ebca16add5cbc95aa2313853b71b349ed85568ad4a050f349844cb5e29439349

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3526c20e58ebe21375d290604d09512b_JaffaCakes118.html
Size

160KB
MD5

3526c20e58ebe21375d290604d09512b
SHA1

342bb3c9aff4fdcc9e3f40c52f211ca75f8cee76
SHA256

ebca16add5cbc95aa2313853b71b349ed85568ad4a050f349844cb5e29439349
SHA512

7720c8ddfca1cb89454c06ce3f6e10dddae12dd9b5ba02feccbf213785dae9e75328417f03bd2f8462ee7cba1723cff7903f46b25343d51b52f7ff5d2a467d56
SSDEEP

3072:S+Gosr30t2yfkMY+BES09JXAnyrZalI+YQ:S+/sr305sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4264	msedge.exe
4264	msedge.exe
3388	msedge.exe
3388	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4264	msedge.exe
4264	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 116	4264	msedge.exe	83
PID 4264 wrote to memory of 116	4264	msedge.exe	83
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3152	4264	msedge.exe	84
PID 4264 wrote to memory of 3388	4264	msedge.exe	85
PID 4264 wrote to memory of 3388	4264	msedge.exe	85
PID 4264 wrote to memory of 1072	4264	msedge.exe	86
PID 4264 wrote to memory of 1072	4264	msedge.exe	86
PID 4264 wrote to memory of 1072	4264	msedge.exe	86
PID 4264 wrote to memory of 1072	4264	msedge.exe	86
PID 4264 wrote to memory of 1072	4264	msedge.exe	86
PID 4264 wrote to memory of 1072	4264	msedge.exe	86
PID 4264 wrote to memory of 1072	4264	msedge.exe	86
PID 4264 wrote to memory of 1072	4264	msedge.exe	86
PID 4264 wrote to memory of 1072	4264	msedge.exe	86
PID 4264 wrote to memory of 1072	4264	msedge.exe	86
PID 4264 wrote to memory of 1072	4264	msedge.exe	86
PID 4264 wrote to memory of 1072	4264	msedge.exe	86
PID 4264 wrote to memory of 1072	4264	msedge.exe	86
PID 4264 wrote to memory of 1072	4264	msedge.exe	86
PID 4264 wrote to memory of 1072	4264	msedge.exe	86
PID 4264 wrote to memory of 1072	4264	msedge.exe	86
PID 4264 wrote to memory of 1072	4264	msedge.exe	86
PID 4264 wrote to memory of 1072	4264	msedge.exe	86
PID 4264 wrote to memory of 1072	4264	msedge.exe	86
PID 4264 wrote to memory of 1072	4264	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3526c20e58ebe21375d290604d09512b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff16cc46f8,0x7fff16cc4708,0x7fff16cc4718
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,3462155002361550403,986201758735326104,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,3462155002361550403,986201758735326104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,3462155002361550403,986201758735326104,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3462155002361550403,986201758735326104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3462155002361550403,986201758735326104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,3462155002361550403,986201758735326104,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b1b0e29452e9b991a476e17d4e73a576

SHA1
3b58777299ef003b41138656b1ab4c57b3b60bbd

SHA256
72e7d9dbaa0df74dc0a65ee38047616c27e60a2c3d99eeb810615fb431da3e9a

SHA512
80704fc32235802f199379a9bc1d5c0bffd5ff3b53c163a8e3c4eb738a7c873dd1a3a58cdc8037e1ba3827532ad5b18a888114ccab1a0d0262fe3f9b3392c67b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f9eb9bc8afef326d3b1a8388fd1b1255

SHA1
e0b05597a7d92f9ac7110533ad11abb4e65dcfd1

SHA256
61d4765b50a23693a17745a33812f38619719859acec597b6a948cb4f5297046

SHA512
4ecffa08e1c2875254dcab6185ff82b0c6f7a1fe21427c621ab7b82305c52c1ee99e5b5862f17d1f4048070405ac7a2a2d50c90960995c6bf14e136e25c36847

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
061e30cef655e49553a85ad7741cb9ce

SHA1
58877770ade9ac4e1fc02eb64631a70c2229a3f1

SHA256
e9956d9702cca873d4e9abadcd46e24436bcef81558f0d99a2d8b6019448dde0

SHA512
12e5f47752b2f535fa66f5e82b5ae50fcc6e5ea15344f83ee244c6ba16c6ad7e7104db6320f08ce7013ba8fd71798367ac646c812ba34227cd81f8d704a7f834

Download Submit