3c28140cbed3bd4eb21e86242bfb58a86c5700f102d57f1fb444654df00dd47f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 23:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6536933afb543511bade66de66038d00_JaffaCakes118.html
Size

139KB
MD5

6536933afb543511bade66de66038d00
SHA1

7673842c7fcf2bead5e3c330bdc9e4c20ce574b2
SHA256

3c28140cbed3bd4eb21e86242bfb58a86c5700f102d57f1fb444654df00dd47f
SHA512

759661a6de5d555906c7146e117505a01c0750444f8a0a3573a02d2ecb56e9a639f166f633d8ef181134a064fb5b5dfd2377d6e758ca6756f9e2c89225be8ac9
SSDEEP

1536:SIVcz6yl6myLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTs:SIvIyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1096	msedge.exe
1096	msedge.exe
936	msedge.exe
936	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
936	msedge.exe
936	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 3360	936	msedge.exe	83
PID 936 wrote to memory of 3360	936	msedge.exe	83
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 4624	936	msedge.exe	84
PID 936 wrote to memory of 1096	936	msedge.exe	85
PID 936 wrote to memory of 1096	936	msedge.exe	85
PID 936 wrote to memory of 3688	936	msedge.exe	86
PID 936 wrote to memory of 3688	936	msedge.exe	86
PID 936 wrote to memory of 3688	936	msedge.exe	86
PID 936 wrote to memory of 3688	936	msedge.exe	86
PID 936 wrote to memory of 3688	936	msedge.exe	86
PID 936 wrote to memory of 3688	936	msedge.exe	86
PID 936 wrote to memory of 3688	936	msedge.exe	86
PID 936 wrote to memory of 3688	936	msedge.exe	86
PID 936 wrote to memory of 3688	936	msedge.exe	86
PID 936 wrote to memory of 3688	936	msedge.exe	86
PID 936 wrote to memory of 3688	936	msedge.exe	86
PID 936 wrote to memory of 3688	936	msedge.exe	86
PID 936 wrote to memory of 3688	936	msedge.exe	86
PID 936 wrote to memory of 3688	936	msedge.exe	86
PID 936 wrote to memory of 3688	936	msedge.exe	86
PID 936 wrote to memory of 3688	936	msedge.exe	86
PID 936 wrote to memory of 3688	936	msedge.exe	86
PID 936 wrote to memory of 3688	936	msedge.exe	86
PID 936 wrote to memory of 3688	936	msedge.exe	86
PID 936 wrote to memory of 3688	936	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6536933afb543511bade66de66038d00_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa4b146f8,0x7ffaa4b14708,0x7ffaa4b14718
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,7766552802857472117,16316397138234407733,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,7766552802857472117,16316397138234407733,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,7766552802857472117,16316397138234407733,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,7766552802857472117,16316397138234407733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,7766552802857472117,16316397138234407733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,7766552802857472117,16316397138234407733,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4792 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6db4181c8069991c224d7e46ea0cefdc

SHA1
a7e4af29b1ec43c97908f8f17129b19c145ed403

SHA256
67af970e69a9b529f1cdef5715f7735f88d6eb9f510b6490daae870d7555c26e

SHA512
0ffb192a36408199fd7661ddacb92dbb4ce139ca62898151447c4f7f43a81a497a39f48da98ac584d3c691bdfda71fb08c2f7ec3bc0114b705926357161c53a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3f56194f55fd299d7cf04194e44ce032

SHA1
8344c623382b4aae93dfbfd53cdea016380a4e3d

SHA256
023c0350e19cc867348738101a1c63c205c380d6ff2378cc057bea3bd0512b24

SHA512
6cb65802479f72218d792658df53f37b2e54d29ce4cdb71516abcd6d8ef60f6447bc3fee45bf16b04972d3e5b1f91ed5662fbc8ddc107175070c373bf6c1654d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e143cd4b1f30a0cea00a66e3f1b70710

SHA1
9a8f40a61d6e95d3c1dc5a851b98a99684bda1ef

SHA256
6560fbb254530fceada7bec8b10e2f0c8e106c71e0a879f1e1dcca312c663c7c

SHA512
d65b2419b327d4f3ce7ac9ade0367470470424f01714057bcf7c4acfa25bf35d9aa9b0ed476e27456769711fb509eb683a730a8c05cd22251992a4a18273d69b

Download Submit