e6f18debffd28a5fa5c3ea87d1414d7d08a6bc5b4c83f07b8d6082c9db457a96

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 19:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

36317cfbbab4270fb2320d7fe22e1d41_JaffaCakes118.html
Size

139KB
MD5

36317cfbbab4270fb2320d7fe22e1d41
SHA1

9b238393d53cdfec4aa346a3c55003fddc8bc0a3
SHA256

e6f18debffd28a5fa5c3ea87d1414d7d08a6bc5b4c83f07b8d6082c9db457a96
SHA512

7a5a97f210b760911ea1d745b5e69ea6601cca0ebff1d8d50fc2991558c1bc5245cdd3840e886aef967611fbee09ccd768c50b0370fc12f42f7e00e93603f099
SSDEEP

3072:S/ejlFjb4jGyfkMY+BES09JXAnyrZalI+YQ:S/bsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
928	msedge.exe
928	msedge.exe
1344	msedge.exe
1344	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1344	msedge.exe
1344	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 892	1344	msedge.exe	83
PID 1344 wrote to memory of 892	1344	msedge.exe	83
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 1904	1344	msedge.exe	84
PID 1344 wrote to memory of 928	1344	msedge.exe	85
PID 1344 wrote to memory of 928	1344	msedge.exe	85
PID 1344 wrote to memory of 1484	1344	msedge.exe	86
PID 1344 wrote to memory of 1484	1344	msedge.exe	86
PID 1344 wrote to memory of 1484	1344	msedge.exe	86
PID 1344 wrote to memory of 1484	1344	msedge.exe	86
PID 1344 wrote to memory of 1484	1344	msedge.exe	86
PID 1344 wrote to memory of 1484	1344	msedge.exe	86
PID 1344 wrote to memory of 1484	1344	msedge.exe	86
PID 1344 wrote to memory of 1484	1344	msedge.exe	86
PID 1344 wrote to memory of 1484	1344	msedge.exe	86
PID 1344 wrote to memory of 1484	1344	msedge.exe	86
PID 1344 wrote to memory of 1484	1344	msedge.exe	86
PID 1344 wrote to memory of 1484	1344	msedge.exe	86
PID 1344 wrote to memory of 1484	1344	msedge.exe	86
PID 1344 wrote to memory of 1484	1344	msedge.exe	86
PID 1344 wrote to memory of 1484	1344	msedge.exe	86
PID 1344 wrote to memory of 1484	1344	msedge.exe	86
PID 1344 wrote to memory of 1484	1344	msedge.exe	86
PID 1344 wrote to memory of 1484	1344	msedge.exe	86
PID 1344 wrote to memory of 1484	1344	msedge.exe	86
PID 1344 wrote to memory of 1484	1344	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\36317cfbbab4270fb2320d7fe22e1d41_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff96de446f8,0x7ff96de44708,0x7ff96de44718
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,17517116543231049787,17867259077095162007,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,17517116543231049787,17867259077095162007,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,17517116543231049787,17867259077095162007,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17517116543231049787,17867259077095162007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17517116543231049787,17867259077095162007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,17517116543231049787,17867259077095162007,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4904 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e5646494e1578efe058e133b7c30bb3b

SHA1
f29705339be77102cc96eb61a2a4933ef3b25ab9

SHA256
6ab662906284143c0c22162777d70ef28c23cd5e14da72473b476edca93e0744

SHA512
4f3e16af10d3cf30d0d079b063d2055ed0d97316293d047c6fd37104def9f8d70bd2d04578616c56eb2d5fdb83d6b1d430eba509bc3ab6f66d8e0ef00b2dcdd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9f6993da95428f5639887d562256fde1

SHA1
7134079a3fd4b312f8612f819d46f42f0f3b5001

SHA256
b8c7ca3bc12fdf42919b9373803e759a65e23fbc69c14ee6c7d215847ccead43

SHA512
09d66273e93eb6d8310b8f7be1cc0229d186664f14f3d91024c02f18e7ea8c5d43c31144f3b9e96af52faa08bae589416930b40b93742573b98081dc24ff2b3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ea126863bf70677c34f8d33332e91893

SHA1
4fcc7d09c18d76c4a820abe523e509f5dcfe1e14

SHA256
58e1eaac1a089b4830b0122b2801d9c1e3d13ff595c97aa1fa8398ae0d067f38

SHA512
f83a0a97b4f4762c12fc312f9671e6a2bfa132c8dd61c6c8c554cc0d180b69b8aa2f953b7386a0a22614101e919536c467c71065ec271648fc39c6e1979ffc50

Download Submit