88cba76c5aaf7fb8612fb52149a9d4ac5bf6a12e8d8bf78541e5ecd63b5be9df

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 01:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37a0d74a5432ca028703b1707058c782_JaffaCakes118.html
Size

128KB
MD5

37a0d74a5432ca028703b1707058c782
SHA1

5649415ee72ee6d17b83d7a2fb1491cef6ea768f
SHA256

88cba76c5aaf7fb8612fb52149a9d4ac5bf6a12e8d8bf78541e5ecd63b5be9df
SHA512

50c2a5b5b5563fe93a25e21799b3daa034e544e5b0a0f36fe87e4d15177ef26c2c963dde6bca03ee42d1c0d19d946ffde348983b2a146718385078d4440ee65f
SSDEEP

1536:S4aj0o7AjxLRnnfFXyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3p:S4baAPFXyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4092	msedge.exe
4092	msedge.exe
5028	msedge.exe
5028	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 2432	5028	msedge.exe	82
PID 5028 wrote to memory of 2432	5028	msedge.exe	82
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 2148	5028	msedge.exe	83
PID 5028 wrote to memory of 4092	5028	msedge.exe	84
PID 5028 wrote to memory of 4092	5028	msedge.exe	84
PID 5028 wrote to memory of 3488	5028	msedge.exe	85
PID 5028 wrote to memory of 3488	5028	msedge.exe	85
PID 5028 wrote to memory of 3488	5028	msedge.exe	85
PID 5028 wrote to memory of 3488	5028	msedge.exe	85
PID 5028 wrote to memory of 3488	5028	msedge.exe	85
PID 5028 wrote to memory of 3488	5028	msedge.exe	85
PID 5028 wrote to memory of 3488	5028	msedge.exe	85
PID 5028 wrote to memory of 3488	5028	msedge.exe	85
PID 5028 wrote to memory of 3488	5028	msedge.exe	85
PID 5028 wrote to memory of 3488	5028	msedge.exe	85
PID 5028 wrote to memory of 3488	5028	msedge.exe	85
PID 5028 wrote to memory of 3488	5028	msedge.exe	85
PID 5028 wrote to memory of 3488	5028	msedge.exe	85
PID 5028 wrote to memory of 3488	5028	msedge.exe	85
PID 5028 wrote to memory of 3488	5028	msedge.exe	85
PID 5028 wrote to memory of 3488	5028	msedge.exe	85
PID 5028 wrote to memory of 3488	5028	msedge.exe	85
PID 5028 wrote to memory of 3488	5028	msedge.exe	85
PID 5028 wrote to memory of 3488	5028	msedge.exe	85
PID 5028 wrote to memory of 3488	5028	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\37a0d74a5432ca028703b1707058c782_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8030d46f8,0x7ff8030d4708,0x7ff8030d4718
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,10441148802116832924,5904120804441877796,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,10441148802116832924,5904120804441877796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,10441148802116832924,5904120804441877796,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10441148802116832924,5904120804441877796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10441148802116832924,5904120804441877796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10441148802116832924,5904120804441877796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10441148802116832924,5904120804441877796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,10441148802116832924,5904120804441877796,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4776 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7bb4ea27-731b-4831-9633-df5a2aeca844.tmp

Filesize
11KB

MD5
4b8a1996e1f0ebeb3bfcb4087438bf5a

SHA1
9592401c7fc28b422d28e73aee188d3cdb8a6856

SHA256
5e7c590abc63440530ce0801d72f7db773375284b17bca5c37f4d27113cea98a

SHA512
67619ab3fe605395b1b5b8e47b27d6088befde711a5a048e7d60e349287f5200aff66627e62569a0e709fdabf4f21174f7415ac47c7fd0ff762339fd7ff707d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
2c90bee846aaa2c6940aa16f3335f6e8

SHA1
be4f36e505407e5df739d2d38a8186dc8f387bdc

SHA256
33f96b89929b17f2c4505ad16bf2eacca865f2908189ec48c34a0f0169bc38c3

SHA512
7555770f94fb7cc43e658b46c8558b57d44507283c1f35a058c86e2a1b07ec7b93650217542e6db8dde2815ad1118cbb7d7c26a51c4f273447a97b4499627900

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
256B

MD5
6c5bf90cbdfb6fdf7bc98e436b82555f

SHA1
a7c991c7f1846deae5e5dfbaa06fbc655c0593f5

SHA256
81794077b853f615a3dc2e4fd96afcd7d71fd7fac9dbe09d5d1bf0e225a15322

SHA512
fd9f53d0d95851d2ac4053acd99147ead512511bbbdd760e7a9de3436ff28695e46f5ec884f925598fa1523c558f6da87af15a93ae2390072b03d101905539a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
11afb13d70ae48bc84a68adeab1ab1d6

SHA1
a9f6fca2ee259d432d61e53b3d5b10374f35294b

SHA256
b6b51a115bcc2b916433b0ed0b3e198e699dbb280551acddcb4e94902e8f78ca

SHA512
aa49989cde9360fedcc815578893727a9d472fab350f089e1b6d807cdd9b985b0a63f2990edabc3c8e18ac59d8894ad538712ce9e067d13c339a578fe19c56f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
51b5453933f5888e4ebaf2d459c6b0d5

SHA1
560a60430ac71ffc61bc659383d618061f4eed25

SHA256
ce1b6a8597164a670e423907c4e7b482aca57effb99dcf270f5b4fbe8d538bec

SHA512
4405b5985df08dac969953c2b7da54a27125f2e2205d119a171f75167b5ebd9e1d84e041d4d1b0cab02f29cb5cfe2b0cd592ac12bb4ff4ae414c136ac08e3c38

Download Submit