617eb2a85f0173bb6ac7af3b9ec4ebb365c0036a93dabd0db8c16e3e8b92d89b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 15:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4035fa58c81d1421ee75f2564e2f31af_JaffaCakes118.html
Size

19KB
MD5

4035fa58c81d1421ee75f2564e2f31af
SHA1

e0796f6f38342d4a061555c55cdfb73574a34cf5
SHA256

617eb2a85f0173bb6ac7af3b9ec4ebb365c0036a93dabd0db8c16e3e8b92d89b
SHA512

3f292212d82106359b34c7a86cca131db8f97c508121f293b176ca1904e6f298a241b8039f9be1f57cbb30e4010980565f242ea2b04485d3d5b5e663d02c81e3
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIE46zUnjBhGI82qDB8:SIMd0I5nO9HTsvGbxDB8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1232	msedge.exe
1232	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1580	msedge.exe
1580	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 3424	1580	msedge.exe	83
PID 1580 wrote to memory of 3424	1580	msedge.exe	83
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 668	1580	msedge.exe	84
PID 1580 wrote to memory of 1232	1580	msedge.exe	85
PID 1580 wrote to memory of 1232	1580	msedge.exe	85
PID 1580 wrote to memory of 4004	1580	msedge.exe	86
PID 1580 wrote to memory of 4004	1580	msedge.exe	86
PID 1580 wrote to memory of 4004	1580	msedge.exe	86
PID 1580 wrote to memory of 4004	1580	msedge.exe	86
PID 1580 wrote to memory of 4004	1580	msedge.exe	86
PID 1580 wrote to memory of 4004	1580	msedge.exe	86
PID 1580 wrote to memory of 4004	1580	msedge.exe	86
PID 1580 wrote to memory of 4004	1580	msedge.exe	86
PID 1580 wrote to memory of 4004	1580	msedge.exe	86
PID 1580 wrote to memory of 4004	1580	msedge.exe	86
PID 1580 wrote to memory of 4004	1580	msedge.exe	86
PID 1580 wrote to memory of 4004	1580	msedge.exe	86
PID 1580 wrote to memory of 4004	1580	msedge.exe	86
PID 1580 wrote to memory of 4004	1580	msedge.exe	86
PID 1580 wrote to memory of 4004	1580	msedge.exe	86
PID 1580 wrote to memory of 4004	1580	msedge.exe	86
PID 1580 wrote to memory of 4004	1580	msedge.exe	86
PID 1580 wrote to memory of 4004	1580	msedge.exe	86
PID 1580 wrote to memory of 4004	1580	msedge.exe	86
PID 1580 wrote to memory of 4004	1580	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4035fa58c81d1421ee75f2564e2f31af_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f44046f8,0x7ff8f4404708,0x7ff8f4404718
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,1737085932066374942,12456943618817275732,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,1737085932066374942,12456943618817275732,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,1737085932066374942,12456943618817275732,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1737085932066374942,12456943618817275732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1737085932066374942,12456943618817275732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,1737085932066374942,12456943618817275732,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d962258916f020067dc88f1946608011

SHA1
9d81571b7f43bacd808659db10d3476c1d836f6f

SHA256
557d160fc6a0de22e77b5a14a07badacc4db281e85788afe84fafaf2a2942613

SHA512
d0de5ad6aa0a6edaae976098098037fb34e442aa1dfc2ea8e135c8444f735e98e7c3b77cd0945d8066503e512e5b8f159b3b99795f50c957ffcc203ed81e961a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
104f9e2ab6222db2b837e4f627bb4be4

SHA1
4f61f9614b77095712cdee2160733915c3334716

SHA256
993e35fd1cde33a381f04d73cdb68859a133ebae178169a3b7971e22fbf1c84b

SHA512
022d4835bac3861daf3aaa3c80d58452d2a339c05d27548c01715b763eac70c9d1d648310417a00702097409ca05979e08d847dded5c64235b6518fc8b99234e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
360fb8bf160c604dcdddb8e0afe728e8

SHA1
591545bf744b5c32df0a92f367dd7e3fe61d778b

SHA256
64c82c6375b0aff61422e8dc7eab281f79d2b9068eda062f3fce6a95ed17c508

SHA512
8de79a4cfcbc34a694599c671e3782271692f09024e04598e90aaf33f7551bea55044a91a9458c801b95b76b98da49242ee182b293b38d25b031eb239749ba44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e7c3a3ae913d17d69ecda26b0e451eba

SHA1
0a3bb28f6590ef0919e8f797cda004c7272a960e

SHA256
9e13a8bf88e419444d19ab95706205bf9f8f72edd34771599d21d80ceae30799

SHA512
e8ef30d0d871f8a29003d4514d662d444c39fc74896a667a8328783d35de110b6fd5bd071189bbe4fe2d999273052960f42c888e5cc935da52c7acce3aed5bbc

Download Submit