3e81c03992f24d13e7fa0bb2a15e8ff6d15efb36cb6442b437cf93005b4d7db9

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 03:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3290ca3da7466ad4a1488a9d1dd3642c_JaffaCakes118.html
Size

218KB
MD5

3290ca3da7466ad4a1488a9d1dd3642c
SHA1

588e00d7fea1082b9228a9ea33ebb0cf549487ef
SHA256

3e81c03992f24d13e7fa0bb2a15e8ff6d15efb36cb6442b437cf93005b4d7db9
SHA512

e2a1249def504a3503b5793571cf0cb056ecdeda5311c153a28d4406cbb14b9d950a39f27b59178909de72b659e4f457ab4dd5352b6dfe7986229e95ced3de02
SSDEEP

3072:ZMwmef/6QlPyfkMY+BES09JXAnyrZalI+YQ:Ww//NlasMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
216	msedge.exe
216	msedge.exe
1596	msedge.exe
1596	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1596	msedge.exe
1596	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 2744	1596	msedge.exe	82
PID 1596 wrote to memory of 2744	1596	msedge.exe	82
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 4412	1596	msedge.exe	84
PID 1596 wrote to memory of 216	1596	msedge.exe	85
PID 1596 wrote to memory of 216	1596	msedge.exe	85
PID 1596 wrote to memory of 2940	1596	msedge.exe	86
PID 1596 wrote to memory of 2940	1596	msedge.exe	86
PID 1596 wrote to memory of 2940	1596	msedge.exe	86
PID 1596 wrote to memory of 2940	1596	msedge.exe	86
PID 1596 wrote to memory of 2940	1596	msedge.exe	86
PID 1596 wrote to memory of 2940	1596	msedge.exe	86
PID 1596 wrote to memory of 2940	1596	msedge.exe	86
PID 1596 wrote to memory of 2940	1596	msedge.exe	86
PID 1596 wrote to memory of 2940	1596	msedge.exe	86
PID 1596 wrote to memory of 2940	1596	msedge.exe	86
PID 1596 wrote to memory of 2940	1596	msedge.exe	86
PID 1596 wrote to memory of 2940	1596	msedge.exe	86
PID 1596 wrote to memory of 2940	1596	msedge.exe	86
PID 1596 wrote to memory of 2940	1596	msedge.exe	86
PID 1596 wrote to memory of 2940	1596	msedge.exe	86
PID 1596 wrote to memory of 2940	1596	msedge.exe	86
PID 1596 wrote to memory of 2940	1596	msedge.exe	86
PID 1596 wrote to memory of 2940	1596	msedge.exe	86
PID 1596 wrote to memory of 2940	1596	msedge.exe	86
PID 1596 wrote to memory of 2940	1596	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3290ca3da7466ad4a1488a9d1dd3642c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xd8,0x110,0x7ffb611046f8,0x7ffb61104708,0x7ffb61104718
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13429836738240805057,12687060861644762663,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,13429836738240805057,12687060861644762663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,13429836738240805057,12687060861644762663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13429836738240805057,12687060861644762663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13429836738240805057,12687060861644762663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13429836738240805057,12687060861644762663,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3008 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
266B

MD5
89b056240af807a1278d46f325dc5f62

SHA1
1e66dd4c9e030c5d2c23047a085822a372f17887

SHA256
f5f9f29fbb067a58ba60bebb0f36a61c535a234e45ff52f47f192d2836bac9f7

SHA512
109696dba2069f9b711948a93ebb6be8ee851336b14512c613196ca495158e8e53c3ad9bbc07aed6ea037b432f1101492a0e3c761d658f78e6e04d87b2715044

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
85d4d496bb9769d22117c48e6694bcea

SHA1
27825474e0bcf224e4e76d972c58cd220616bbda

SHA256
7fe4d2e9599fcd57ed24715293c0ee4266c9716cbd7c3d69e2aa164d1734e340

SHA512
9028547adce18c5a00cc46cfb224266d517414976ea076c6d359e70e6e30bafc8b2b1569314282bd2d883c171caaa6839aaf51a71595d41b8e93a7231b9e629f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
646bd675f1fdc2c1ab67d928559405aa

SHA1
26912937fc2491b55d827472f3725d9f2905e1f0

SHA256
95aba8d38539d3ac50e445b3ba3ebb4ea9edd28e264459b19d2da2b7a340ca70

SHA512
21fa809b7dce8d698239b69dc3ba088517f0cde4dce9a25584f10b76f74f135bb30dc68a83c8f098de29e55154d23f1b6b0643aaffadf846d1f2fae0fee75dd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
26f05b6230322cb8fe9ef7da9c8ac2ad

SHA1
d71aee1f1126f2507bf3d67e84e131776d998d6a

SHA256
cd95650d3542dbeae31b886257c3d07e970303aaee21662a696d2575e671a5c4

SHA512
c724bf8982bf250cc5836d581f1533ad4ab9dd7d8d66dfd9842fd3d24a4630410ba008510f5b8e84901bb275123391c2bc3658132f041a535d16a0e4ecb980da

Download Submit