6b4c1877d4f9d614e849e976e017b51a3567638dbed447f0a0326d50abaa526b

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 23:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

614411259f7e5503046d7ff075947374_JaffaCakes118.html
Size

116KB
MD5

614411259f7e5503046d7ff075947374
SHA1

e944c4f44089f49f0af76d6cee7eb1a9565dcbd9
SHA256

6b4c1877d4f9d614e849e976e017b51a3567638dbed447f0a0326d50abaa526b
SHA512

a17ea898d258310b0fea370621e154deb40dd491316ba8a199fa61bf1cc6cfe3e194128822661e68f363cd8c9f44b683badf01258e983fa6db19be4aa78c0000
SSDEEP

1536:3w+DcJfIG5Q6dFJOcOHoR3hcHGS8tzs5N/ct:qJfIG5Q6dFnLcHiaS

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1632	msedge.exe
1632	msedge.exe
2840	msedge.exe
2840	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2840	msedge.exe
2840	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 3088	2840	msedge.exe	85
PID 2840 wrote to memory of 3088	2840	msedge.exe	85
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1644	2840	msedge.exe	86
PID 2840 wrote to memory of 1632	2840	msedge.exe	87
PID 2840 wrote to memory of 1632	2840	msedge.exe	87
PID 2840 wrote to memory of 1828	2840	msedge.exe	88
PID 2840 wrote to memory of 1828	2840	msedge.exe	88
PID 2840 wrote to memory of 1828	2840	msedge.exe	88
PID 2840 wrote to memory of 1828	2840	msedge.exe	88
PID 2840 wrote to memory of 1828	2840	msedge.exe	88
PID 2840 wrote to memory of 1828	2840	msedge.exe	88
PID 2840 wrote to memory of 1828	2840	msedge.exe	88
PID 2840 wrote to memory of 1828	2840	msedge.exe	88
PID 2840 wrote to memory of 1828	2840	msedge.exe	88
PID 2840 wrote to memory of 1828	2840	msedge.exe	88
PID 2840 wrote to memory of 1828	2840	msedge.exe	88
PID 2840 wrote to memory of 1828	2840	msedge.exe	88
PID 2840 wrote to memory of 1828	2840	msedge.exe	88
PID 2840 wrote to memory of 1828	2840	msedge.exe	88
PID 2840 wrote to memory of 1828	2840	msedge.exe	88
PID 2840 wrote to memory of 1828	2840	msedge.exe	88
PID 2840 wrote to memory of 1828	2840	msedge.exe	88
PID 2840 wrote to memory of 1828	2840	msedge.exe	88
PID 2840 wrote to memory of 1828	2840	msedge.exe	88
PID 2840 wrote to memory of 1828	2840	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\614411259f7e5503046d7ff075947374_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff76e346f8,0x7fff76e34708,0x7fff76e34718
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,1533533956634607523,10082039128005044684,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,1533533956634607523,10082039128005044684,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,1533533956634607523,10082039128005044684,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1533533956634607523,10082039128005044684,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1533533956634607523,10082039128005044684,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,1533533956634607523,10082039128005044684,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2eb4a127-e96c-4313-b0db-e822df59ea01.tmp

Filesize
5KB

MD5
cb56d2337984611020a267f97fce0241

SHA1
4a3ffe02dd7a05e047ec8b5fdb14d045b09296de

SHA256
63b3dd900a3bbe1c4e1f5400a3cdcbc3535a01d5b1854a66ddfae785aeee81de

SHA512
75962f66c3887deeca120caa163131f8ec3a776d519a0a23327ffa6548bd431284e631b7666640f27ab11c0d8cd2c336d4c9c2ee3ef46dc3dd0ba8db63df39a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
304B

MD5
ce030a6f834ef2e9d1279d247c42e4aa

SHA1
37dbce25a256513a4f085acbff4deb51e3adad74

SHA256
2cfd6cd7fea393ec94fa69908cb1e4940fdf91aac36a660c11df2c1671c1a912

SHA512
e3e95e2d1bd0fa22fb19678f40a7df8d771b8eb014c9e6fab4267decef9656d8e8ae117b79ed49ca86cdb8bab967e79e64de7b6fe69af7d587a5faa217798cb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
371c8cec6bf0f3e2155fa49a4f355735

SHA1
97e7d2bf4be93adc1943c4180b505b95f74c4530

SHA256
58884816167918a339dcee57a480066d4e8d247beb0e1653d6b2619a135ffcbc

SHA512
fce9c5b9e13bc9d07a0a9088bc933056c1c25db26cd6be8997d80670082e4cd17cdd81e011c83a8b662db54d1cdd1a7fb608934f330aefa90495d341c103346a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bbb999373e6e9adce59335913ccfdf9c

SHA1
d1be05d2c6289bf10058dbb5e32e32fde8fefd93

SHA256
5b4ca0c854e0458fdc7da4e49baf189a2409a55684989fa86e232ac2045d077d

SHA512
2e17fb6efd33fd51776b54926d3591c05ac1d1592126bd719442db9b2d43e7a2049bf773a9476229c36494265ac98482964d304549d3894df2f85d6a7748099c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3a9b43f994be9f4ac04f1d633b18dd30

SHA1
58965b762fbd4f50b41b75fe4d706816865d3383

SHA256
59117e76bbcb9e10a7f8472a2708f49e89bf220f5168bf245ed8fd5f1bac0099

SHA512
e6032f37deeabb689fd2d52371b0d656a35098764703d755c4e6db4841856eab80cf53c04b53c319a41df96ca2aed0dd1811ad445ad85e80682684466e6f8fcf

Download Submit