76bf47c88b7b57d0dba11eb3d700ffcad25425fcd33e9d7ca5560c360751c1b6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 04:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

385fa934a8b99cbdc1d5b762227f00cf_JaffaCakes118.html
Size

138KB
MD5

385fa934a8b99cbdc1d5b762227f00cf
SHA1

380ed2809badce2525996b7aaab07c4ddbbda67d
SHA256

76bf47c88b7b57d0dba11eb3d700ffcad25425fcd33e9d7ca5560c360751c1b6
SHA512

77b8676345f4b74b18142940b63764b44636dc4cea795fc9d4789f418a3391a15cdecdb8c0eefdd8d39fd322636991581c9fc941fb2402baf718efabc98b703a
SSDEEP

1536:SPvg1E+lR1yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTs:SP41yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
2500	msedge.exe
2500	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 4928	2500	msedge.exe	82
PID 2500 wrote to memory of 4928	2500	msedge.exe	82
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 4136	2500	msedge.exe	83
PID 2500 wrote to memory of 3664	2500	msedge.exe	84
PID 2500 wrote to memory of 3664	2500	msedge.exe	84
PID 2500 wrote to memory of 4768	2500	msedge.exe	85
PID 2500 wrote to memory of 4768	2500	msedge.exe	85
PID 2500 wrote to memory of 4768	2500	msedge.exe	85
PID 2500 wrote to memory of 4768	2500	msedge.exe	85
PID 2500 wrote to memory of 4768	2500	msedge.exe	85
PID 2500 wrote to memory of 4768	2500	msedge.exe	85
PID 2500 wrote to memory of 4768	2500	msedge.exe	85
PID 2500 wrote to memory of 4768	2500	msedge.exe	85
PID 2500 wrote to memory of 4768	2500	msedge.exe	85
PID 2500 wrote to memory of 4768	2500	msedge.exe	85
PID 2500 wrote to memory of 4768	2500	msedge.exe	85
PID 2500 wrote to memory of 4768	2500	msedge.exe	85
PID 2500 wrote to memory of 4768	2500	msedge.exe	85
PID 2500 wrote to memory of 4768	2500	msedge.exe	85
PID 2500 wrote to memory of 4768	2500	msedge.exe	85
PID 2500 wrote to memory of 4768	2500	msedge.exe	85
PID 2500 wrote to memory of 4768	2500	msedge.exe	85
PID 2500 wrote to memory of 4768	2500	msedge.exe	85
PID 2500 wrote to memory of 4768	2500	msedge.exe	85
PID 2500 wrote to memory of 4768	2500	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\385fa934a8b99cbdc1d5b762227f00cf_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa05d646f8,0x7ffa05d64708,0x7ffa05d64718
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,11096370759262626999,15402445450695749685,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,11096370759262626999,15402445450695749685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,11096370759262626999,15402445450695749685,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11096370759262626999,15402445450695749685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11096370759262626999,15402445450695749685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,11096370759262626999,15402445450695749685,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ea772c7d34f037f288d8ecefb28b4249

SHA1
b580ce53f7c787480f37bb4cd9c5a4fd962f4f34

SHA256
09734adaa37deae8b8964a1c88f7cbb50a50e0a7285241099f55a4bb3e768dc4

SHA512
0d9b91839436b67b728fcf262da2ed4203fb4eaa98442a97ce64d6b8e46305d25c7d934c96f01063e819c92a8a614bc11cbfb3c56b7da892959b8f5f0a801a26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7b044aeb6645b74599ed3a041dbc6ff7

SHA1
1278390a3d8646c1796589295de1d0d1248aa250

SHA256
7570f5f7ce471c686daea2becadd07f542d169856ee13ff1d4a22415b156d97a

SHA512
defe89d660a39f5fe75a881dbc4f0833be98fa1a70c2f9d9be98f61537a1373aaad752492fe4b034a78de6206658b420d9a7d280c4bc1d18e893cb4ab8c86cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6afff5285ae3097bbdb4805788b87e42

SHA1
f3d4a0b17810fc12149e72d0b5f26c7f9ceb82e5

SHA256
245fbb72e534e7ac0ef7cb477af48479f7939538b356dccf74b617440030ce97

SHA512
6887bf56c3adcf3407811f1d4700c9e88098632dbe9c4b0ee486fe809025237d955f03a8c9c44d7ee4b8874a6d8754c63bff5f99fc7767dc937c178c1a7e4b8a

Download Submit