93ce9f5213e7d3be3e54c331f20bae4e9813caf257dd1c569456cabacc799ddb

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 07:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3e4b1696d19615869738ddef064ab6c4_JaffaCakes118.html
Size

220KB
MD5

3e4b1696d19615869738ddef064ab6c4
SHA1

222f271a4955a4d4d2af1f7c010a50f84b5a42af
SHA256

93ce9f5213e7d3be3e54c331f20bae4e9813caf257dd1c569456cabacc799ddb
SHA512

17c3bdc4d88afb0daf67bc7cbc4f9af6cfa2db27c30fc58242f22aa412d5b1c9c0429eb4d050cb18f79aab5349dd2a79803147514e42ea9fe2b42cf54d6a9137
SSDEEP

3072:S4snqEKz2Lppq37yfkMY+BES09JXAnyrZalI+YQ:S4yCtusMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1644	msedge.exe
1644	msedge.exe
2284	msedge.exe
2284	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2284	msedge.exe
2284	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 3164	2284	msedge.exe	85
PID 2284 wrote to memory of 3164	2284	msedge.exe	85
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 4332	2284	msedge.exe	88
PID 2284 wrote to memory of 1644	2284	msedge.exe	89
PID 2284 wrote to memory of 1644	2284	msedge.exe	89
PID 2284 wrote to memory of 2268	2284	msedge.exe	90
PID 2284 wrote to memory of 2268	2284	msedge.exe	90
PID 2284 wrote to memory of 2268	2284	msedge.exe	90
PID 2284 wrote to memory of 2268	2284	msedge.exe	90
PID 2284 wrote to memory of 2268	2284	msedge.exe	90
PID 2284 wrote to memory of 2268	2284	msedge.exe	90
PID 2284 wrote to memory of 2268	2284	msedge.exe	90
PID 2284 wrote to memory of 2268	2284	msedge.exe	90
PID 2284 wrote to memory of 2268	2284	msedge.exe	90
PID 2284 wrote to memory of 2268	2284	msedge.exe	90
PID 2284 wrote to memory of 2268	2284	msedge.exe	90
PID 2284 wrote to memory of 2268	2284	msedge.exe	90
PID 2284 wrote to memory of 2268	2284	msedge.exe	90
PID 2284 wrote to memory of 2268	2284	msedge.exe	90
PID 2284 wrote to memory of 2268	2284	msedge.exe	90
PID 2284 wrote to memory of 2268	2284	msedge.exe	90
PID 2284 wrote to memory of 2268	2284	msedge.exe	90
PID 2284 wrote to memory of 2268	2284	msedge.exe	90
PID 2284 wrote to memory of 2268	2284	msedge.exe	90
PID 2284 wrote to memory of 2268	2284	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3e4b1696d19615869738ddef064ab6c4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf44a46f8,0x7ffaf44a4708,0x7ffaf44a4718
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,9922761074865450336,3907939921125336753,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,9922761074865450336,3907939921125336753,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,9922761074865450336,3907939921125336753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9922761074865450336,3907939921125336753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9922761074865450336,3907939921125336753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,9922761074865450336,3907939921125336753,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4924 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
741bec61fdd4bace487160fc34a01767

SHA1
2156de3a2e2ece8d59597a221a4d00618726ecf2

SHA256
db2618e02b55267e6e6c06fd0d07a8680f3ee81acf29f7e36de612b38bf1d43c

SHA512
9dffa1b5fad7d14b4b968d366d476ea6e76364b7c7f9ccd67a13e52915ac04c9e8f24919d51d810c2f386645a47f7af920e5dafe07c2a2c7996417aa7cb65cea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
efb5e190b2c2ec7d4a035f09f2e8a410

SHA1
a202c6ca67e211f3cbe3c59969e51812e0295197

SHA256
d42bb7c9e25d6f1a696cfdc1b158542c98194a7669a27603c0f848e510a0c50f

SHA512
459b57fc471baa17d46fcc2af48a7822f71ee6e7af9d52d8f0c60e1d56ebba012e02dfd46188659d1d37c6c5e3586fd34cd8bf2e7bf73a3c888b60b184c3faf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
43a610b80a15e9ddee4fe738ae2a77da

SHA1
8bbfe36756f191b8db03d4f44b29b467bb72d92d

SHA256
15651ffc6f3a5c3608ecaa22f526fd391e12c89230c9ef167a90ff47275053a7

SHA512
f36b5acfe9210cb96280bc6419a50bedc64d2b51c0d20d82484239ad4b22728a3a51bce0cacc2a4a6936756e531de39c12fd372526f63b5018f691201a63805f

Download Submit