21757a8faae0149f69a6a9952695d30f3859dad12b1f0b63d4197db9b88a6d02

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 09:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

395949198926d2cfa847443537aadf20_JaffaCakes118.html
Size

142KB
MD5

395949198926d2cfa847443537aadf20
SHA1

feb3bb251f2997c7554c69492f8f209bbe9b5ed1
SHA256

21757a8faae0149f69a6a9952695d30f3859dad12b1f0b63d4197db9b88a6d02
SHA512

30cde9f74bf04961590d2b14f0e285cb9e6df7341ec24ed37d37bf642e2d17621a3e5ed8383a4e15a84af3f3688b37e0b7507e7e442a4f0527610e8a4baf9a80
SSDEEP

1536:SNmgwoQ3Wn93cx76vuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXAZ:S7Uhx7dyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
760	msedge.exe
760	msedge.exe
3172	msedge.exe
3172	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3172	msedge.exe
3172	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 1184	3172	msedge.exe	81
PID 3172 wrote to memory of 1184	3172	msedge.exe	81
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 1552	3172	msedge.exe	82
PID 3172 wrote to memory of 760	3172	msedge.exe	83
PID 3172 wrote to memory of 760	3172	msedge.exe	83
PID 3172 wrote to memory of 2280	3172	msedge.exe	84
PID 3172 wrote to memory of 2280	3172	msedge.exe	84
PID 3172 wrote to memory of 2280	3172	msedge.exe	84
PID 3172 wrote to memory of 2280	3172	msedge.exe	84
PID 3172 wrote to memory of 2280	3172	msedge.exe	84
PID 3172 wrote to memory of 2280	3172	msedge.exe	84
PID 3172 wrote to memory of 2280	3172	msedge.exe	84
PID 3172 wrote to memory of 2280	3172	msedge.exe	84
PID 3172 wrote to memory of 2280	3172	msedge.exe	84
PID 3172 wrote to memory of 2280	3172	msedge.exe	84
PID 3172 wrote to memory of 2280	3172	msedge.exe	84
PID 3172 wrote to memory of 2280	3172	msedge.exe	84
PID 3172 wrote to memory of 2280	3172	msedge.exe	84
PID 3172 wrote to memory of 2280	3172	msedge.exe	84
PID 3172 wrote to memory of 2280	3172	msedge.exe	84
PID 3172 wrote to memory of 2280	3172	msedge.exe	84
PID 3172 wrote to memory of 2280	3172	msedge.exe	84
PID 3172 wrote to memory of 2280	3172	msedge.exe	84
PID 3172 wrote to memory of 2280	3172	msedge.exe	84
PID 3172 wrote to memory of 2280	3172	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\395949198926d2cfa847443537aadf20_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb923946f8,0x7ffb92394708,0x7ffb92394718
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,2624055739287638962,6044899978089082181,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,2624055739287638962,6044899978089082181,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,2624055739287638962,6044899978089082181,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,2624055739287638962,6044899978089082181,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,2624055739287638962,6044899978089082181,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,2624055739287638962,6044899978089082181,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4992 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
89d0749367eac0b67ebc7743bd8b248c

SHA1
a5e9de2db460be73ba1e6c692e0851903bf19a52

SHA256
1fc126fc4a26afe010808a38f3145c3917e9adf1487db4f1da279b317a29b243

SHA512
3625a5cfde3e47b76332e5f6a0a83b52a9370c1597ceb5d10d9eadea034abf322ccf9b67e626157a7a5c726952b1ac7a8e52a403ed547c8b062879836f944b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bf35a9d8c94f4d8c48ea6823e6d88caa

SHA1
74b9116c0f817d0702d89b5bb4f162313f93dca9

SHA256
5e70346e519b3238f443bf15ef84c5c39cd321c90e1c979c0ef343a54e414cd4

SHA512
b9ff0687902ee6857e2a70027378d7056cefd5718e07cf30ca6e9cf853496b1d39cef1cd3e677bc4aec10e0952ad1b7650730cd9d70e6aad712cdc17d42505f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6ee6bb4f4e8a0e170ba1050b87cf5dbb

SHA1
3f6395a6307743f4211297b9a35a236b4ec2d979

SHA256
49cce3e39cfff25f1478b6871dbd203cda88d24fe9d1f54f549f9257cb1e45ff

SHA512
a8dd067dd14e25ac4d2b9f37d18e9312d9825f9913890d7f77b9a5a5b1f1ff79a901ed41427e960b032b8ec4e86f5f635469ff27dd0afad33f67f2f21fb38577

Download Submit