	msedge.exe	85
PID 1692 wrote to memory of 4044	1692	msedge.exe	85
PID 1692 wrote to memory of 4044	1692	msedge.exe	85
PID 1692 wrote to memory of 4044	1692	msedge.exe	85
PID 1692 wrote to memory of 4044	1692	msedge.exe	85
PID 1692 wrote to memory of 4044	1692	msedge.exe	85
PID 1692 wrote to memory of 4044	1692	msedge.exe	85
PID 1692 wrote to memory of 4044	1692	msedge.exe	85
PID 1692 wrote to memory of 4044	1692	msedge.exe	85
PID 1692 wrote to memory of 4044	1692	msedge.exe	85
PID 1692 wrote to memory of 4044	1692	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\32486c7119bd88eeb83240721cb6fe45_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff850fe46f8,0x7ff850fe4708,0x7ff850fe4718
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,16337353746646305733,16339979721957645720,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2252,16337353746646305733,16339979721957645720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2252,16337353746646305733,16339979721957645720,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,16337353746646305733,16339979721957645720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,16337353746646305733,16339979721957645720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,16337353746646305733,16339979721957645720,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3168 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6947fe545480caf83a90804d24fcc3ac

SHA1
a29837ec5b695db82ed411eb5b1bc0a52655fb0a

SHA256
6c91c3d2f267a5a45f15d070e6f83bf6e34e1d5f79f683046c5ce82362070bda

SHA512
9e6f2859a4fe90e5727b812a7a609a2f90bc269c084b6faf65453657ec99f5a8eaaa60200110416ad22b96acc426a68ec8e31301e25590daccd25bcedefb34cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
055604e9d9074077b408c826d5a88055

SHA1
90ff561daa6e58c227bad0addb54286ea06adb82

SHA256
f7e69555bafc6d8f5a8fb3ef25c5adc3fb3fe3c945335e627c4a1910fb7ff39c

SHA512
0b2152d0e5da205ec8eb4e9bfaa97e2830ec185c3848bc0689dad758381e6e3ad8ca9c6dcdb4b4d3251053e9ecccfd0bbbe284b9102d66036a8a84b848ba9f49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7b3d76976509f42f1974329c02cb35a6

SHA1
d8f6f45688f9c16bdcce4a54f0fc1c99c6e8887a

SHA256
f4ff13ef75dda0730c18b5f7218a50eaf0a5b6d37da1e5d01218cb87617f3c28

SHA512
a4bdd0d544aeb68099772930653fc52cedee14f34f08bde9a3cfc9675abc91272b2156770a332ee59d47d727f07b1b307518abc2301d8826561d8d7de156d69d

Download Submit