bc8f9b8bfb5a66f29c61586012d7adf8f778ee7fa958a877837cc241eeed1058

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 19:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

646ae78b1ba446d3c269811f65e9959e_JaffaCakes118.html
Size

115KB
MD5

646ae78b1ba446d3c269811f65e9959e
SHA1

32e6741b181e7375f155b1dff5b04d2b6fda597f
SHA256

bc8f9b8bfb5a66f29c61586012d7adf8f778ee7fa958a877837cc241eeed1058
SHA512

56e5202f2dd75cdf105a9c5e7522c222e99ec90ec70cd2707694f7370563d121061687ce8f1650fcab82108d693e01bb59c8d893dcea28619a93cf9240138230
SSDEEP

3072:ViHWQia79GGO7f5gvt8aN205Id02WjjPMVTfStEH:ViHWa9GGO75gvt8aN20ad9d

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
868	msedge.exe
868	msedge.exe
2176	msedge.exe
2176	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 3260	2176	msedge.exe	85
PID 2176 wrote to memory of 3260	2176	msedge.exe	85
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 1028	2176	msedge.exe	86
PID 2176 wrote to memory of 868	2176	msedge.exe	87
PID 2176 wrote to memory of 868	2176	msedge.exe	87
PID 2176 wrote to memory of 5008	2176	msedge.exe	88
PID 2176 wrote to memory of 5008	2176	msedge.exe	88
PID 2176 wrote to memory of 5008	2176	msedge.exe	88
PID 2176 wrote to memory of 5008	2176	msedge.exe	88
PID 2176 wrote to memory of 5008	2176	msedge.exe	88
PID 2176 wrote to memory of 5008	2176	msedge.exe	88
PID 2176 wrote to memory of 5008	2176	msedge.exe	88
PID 2176 wrote to memory of 5008	2176	msedge.exe	88
PID 2176 wrote to memory of 5008	2176	msedge.exe	88
PID 2176 wrote to memory of 5008	2176	msedge.exe	88
PID 2176 wrote to memory of 5008	2176	msedge.exe	88
PID 2176 wrote to memory of 5008	2176	msedge.exe	88
PID 2176 wrote to memory of 5008	2176	msedge.exe	88
PID 2176 wrote to memory of 5008	2176	msedge.exe	88
PID 2176 wrote to memory of 5008	2176	msedge.exe	88
PID 2176 wrote to memory of 5008	2176	msedge.exe	88
PID 2176 wrote to memory of 5008	2176	msedge.exe	88
PID 2176 wrote to memory of 5008	2176	msedge.exe	88
PID 2176 wrote to memory of 5008	2176	msedge.exe	88
PID 2176 wrote to memory of 5008	2176	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\646ae78b1ba446d3c269811f65e9959e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8cff46f8,0x7ffd8cff4708,0x7ffd8cff4718
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,4767707539096746008,7417454691255706192,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,4767707539096746008,7417454691255706192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,4767707539096746008,7417454691255706192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4767707539096746008,7417454691255706192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4767707539096746008,7417454691255706192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4767707539096746008,7417454691255706192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,4767707539096746008,7417454691255706192,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5148 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
35742e3ec2858ba2370a3ea0e2d65b58

SHA1
f1f8dc692c1928d03fd376d1b17f8576c7d93621

SHA256
937e97eb63c64498975381209b441c2a3c8dc853083b04ab5bfb0eb2f99c8dce

SHA512
7c7bbe049655b52080ee95208ae1d0ca76629e940620b20fba66749fc1dbb302bf3c3eaa632f9619bfb31635e788a351ac1c879b9c6ad2b084128b4347faf887

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d1365d534223c71dae08e319879a0211

SHA1
12ef9fafcc81742dad0857be5701783f9c6711f0

SHA256
a853f138e2643d194bef4f3a41760b394422cce763f5891682cfe6fed2c22d2a

SHA512
c6b4f720c2586773929ff9b291b8bc8c860a33478d6c72390bb2e3104432c4437c517e85bf211dc7dd6d2eb670a4c779b45a268ddbc4d3ad054385235ffd5a4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1b56b0d45a9450954a3fff79e46c3174

SHA1
059ab31fec424f22f1d0c19a7216865d8d1616cb

SHA256
e2836f261724fd8f39186018ee372cf149452596dedf2437a06ef183491c77f3

SHA512
4f29b3c1ab0c13f239e8a21400950795f9c83b2dabf9c55a476ee7423b44bcffc1155e46da961fce437894a65b298eb6ce2c883b4e376b2e4fa492ac41b87684

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0d097582b8ae63671eda7a09553d88c4

SHA1
6d6f30cfe7d093a44fdd6754576bf0209843ec16

SHA256
dc97003d86647786575396ffb920948245b2d5a5e3448107a0a06f6ada1fa36b

SHA512
e7489670a60806f0a8110829457666818fcda5c70600f40695f4ef2947ae9239b943db02c4872b25c5b6ff326c928ac6d4c2ae4df2911acd3914343578fe7c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e7e77055393dea875bbe5f368a4569ba

SHA1
1a3155b960f023908060a92539c31de9959d52f2

SHA256
c32c98a6137ed1b57ad9ca3a3ae4941f459be3b3ea5164db054ec636187eb210

SHA512
3200b478c8db5afae76de1744649fb29a272f9164de10f83776aefca0ff75be31ff1b1726608c90b6c6d9b14982fa7fa66d9675312804e3753563724a3b98efd

Download Submit