44fb0ff1e2cf7adc0d333e9150f414134f804b656f7a133b80c9d41d2ec7d260

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c42051749fbb3ade942564a045a5844_JaffaCakes118.html
Size

213KB
MD5

3c42051749fbb3ade942564a045a5844
SHA1

bfdd6e52f7f22713a2d44605d7511fc36c72012d
SHA256

44fb0ff1e2cf7adc0d333e9150f414134f804b656f7a133b80c9d41d2ec7d260
SHA512

4a5c9e3091370b05a72460e27293a157dd3fadfe3a51553c69d4154991dfe5b4685248795ac683e666a2aebb4bb9bb56ba6fe5b65188df7009df5577e6c4a775
SSDEEP

3072:SJg5mhYdyquyfkMY+BES09JXAnyrZalI+YQ:SJlQLsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1644	msedge.exe
1644	msedge.exe
2840	msedge.exe
2840	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2840	msedge.exe
2840	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 3088	2840	msedge.exe	84
PID 2840 wrote to memory of 3088	2840	msedge.exe	84
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 2136	2840	msedge.exe	85
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 2464	2840	msedge.exe	87
PID 2840 wrote to memory of 2464	2840	msedge.exe	87
PID 2840 wrote to memory of 2464	2840	msedge.exe	87
PID 2840 wrote to memory of 2464	2840	msedge.exe	87
PID 2840 wrote to memory of 2464	2840	msedge.exe	87
PID 2840 wrote to memory of 2464	2840	msedge.exe	87
PID 2840 wrote to memory of 2464	2840	msedge.exe	87
PID 2840 wrote to memory of 2464	2840	msedge.exe	87
PID 2840 wrote to memory of 2464	2840	msedge.exe	87
PID 2840 wrote to memory of 2464	2840	msedge.exe	87
PID 2840 wrote to memory of 2464	2840	msedge.exe	87
PID 2840 wrote to memory of 2464	2840	msedge.exe	87
PID 2840 wrote to memory of 2464	2840	msedge.exe	87
PID 2840 wrote to memory of 2464	2840	msedge.exe	87
PID 2840 wrote to memory of 2464	2840	msedge.exe	87
PID 2840 wrote to memory of 2464	2840	msedge.exe	87
PID 2840 wrote to memory of 2464	2840	msedge.exe	87
PID 2840 wrote to memory of 2464	2840	msedge.exe	87
PID 2840 wrote to memory of 2464	2840	msedge.exe	87
PID 2840 wrote to memory of 2464	2840	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3c42051749fbb3ade942564a045a5844_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff76e346f8,0x7fff76e34708,0x7fff76e34718
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,6949912589133341511,1412625607464470626,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,6949912589133341511,1412625607464470626,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,6949912589133341511,1412625607464470626,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6949912589133341511,1412625607464470626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6949912589133341511,1412625607464470626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,6949912589133341511,1412625607464470626,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3016 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
de47a930721a6931e9c26efe1f996311

SHA1
062c8eb3c461729be885c0079c994371c3e291b4

SHA256
817f2ba2896bb181585770f1d927efaefbf5a54d7240693a08411d80f4255810

SHA512
a03f93bc71d86f0c10ecc226dd15bcd3e1bcb899da004232be154e7864971a7ac4c22a19ad8ab4d0a172233be687281d85094e32d836292530ec38653f6c587c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
077e7a069e5b82c1bad56f7ce6abac92

SHA1
650b49c35cb48b8a4a43fb5a63bc1e34e7954f40

SHA256
6470084710ac1b6e6a2bfa69a34bf8514989d6a2661042f5ec0a0bfe71780cb2

SHA512
1d51a5feb4777a02b5e45e00d9721923081e5604545c73bbcb0714ff93c7f4dd8e1f52ed1d0fcae14b74c4159ce49894e1c560e6232ca8f12dd2a670c0da5dc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
88df1248b474f1803a7cde13b8719b2a

SHA1
f9425ad660d8cc7c41e1c4adea1af8ab044f91bd

SHA256
cefb89f25c9fa2454729957073318fde49a5d0cee8e779865881de9e75d7577e

SHA512
84403aba3a77e6cdb0754f686b57293c2b6386c49245728d29f10f4b6859874fcbbd4bffd63ee5e4645c904c1658919e97ee8650ba9c7f447ec06b57013d2762

Download Submit