0fb4432db0d3ce8d3d6d703048374e18a76eed3f88fef47004062161172b1dd4

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 18:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

477d078f4ea91ddac119f355249e3af8_JaffaCakes118.html
Size

138KB
MD5

477d078f4ea91ddac119f355249e3af8
SHA1

8fbf795ace9a1796caf2a3c51a431dcb86a9f118
SHA256

0fb4432db0d3ce8d3d6d703048374e18a76eed3f88fef47004062161172b1dd4
SHA512

68cb786c89e90a1a6bb4addb12dd8cdd52010549992f690be69e883e9567d25d589d739ea300974fb7901bace24810b99f23606786366368d7e1001087c94c2c
SSDEEP

1536:Sc2mn4D+h6hzyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:Ssnto1yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3648	msedge.exe
3648	msedge.exe
700	msedge.exe
700	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
700	msedge.exe
700	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 700 wrote to memory of 4644	700	msedge.exe	85
PID 700 wrote to memory of 4644	700	msedge.exe	85
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 2476	700	msedge.exe	87
PID 700 wrote to memory of 3648	700	msedge.exe	88
PID 700 wrote to memory of 3648	700	msedge.exe	88
PID 700 wrote to memory of 3836	700	msedge.exe	89
PID 700 wrote to memory of 3836	700	msedge.exe	89
PID 700 wrote to memory of 3836	700	msedge.exe	89
PID 700 wrote to memory of 3836	700	msedge.exe	89
PID 700 wrote to memory of 3836	700	msedge.exe	89
PID 700 wrote to memory of 3836	700	msedge.exe	89
PID 700 wrote to memory of 3836	700	msedge.exe	89
PID 700 wrote to memory of 3836	700	msedge.exe	89
PID 700 wrote to memory of 3836	700	msedge.exe	89
PID 700 wrote to memory of 3836	700	msedge.exe	89
PID 700 wrote to memory of 3836	700	msedge.exe	89
PID 700 wrote to memory of 3836	700	msedge.exe	89
PID 700 wrote to memory of 3836	700	msedge.exe	89
PID 700 wrote to memory of 3836	700	msedge.exe	89
PID 700 wrote to memory of 3836	700	msedge.exe	89
PID 700 wrote to memory of 3836	700	msedge.exe	89
PID 700 wrote to memory of 3836	700	msedge.exe	89
PID 700 wrote to memory of 3836	700	msedge.exe	89
PID 700 wrote to memory of 3836	700	msedge.exe	89
PID 700 wrote to memory of 3836	700	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\477d078f4ea91ddac119f355249e3af8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc835446f8,0x7ffc83544708,0x7ffc83544718
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9953829195785591181,3503715564572554275,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,9953829195785591181,3503715564572554275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,9953829195785591181,3503715564572554275,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9953829195785591181,3503715564572554275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9953829195785591181,3503715564572554275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9953829195785591181,3503715564572554275,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3012 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
38682b586f1f3f1ff9c38a830b7851fd

SHA1
146055f386fcde0f69bc5da97f19972936f8276f

SHA256
aa3f50ceb18e32dbebc2205663ba87f820d41f1e8795fcf5705006bd5c222a9c

SHA512
2b11dd08a2ed7e3cd158331d94281d693b9df8e27cbcc74e5d7e8ec65f3fbe9cc7b7953d265f8d6dd6977af84cfbc4b58e3b48ff828bff4b04c40b180c98415d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
56b71cdf39e57884b8a4b6474b541fe9

SHA1
a5cb903c65d2047da3e8ab6c2c9d9f5ce9130e71

SHA256
fe816828b8c8d004d7ac84561dccb9caeab886b3a77e066fe7e670066cfe1147

SHA512
5b850ee7ddf2f073c4e0d0d1dea86a7553beb2904a55727716c6df2bece53b65805157aa6b8c5a20400d9cb13c6317610da0e6694d6285a10ff416462dadb63e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
57440d37fab345456d396e62ea6a90f5

SHA1
7340b6f9d6209032022a163ac6668aab1bcb1788

SHA256
17802e4356509d3154323a49227a85c5f1271d2a1959a71a298d8d571d857c5f

SHA512
16ccf681506c2f3cc47d3ac9c4b9375e28502e957a176318cb594f2a35bc4c81b8c3866650a48b807b085a3d7212a13966d61531de078da985cfd2733953a79e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d9c3f802596f5ebf0a116dea424f15b2

SHA1
d3b31d0089af517543183e46f1f66c62ca56f023

SHA256
d2dfa97ae64bdffe54040dbd7175bf45e5476772c7ca777f248f3c1aec740ec9

SHA512
fa6fee7a286c225f6bb42d33730a0747e5143d979f663cf86eda068899e7ed63fa084932719f915e8c8e5a96e4a51982d861b4ee04e0753b7f1241cf02e044dd

Download Submit