0a6ba9356e5f99e09fd83431529bfbcfd833cc68c1ffce5c3b2406c2b13f2b0e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 17:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

508d04b5389c92d2ac15d76654b702b1_JaffaCakes118.html
Size

214KB
MD5

508d04b5389c92d2ac15d76654b702b1
SHA1

76c2525cb6da1cc380ec785a1940990a68fa3007
SHA256

0a6ba9356e5f99e09fd83431529bfbcfd833cc68c1ffce5c3b2406c2b13f2b0e
SHA512

74790885d6fda403ccefefe9e9a2ca3cfffbd636023b411f49b12085556bedbbb28fdb523b4813c9c901af671322f69009ccd091b5576a9dfc72096cc73c221e
SSDEEP

3072:+rhB9CyHxX7Be7iAvtLPbAwuBNKifXTJX:Gz9VxLY7iAVLTBQJlX

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3672	msedge.exe
3672	msedge.exe
4848	msedge.exe
4848	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 3628	4848	msedge.exe	83
PID 4848 wrote to memory of 3628	4848	msedge.exe	83
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 2376	4848	msedge.exe	84
PID 4848 wrote to memory of 3672	4848	msedge.exe	85
PID 4848 wrote to memory of 3672	4848	msedge.exe	85
PID 4848 wrote to memory of 2996	4848	msedge.exe	86
PID 4848 wrote to memory of 2996	4848	msedge.exe	86
PID 4848 wrote to memory of 2996	4848	msedge.exe	86
PID 4848 wrote to memory of 2996	4848	msedge.exe	86
PID 4848 wrote to memory of 2996	4848	msedge.exe	86
PID 4848 wrote to memory of 2996	4848	msedge.exe	86
PID 4848 wrote to memory of 2996	4848	msedge.exe	86
PID 4848 wrote to memory of 2996	4848	msedge.exe	86
PID 4848 wrote to memory of 2996	4848	msedge.exe	86
PID 4848 wrote to memory of 2996	4848	msedge.exe	86
PID 4848 wrote to memory of 2996	4848	msedge.exe	86
PID 4848 wrote to memory of 2996	4848	msedge.exe	86
PID 4848 wrote to memory of 2996	4848	msedge.exe	86
PID 4848 wrote to memory of 2996	4848	msedge.exe	86
PID 4848 wrote to memory of 2996	4848	msedge.exe	86
PID 4848 wrote to memory of 2996	4848	msedge.exe	86
PID 4848 wrote to memory of 2996	4848	msedge.exe	86
PID 4848 wrote to memory of 2996	4848	msedge.exe	86
PID 4848 wrote to memory of 2996	4848	msedge.exe	86
PID 4848 wrote to memory of 2996	4848	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\508d04b5389c92d2ac15d76654b702b1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa37e46f8,0x7ffaa37e4708,0x7ffaa37e4718
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,2400184897453387457,2917962499672069287,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,2400184897453387457,2917962499672069287,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,2400184897453387457,2917962499672069287,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2400184897453387457,2917962499672069287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2400184897453387457,2917962499672069287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,2400184897453387457,2917962499672069287,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b98f4e8b68cb8678262521b897e45c19

SHA1
87981bcba04b4192bc01e9f5c7d1e3eabc340e5d

SHA256
f6c6f386b95cc50cd21f04016a3f13b4e4b62f611a4bc5f93ac2bedde5a50273

SHA512
2159f038330d6ccc0cb28d21a8fef9b44d14db43c39cd2090822aad3761680a1ee5274a962829325bd413cf7600a5d2da748f3f3696f0323ff1077819f131886

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
455a74b01dd6d8ea0f07bd1aa100ef78

SHA1
eae41574dc9e25fb518ac5635fd115b230639f2a

SHA256
89ba9f2d4d08a6286bf4ab12e94812fd470f22230b3410ea7a916d8736980499

SHA512
b97edeea6fc785955fe6a07e900216f369f0f72103860e30dab9cf25d96def9addaa2d61ad96c53ff2187912b3206d156269e9598769122d77a7ec743f3c510a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
26fd4b0965db974b5b1ff9057c932328

SHA1
5778b89c5bfbf73dcc81e9a96bfac30f0f2e21d9

SHA256
85a1bd1a899f42139904fe240492e6d1937e1f356d54ca69f9b326e86d1b5d8f

SHA512
73dfae3c6a747052f15083d7e75cbc3075f40afaee1ce1be00f600bcb60ede9f4692f626d015f47ff9085eb8e7d7a57ffeee9819feed5f670c5104d174d44ea9

Download Submit