ce83fb6360e6573ac114b9aed101391652a6f3accfa582eb99fad00a4f687ad0

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

513380299c67f82ed56f4774892be79d_JaffaCakes118.html
Size

17KB
MD5

513380299c67f82ed56f4774892be79d
SHA1

d22139dd1d86b54150ea0a1470496bb2bfaf0516
SHA256

ce83fb6360e6573ac114b9aed101391652a6f3accfa582eb99fad00a4f687ad0
SHA512

9d069cd97f1927ce42a03dc3f1b45a37dae5a8256f8d56abfa1e3b54f2eb6dee8d250aa0d0b57e4b2b0d6fd89b0faab1a4e4976a338abf81fadc305245a94419
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAI04kzUnjBhIy82qDB8:SIMd0I5nvHRsvIBxDB8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2288	msedge.exe
2288	msedge.exe
1336	msedge.exe
1336	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1336	msedge.exe
1336	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 3964	1336	msedge.exe	83
PID 1336 wrote to memory of 3964	1336	msedge.exe	83
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 3364	1336	msedge.exe	84
PID 1336 wrote to memory of 2288	1336	msedge.exe	85
PID 1336 wrote to memory of 2288	1336	msedge.exe	85
PID 1336 wrote to memory of 396	1336	msedge.exe	86
PID 1336 wrote to memory of 396	1336	msedge.exe	86
PID 1336 wrote to memory of 396	1336	msedge.exe	86
PID 1336 wrote to memory of 396	1336	msedge.exe	86
PID 1336 wrote to memory of 396	1336	msedge.exe	86
PID 1336 wrote to memory of 396	1336	msedge.exe	86
PID 1336 wrote to memory of 396	1336	msedge.exe	86
PID 1336 wrote to memory of 396	1336	msedge.exe	86
PID 1336 wrote to memory of 396	1336	msedge.exe	86
PID 1336 wrote to memory of 396	1336	msedge.exe	86
PID 1336 wrote to memory of 396	1336	msedge.exe	86
PID 1336 wrote to memory of 396	1336	msedge.exe	86
PID 1336 wrote to memory of 396	1336	msedge.exe	86
PID 1336 wrote to memory of 396	1336	msedge.exe	86
PID 1336 wrote to memory of 396	1336	msedge.exe	86
PID 1336 wrote to memory of 396	1336	msedge.exe	86
PID 1336 wrote to memory of 396	1336	msedge.exe	86
PID 1336 wrote to memory of 396	1336	msedge.exe	86
PID 1336 wrote to memory of 396	1336	msedge.exe	86
PID 1336 wrote to memory of 396	1336	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\513380299c67f82ed56f4774892be79d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb93be46f8,0x7ffb93be4708,0x7ffb93be4718
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11480998368456391441,11601584494729643364,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,11480998368456391441,11601584494729643364,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,11480998368456391441,11601584494729643364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11480998368456391441,11601584494729643364,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11480998368456391441,11601584494729643364,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11480998368456391441,11601584494729643364,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2724 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a49c8bd51fb6551d5ab1aa94d94bb6f5

SHA1
17be41af672d05fbdcaa672553c9842923b4be5d

SHA256
4b3a5f61a2bf0fa31bed46b823ce2dc98ea7e3faa15aa948c197af5f10d83bf8

SHA512
0a709f11cb121d79f764d9b5bf56cb190dd3cf91282b0fafd0f13a48834645dd6995f32e3a09835be75c05170cd952f08673f0e70a23a25b4ab1d76cd7ac3667

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
98077acfd4f13822d92bf273be8da5ef

SHA1
e4babe4ce5c6b7c52b2d1738f78676bd595c07f0

SHA256
ce07136e411656036f6749005aa110e6c7b9188bc7dcd49cbd3902fbe9705b59

SHA512
62620763d78eafdb136c65afbc9b87d0c7b38ce94b180c364a17d9d0e2ee5e692b02f5addb4a504dd91a7ba5bf016195ff1c326322d1a2030005df8ecbd71ac4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dcac19cde9d6d1df77ad654efd00bd53

SHA1
43192ca9fd3da6abb64b133fb969abee131e0f0b

SHA256
125c6cdcb0f18ba9302f9c8046a6d973a8a5d905b95a2ce7001f2ad5b9a7e0cd

SHA512
980109c2242d7be59b7e448c07782a783e183cb50b6ca0568c3e2f96e7b8d53479893c5e8d1a09ea8a26cb5707e1b5aa3652bdc88429ad41cd5392f39b196bfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e0c48b659c524e33dd01514480bba519

SHA1
10597dc1352030bc3f206e0b93691590edc06a01

SHA256
071e08b494cf49c6f3c5667a80c1e0ed29e9307fd5d2df20036c1bc257cd1ead

SHA512
4601f8d6810a7c047bc5e2a724352df15347ac05db61977b4910b86084ca8ee5d2a6beab62397d18f43684ae59afbbe14ec11c652b5d4619522f68de44e9f1fc

Download Submit