5c6a061bc4311c88ee958eea3a2240ed3bb8b2424eb2efa4282d4bd5112a1b14

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-05-2024 19:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b30f5b408278ea3ddfb102a523fff33_JaffaCakes118.html
Size

143KB
MD5

5b30f5b408278ea3ddfb102a523fff33
SHA1

3a8bb2b828fce8441e9f9a7930c2edc6ec7fcac1
SHA256

5c6a061bc4311c88ee958eea3a2240ed3bb8b2424eb2efa4282d4bd5112a1b14
SHA512

09e51a3463c3007d61eb63643162d2c6549b5fdf81e5037c6aa089d1c52ccbf8e4476ff412c072855c36f186f140f89d3ba7e3a9b69498d903c28f37cf00ff9e
SSDEEP

1536:S3qLMEsNp3FNx76vuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3p:SQsNVx7dyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
2132	msedge.exe
2132	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2132	msedge.exe
2132	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 4604	2132	msedge.exe	82
PID 2132 wrote to memory of 4604	2132	msedge.exe	82
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 1176	2132	msedge.exe	83
PID 2132 wrote to memory of 4040	2132	msedge.exe	84
PID 2132 wrote to memory of 4040	2132	msedge.exe	84
PID 2132 wrote to memory of 3572	2132	msedge.exe	85
PID 2132 wrote to memory of 3572	2132	msedge.exe	85
PID 2132 wrote to memory of 3572	2132	msedge.exe	85
PID 2132 wrote to memory of 3572	2132	msedge.exe	85
PID 2132 wrote to memory of 3572	2132	msedge.exe	85
PID 2132 wrote to memory of 3572	2132	msedge.exe	85
PID 2132 wrote to memory of 3572	2132	msedge.exe	85
PID 2132 wrote to memory of 3572	2132	msedge.exe	85
PID 2132 wrote to memory of 3572	2132	msedge.exe	85
PID 2132 wrote to memory of 3572	2132	msedge.exe	85
PID 2132 wrote to memory of 3572	2132	msedge.exe	85
PID 2132 wrote to memory of 3572	2132	msedge.exe	85
PID 2132 wrote to memory of 3572	2132	msedge.exe	85
PID 2132 wrote to memory of 3572	2132	msedge.exe	85
PID 2132 wrote to memory of 3572	2132	msedge.exe	85
PID 2132 wrote to memory of 3572	2132	msedge.exe	85
PID 2132 wrote to memory of 3572	2132	msedge.exe	85
PID 2132 wrote to memory of 3572	2132	msedge.exe	85
PID 2132 wrote to memory of 3572	2132	msedge.exe	85
PID 2132 wrote to memory of 3572	2132	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5b30f5b408278ea3ddfb102a523fff33_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9924846f8,0x7ff992484708,0x7ff992484718
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,11516874348088586574,14310942244689315125,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,11516874348088586574,14310942244689315125,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,11516874348088586574,14310942244689315125,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11516874348088586574,14310942244689315125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,11516874348088586574,14310942244689315125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,11516874348088586574,14310942244689315125,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3024 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a0bae546595950acd0ba322bf72c14cc

SHA1
5f51cf81d64b00b980a2568bdd250d38373c4a8a

SHA256
5bb63496588649cbdaffb824a2e6c5f9155454abb6920641a73e34f25d9afa7b

SHA512
a317e32edf7e0cfb64e5ad3fa2452cce3bfa530d52e952e8dded9f0e8975afeedcc01152e8b4dec2ffd67732cca4271119e54013ee197b5c490cc893dd8a0f6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
85e92d7e204c086eba5aad895751e532

SHA1
28e7b3b3b33c599796f3fc0285ffe44584d3a3bd

SHA256
1297a02ebaa00510af628764445f89353c222b4111a95d8acba3a55959fbd984

SHA512
82e01e8b650e43dc95e65705cba6ebd95f3566761baa8a4907433c8043710a0562a0c0588b6000910baec93daae9848f4ce966ac420962a33f856001dd0a9c71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2cd03e707fbf1d087acdfa610b2774dd

SHA1
83f90940c7b386c8a09fb5f41d653daf0378d62b

SHA256
a7f46c04db9bd5a14f6d87a87955edcf02a1aaed5ca0b12b0af438aad1e3949b

SHA512
2b1407b3d68d93ef56e288a938a0285137074f353df88c0abfccb9cb4cd720692ff2b347e38435906c7f46a12f9022d613602132ff33020573dec6a46d6cf8c8

Download Submit