86e11d39029ab175475e83b42497074cfee0a9668e4547742869793c50256ea3

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ba0ff60f65c9eee702cc27ebf6912cb_JaffaCakes118.html
Size

19KB
MD5

4ba0ff60f65c9eee702cc27ebf6912cb
SHA1

833aa6a709e37ef5fd907f57d56d528d6eeefa9d
SHA256

86e11d39029ab175475e83b42497074cfee0a9668e4547742869793c50256ea3
SHA512

c2b3a2d0ee4b1a2b9225859e0e2df55715e959d84569de7bcfcbf82a458317338b3e87c825d7316a61862e98b4f9df868ab9de621b7ec37a7dd92e06b824e0bb
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAId4vzUnjBhR782qDB8:SIMd0I5nvHpsvRgxDB8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
1392	msedge.exe
1392	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 2904	1392	msedge.exe	83
PID 1392 wrote to memory of 2904	1392	msedge.exe	83
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	84
PID 1392 wrote to memory of 4348	1392	msedge.exe	85
PID 1392 wrote to memory of 4348	1392	msedge.exe	85
PID 1392 wrote to memory of 1480	1392	msedge.exe	86
PID 1392 wrote to memory of 1480	1392	msedge.exe	86
PID 1392 wrote to memory of 1480	1392	msedge.exe	86
PID 1392 wrote to memory of 1480	1392	msedge.exe	86
PID 1392 wrote to memory of 1480	1392	msedge.exe	86
PID 1392 wrote to memory of 1480	1392	msedge.exe	86
PID 1392 wrote to memory of 1480	1392	msedge.exe	86
PID 1392 wrote to memory of 1480	1392	msedge.exe	86
PID 1392 wrote to memory of 1480	1392	msedge.exe	86
PID 1392 wrote to memory of 1480	1392	msedge.exe	86
PID 1392 wrote to memory of 1480	1392	msedge.exe	86
PID 1392 wrote to memory of 1480	1392	msedge.exe	86
PID 1392 wrote to memory of 1480	1392	msedge.exe	86
PID 1392 wrote to memory of 1480	1392	msedge.exe	86
PID 1392 wrote to memory of 1480	1392	msedge.exe	86
PID 1392 wrote to memory of 1480	1392	msedge.exe	86
PID 1392 wrote to memory of 1480	1392	msedge.exe	86
PID 1392 wrote to memory of 1480	1392	msedge.exe	86
PID 1392 wrote to memory of 1480	1392	msedge.exe	86
PID 1392 wrote to memory of 1480	1392	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4ba0ff60f65c9eee702cc27ebf6912cb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc2ac46f8,0x7ffdc2ac4708,0x7ffdc2ac4718
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,471024519302386595,5028261843064370124,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,471024519302386595,5028261843064370124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,471024519302386595,5028261843064370124,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,471024519302386595,5028261843064370124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,471024519302386595,5028261843064370124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,471024519302386595,5028261843064370124,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
59b806b9326b5ffca641a07a37b38b54

SHA1
103924db85a6dfb126c2241270c44b2fde585940

SHA256
32a2a784b3da84f3f6c151dc6effcdc64a7d9ed1e4fa63287e2dc12a900e9a28

SHA512
7ed4baf302360a25711710ce53a44670efff685ea64a295fa89da885117bc19fa6281f8a201e47b7954dab3a84c315dcfc3c3e6b0243819ca272dfbe4f9b025b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
569260865616b01a188103790a287afe

SHA1
042cfc98937842a5cc85c3de7f75476091fb63f0

SHA256
5b6a800251215562b45da09d73e9402636bcf910c6f475f1a13527aa5ad5d483

SHA512
7526011a2b67ba7196d6678a069726f8d1336bbf46fac10980013636f7e5850651598c62f6abd73c48d05cd4aec5a5cbfe4f3e2fa24cf8cb9b8abdb93581248f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d941ae3673704fc1c41dda149dcc4a31

SHA1
63aec21b80adf13513bc1159d635b8c8eaed31a4

SHA256
5485fe0f44146b50f412f53e3af8cbf8898d3988393e6f4834da0fbf89e257b8

SHA512
0d1eae68ead745fd8bd7b5a25c6b9b6308be143d3f3674b26e2ef1ca64362f155ae98941e9844aeac7596f3c3dfff0167f9a7107327d7cf975721cf65a71c8e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
50ccfae7d4bb013e6dff5e45aae10d9f

SHA1
57dac3582f071d90bc2eea1961a6cb6dc78a228d

SHA256
7f5da510ec9fb20f99a7f821683e5b50866c064ea7c51973a0ff8a646a0e9c72

SHA512
5ef8dd96e4b4fbe3c24cb65d4a953d4d273d47b55ea3c8c768763f98d0aacf18a5630427d4f71d4910c6ab975c064053e436200d81e13383a8f6262a1bacde1f

Download Submit