1777dc5f602e48d703cb4f3961c5c653c5b6570c9aa32a922238e16bbba8ca4e

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 23:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

438395a6cc17df45d816f6d6dfb29ba9_JaffaCakes118.html
Size

15KB
MD5

438395a6cc17df45d816f6d6dfb29ba9
SHA1

2baee3d913ad042786a5f0a1c09ebd3c280ef0ac
SHA256

1777dc5f602e48d703cb4f3961c5c653c5b6570c9aa32a922238e16bbba8ca4e
SHA512

afc43114e82c98d44c1c6d25c7fbc2b9648506efe990189c1ca48c5e24c829da5dbeaa39a82c4ee087afac62d91780a74a3302bc8d5904d3fea463bd2c0555a9
SSDEEP

384:rwPIT0sV8Dp/G/u65Y/UuqG/S2KrGlkluGTob12WV597OzPuM:UIT0sV8Dp/G/P5Y/UuqGxKrGlkljEb1k

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe
4476	msedge.exe
4476	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 1380	4476	msedge.exe	82
PID 4476 wrote to memory of 1380	4476	msedge.exe	82
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 2324	4476	msedge.exe	83
PID 4476 wrote to memory of 4428	4476	msedge.exe	84
PID 4476 wrote to memory of 4428	4476	msedge.exe	84
PID 4476 wrote to memory of 2008	4476	msedge.exe	85
PID 4476 wrote to memory of 2008	4476	msedge.exe	85
PID 4476 wrote to memory of 2008	4476	msedge.exe	85
PID 4476 wrote to memory of 2008	4476	msedge.exe	85
PID 4476 wrote to memory of 2008	4476	msedge.exe	85
PID 4476 wrote to memory of 2008	4476	msedge.exe	85
PID 4476 wrote to memory of 2008	4476	msedge.exe	85
PID 4476 wrote to memory of 2008	4476	msedge.exe	85
PID 4476 wrote to memory of 2008	4476	msedge.exe	85
PID 4476 wrote to memory of 2008	4476	msedge.exe	85
PID 4476 wrote to memory of 2008	4476	msedge.exe	85
PID 4476 wrote to memory of 2008	4476	msedge.exe	85
PID 4476 wrote to memory of 2008	4476	msedge.exe	85
PID 4476 wrote to memory of 2008	4476	msedge.exe	85
PID 4476 wrote to memory of 2008	4476	msedge.exe	85
PID 4476 wrote to memory of 2008	4476	msedge.exe	85
PID 4476 wrote to memory of 2008	4476	msedge.exe	85
PID 4476 wrote to memory of 2008	4476	msedge.exe	85
PID 4476 wrote to memory of 2008	4476	msedge.exe	85
PID 4476 wrote to memory of 2008	4476	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\438395a6cc17df45d816f6d6dfb29ba9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad02946f8,0x7ffad0294708,0x7ffad0294718
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,14246456240827003006,11454086897923847548,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,14246456240827003006,11454086897923847548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,14246456240827003006,11454086897923847548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14246456240827003006,11454086897923847548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14246456240827003006,11454086897923847548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,14246456240827003006,11454086897923847548,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1444 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
588739299be6445e2df4e044aaf4dbed

SHA1
833530feea226d3e763ff96faa09d2ea4a69f981

SHA256
3701542dc7511606eaf058882f7a4bf9e5cd15a824f5bcaa3e5e33c77474e827

SHA512
0e62c6a8a4e67d175be98f864b1374c75826c8dee69eb40af4b66029831092a433d86cc03fe6d1ed54efb86e13e9e867a45684c6dfcefbd14a43690f948ee1d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
474e05b9cb14edec9d25ee10854d605f

SHA1
9a7f5d6b43f64e00eb666b7894b421173f9e033b

SHA256
71076b19383b64b3ba0c1f64cc371135baa75c513ee6d9c022ea0cf3bdcf4175

SHA512
7f09eadf9ca01be20d8a4cb1d78a2af091eea1ac189efdf09f0c0970a6876d10bbc216507c2bd64c3ae0022103f624b1749390fad9f1644688daa7d3ca45f5fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
19388915e8844e58d478a360483c406c

SHA1
7d1c7bf42186edf4f1e3cac917953c914e2aad5b

SHA256
4086e5b737820d296390c5fcd9d482c54c1b8477d1e202850fe7f832aaf35cfa

SHA512
b0a3ba07938589315ae77170722725b869f993492d66397c10fab6223972015087e46b0f979d470c0e41c4166c477688a58492a675a94e2c15caa9f411698d00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d9fd8c1eac4b34a9e4c177cfe93799d2

SHA1
ae3521c7910e81cd7ce346562a876f22cc43be50

SHA256
644cc4debd12996d502f08facc3086ebc447e5afe7c17224acf5b3939124c604

SHA512
d3625364dee41884a25d218254e62bd317d4b14f8938a55ade9e834fc4c2c81b533bd0ec4dadbe5d46aeac8b5a0e7ddd50514deaac53cbb1362c67dcd6c26b68

Download Submit