21cf81a58fba759dff64fef95f93e82f53b7f1a4de41bd8b4ec40fcc4dee7bd6

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 18:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

475dc56c1a19bd260debf53dc55edcf8_JaffaCakes118.html
Size

139KB
MD5

475dc56c1a19bd260debf53dc55edcf8
SHA1

2659ad0a1f8573d8bbcf31e828bc9497dfdcb76a
SHA256

21cf81a58fba759dff64fef95f93e82f53b7f1a4de41bd8b4ec40fcc4dee7bd6
SHA512

b3ed7bb66ef6a7dc690b3ab6dd03aaae9f45e27eb109e96abdf9145a0e5921a252228ca776d282926886cb3247801202e81d619a8b1b0ad9b56719ebf642bad3
SSDEEP

1536:SNVtPhllyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy+:SNHxyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
1008	msedge.exe
1008	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1008	msedge.exe
1008	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 1348	1008	msedge.exe	85
PID 1008 wrote to memory of 1348	1008	msedge.exe	85
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 1120	1008	msedge.exe	86
PID 1008 wrote to memory of 4912	1008	msedge.exe	87
PID 1008 wrote to memory of 4912	1008	msedge.exe	87
PID 1008 wrote to memory of 1124	1008	msedge.exe	88
PID 1008 wrote to memory of 1124	1008	msedge.exe	88
PID 1008 wrote to memory of 1124	1008	msedge.exe	88
PID 1008 wrote to memory of 1124	1008	msedge.exe	88
PID 1008 wrote to memory of 1124	1008	msedge.exe	88
PID 1008 wrote to memory of 1124	1008	msedge.exe	88
PID 1008 wrote to memory of 1124	1008	msedge.exe	88
PID 1008 wrote to memory of 1124	1008	msedge.exe	88
PID 1008 wrote to memory of 1124	1008	msedge.exe	88
PID 1008 wrote to memory of 1124	1008	msedge.exe	88
PID 1008 wrote to memory of 1124	1008	msedge.exe	88
PID 1008 wrote to memory of 1124	1008	msedge.exe	88
PID 1008 wrote to memory of 1124	1008	msedge.exe	88
PID 1008 wrote to memory of 1124	1008	msedge.exe	88
PID 1008 wrote to memory of 1124	1008	msedge.exe	88
PID 1008 wrote to memory of 1124	1008	msedge.exe	88
PID 1008 wrote to memory of 1124	1008	msedge.exe	88
PID 1008 wrote to memory of 1124	1008	msedge.exe	88
PID 1008 wrote to memory of 1124	1008	msedge.exe	88
PID 1008 wrote to memory of 1124	1008	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\475dc56c1a19bd260debf53dc55edcf8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa445a46f8,0x7ffa445a4708,0x7ffa445a4718
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,15452093936692329314,18152012267551906910,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,15452093936692329314,18152012267551906910,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,15452093936692329314,18152012267551906910,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15452093936692329314,18152012267551906910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15452093936692329314,18152012267551906910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,15452093936692329314,18152012267551906910,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4896 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e2e896b396bea53faaa823c5d9231bf2

SHA1
5add416c8cc0c23d649bb96b1db39c41c08f80f5

SHA256
3da09db42a8bc08d6b17460d2c2d8692ab46a1aca235719f2f76d58a352116ec

SHA512
0f1c599cf57242494c29cc25001f65824bf89471423aa228c1897eb96f6cd15df03ee9c09c4b0102d77cd3365fec096b9e27fe2a849c05c16d28cc37fbd74551

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c110382c4ae3299bd6f4b1a3a3553530

SHA1
99a96e808456cab6bf17e6209ce98155939587e2

SHA256
6f7ae6ab88b1fbb866f3b9c6bbef67cae329930b4f398dce908822a8cdb0268e

SHA512
d905476ff4b6305aa660d041a4e0d040fa6c0e608784989a316fd172cabfc39035bd1e637b8fe404271868b5c1d02148e3ff8d449d98adc73dbcfdab8beaddd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
56c97e83b4057e328cfcf92eabc0a02e

SHA1
765186fa2616c4841c31c7dad14a6a9b4989dae2

SHA256
a1d09a04220c1c2c2ff8870be90dc46ec253e35079a57b93a2d22d5cebed3eae

SHA512
359b662a2812e99bb4f7dc3f00a7da610bc304354277a827616c78040261e48c6b975528884c394b9da5734ef387e34b2793cd0e50486a61ee4803863850bf93

Download Submit