19b31fd2057f68ef106b3dd3c044a8d03e5ddea1ebca4c140156616b6f2206ab

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 03:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49569e52f9e8c7532be95239b163eb30_JaffaCakes118.html
Size

119KB
MD5

49569e52f9e8c7532be95239b163eb30
SHA1

07e0ec18a3951f9163a88430632656ffec37ac2c
SHA256

19b31fd2057f68ef106b3dd3c044a8d03e5ddea1ebca4c140156616b6f2206ab
SHA512

91fdaedca3f4db0aec8fb051baceb39231c8fef4f14b2735e7f98e8c3ab76709fbfe27a1e179f678ce5aed3d373c6bfd37891c4fd026d5cad3f9901a6b064a88
SSDEEP

1536:SBOKGyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGL:SBsyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
928	msedge.exe
928	msedge.exe
2140	msedge.exe
2140	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2140	msedge.exe
2140	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 4396	2140	msedge.exe	84
PID 2140 wrote to memory of 4396	2140	msedge.exe	84
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 2220	2140	msedge.exe	85
PID 2140 wrote to memory of 928	2140	msedge.exe	86
PID 2140 wrote to memory of 928	2140	msedge.exe	86
PID 2140 wrote to memory of 4588	2140	msedge.exe	87
PID 2140 wrote to memory of 4588	2140	msedge.exe	87
PID 2140 wrote to memory of 4588	2140	msedge.exe	87
PID 2140 wrote to memory of 4588	2140	msedge.exe	87
PID 2140 wrote to memory of 4588	2140	msedge.exe	87
PID 2140 wrote to memory of 4588	2140	msedge.exe	87
PID 2140 wrote to memory of 4588	2140	msedge.exe	87
PID 2140 wrote to memory of 4588	2140	msedge.exe	87
PID 2140 wrote to memory of 4588	2140	msedge.exe	87
PID 2140 wrote to memory of 4588	2140	msedge.exe	87
PID 2140 wrote to memory of 4588	2140	msedge.exe	87
PID 2140 wrote to memory of 4588	2140	msedge.exe	87
PID 2140 wrote to memory of 4588	2140	msedge.exe	87
PID 2140 wrote to memory of 4588	2140	msedge.exe	87
PID 2140 wrote to memory of 4588	2140	msedge.exe	87
PID 2140 wrote to memory of 4588	2140	msedge.exe	87
PID 2140 wrote to memory of 4588	2140	msedge.exe	87
PID 2140 wrote to memory of 4588	2140	msedge.exe	87
PID 2140 wrote to memory of 4588	2140	msedge.exe	87
PID 2140 wrote to memory of 4588	2140	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\49569e52f9e8c7532be95239b163eb30_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9747f46f8,0x7ff9747f4708,0x7ff9747f4718
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,1310720209325445617,18149469586735541611,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,1310720209325445617,18149469586735541611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,1310720209325445617,18149469586735541611,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1310720209325445617,18149469586735541611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1310720209325445617,18149469586735541611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,1310720209325445617,18149469586735541611,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4372 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
45b4768463f7b6be1265a75c83807c3e

SHA1
be27062cde069f1671816d9e8155c015e99e0414

SHA256
f375cb895cc12ddac78b87110895a7be52ffdfd6066f2c2bed38e13f80068eb1

SHA512
574346490323c165bbbef0d86442026d3bae8fa3e318a8d513634411ac339385421c39ffe789d54a20cf6ad4b9b31ac2c27e25f5eab11de4bf1819cdfe52c4c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1a65c49ad3e13c277f3db9ca4e66a0d0

SHA1
c7082fcebd8be7f053b29fd9b02a8c2968231242

SHA256
36d7d80e637ea1d4df1f0bbe72450f3adee4413fad829c2012efb2e82e71f69d

SHA512
2a2f6d48aeb2833004671e5bc58491dbbe1fc9902fd900015fd9dca52188fa7c4173f5b7f2ef3c7395ae10e3a15bededb6590609ead7aad4f67f19027db3b21c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
80ad2363f6d5518b019bb77983a82c95

SHA1
15343a6fcd56c2c2bd4fa12772d03f01e7e6ed1d

SHA256
00b5d0a34826ef78b685df8e8ae4687999579515e24d23ad0d0335dd23c77ae0

SHA512
66985bb13f0fae699978f3484a14f9c7512b1a14eb84649e5bdaafb96f20ea09f1dad167770f8c50a494045755b96772e4d1bf6a0389fcb2c7e00c398fd678d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
63d49b94e0531c335e6f822ede299993

SHA1
67f3a877894e73b275c1ab8961407f5409c78d14

SHA256
e3c5272aace7724878b63f9b771cc11f68ced6989ba438c5b244a1fcca6c7392

SHA512
e268343f8e33c9e6397544d3a21442c518193f19b2e0cc25e171f75264b20e7b55b617c746d351417a22c99761fb659a17a449fabd0f47e756026ff7f1ea42be

Download Submit