53da48780d471017e66047eeb4fd7fa32172ddd0679de7665bc690c5e397e68a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a1a5dbbd5dde7e58e1c62740e21a85b_JaffaCakes118.html
Size

139KB
MD5

3a1a5dbbd5dde7e58e1c62740e21a85b
SHA1

eba7cb52e56741a213e247061fbe3eb36cd079b5
SHA256

53da48780d471017e66047eeb4fd7fa32172ddd0679de7665bc690c5e397e68a
SHA512

53a01a96095939a16c3ade7022c856c8031db711ac99a512b2a083b8e3a4d3d7fc4f73dc17c524192321c1f7beed9799ac8004cdb13c8dd3d0af73e51550004f
SSDEEP

1536:Sh37bEhoAlZryLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:ShnUo0yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2524	msedge.exe
2524	msedge.exe
1200	msedge.exe
1200	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1200	msedge.exe
1200	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 552	1200	msedge.exe	82
PID 1200 wrote to memory of 552	1200	msedge.exe	82
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 1988	1200	msedge.exe	83
PID 1200 wrote to memory of 2524	1200	msedge.exe	84
PID 1200 wrote to memory of 2524	1200	msedge.exe	84
PID 1200 wrote to memory of 4084	1200	msedge.exe	85
PID 1200 wrote to memory of 4084	1200	msedge.exe	85
PID 1200 wrote to memory of 4084	1200	msedge.exe	85
PID 1200 wrote to memory of 4084	1200	msedge.exe	85
PID 1200 wrote to memory of 4084	1200	msedge.exe	85
PID 1200 wrote to memory of 4084	1200	msedge.exe	85
PID 1200 wrote to memory of 4084	1200	msedge.exe	85
PID 1200 wrote to memory of 4084	1200	msedge.exe	85
PID 1200 wrote to memory of 4084	1200	msedge.exe	85
PID 1200 wrote to memory of 4084	1200	msedge.exe	85
PID 1200 wrote to memory of 4084	1200	msedge.exe	85
PID 1200 wrote to memory of 4084	1200	msedge.exe	85
PID 1200 wrote to memory of 4084	1200	msedge.exe	85
PID 1200 wrote to memory of 4084	1200	msedge.exe	85
PID 1200 wrote to memory of 4084	1200	msedge.exe	85
PID 1200 wrote to memory of 4084	1200	msedge.exe	85
PID 1200 wrote to memory of 4084	1200	msedge.exe	85
PID 1200 wrote to memory of 4084	1200	msedge.exe	85
PID 1200 wrote to memory of 4084	1200	msedge.exe	85
PID 1200 wrote to memory of 4084	1200	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3a1a5dbbd5dde7e58e1c62740e21a85b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8591c46f8,0x7ff8591c4708,0x7ff8591c4718
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,72245799724609334,4925511577128832179,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,72245799724609334,4925511577128832179,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,72245799724609334,4925511577128832179,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,72245799724609334,4925511577128832179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,72245799724609334,4925511577128832179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,72245799724609334,4925511577128832179,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4896 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
30c07007cbf0aad10ec63bad3d80ab6e

SHA1
52d0a97ed5ea644ecc69ede850edef08b0f61e14

SHA256
1614598724de356977d45e04b1da7acda86cc8d5e03d9421f0da6c9db1024fc0

SHA512
db135d000bc94a3a04bbef5ea9fafc5f951476b68038a551cd7dc861e0ab446931d7fc6b5c53cb2ef3e4a888c3c65ea2caad8e81655d838eb3dde99eccf0280b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9d604acb9049ceee924d7eedf3a8660d

SHA1
5239e913b1a02cc86a807f0774a97dd1903a1933

SHA256
b839be899e5ffb825feea480d1457eb0d170cc01d6111e55d1fc23bf298996fc

SHA512
2235b9b67e5ff636d2acc6c1b6d361e0f89b4e8203df5b9f898d79bc015300948adc24c81584c4307301d872b699dd25cc3ec7ca81143a2c5468f07250263861

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e0241d339e80d54dfb464218f3b2d7d5

SHA1
60adde1bffe2b58358e654e34c193cc408242368

SHA256
c235b32b1ddec597eab9a2cee2a21eb54b63de6b3398aeda1bc7e4c0b11d5737

SHA512
9b7b4d8c1403e38d74ead3dd1f770429c9dd0bca533947c1f3d42c028ff184050de62ac4fe20c22929c8574602207aedded691321fc2c085cd2809bfb6712078

Download Submit