d6b8a1c72260dbc76426633cba3312a94706ce1ecf200bdbbc4878dff51e66e8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67eb9f0794da82cc0b4248d538cb8da9_JaffaCakes118.html
Size

350KB
MD5

67eb9f0794da82cc0b4248d538cb8da9
SHA1

1b033cf2ba30cb42edd240053ea665b83e8339c1
SHA256

d6b8a1c72260dbc76426633cba3312a94706ce1ecf200bdbbc4878dff51e66e8
SHA512

d698eb8cdb5935f4514fd2549a2e76f1baff47eb5543ed6d58ead11a50318ee8c58cec6ca915a61d58a4db79f09cabdfed19127fb505247760715826cc7a9548
SSDEEP

3072:SncyrfiLJWn/OKz6vaz+rOPFgDVZzkETsD:SVrfiLJW2Kzvz+rOPFWsD

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3452	msedge.exe
3452	msedge.exe
4680	msedge.exe
4680	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 4524	4680	msedge.exe	83
PID 4680 wrote to memory of 4524	4680	msedge.exe	83
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 4204	4680	msedge.exe	84
PID 4680 wrote to memory of 3452	4680	msedge.exe	85
PID 4680 wrote to memory of 3452	4680	msedge.exe	85
PID 4680 wrote to memory of 5020	4680	msedge.exe	86
PID 4680 wrote to memory of 5020	4680	msedge.exe	86
PID 4680 wrote to memory of 5020	4680	msedge.exe	86
PID 4680 wrote to memory of 5020	4680	msedge.exe	86
PID 4680 wrote to memory of 5020	4680	msedge.exe	86
PID 4680 wrote to memory of 5020	4680	msedge.exe	86
PID 4680 wrote to memory of 5020	4680	msedge.exe	86
PID 4680 wrote to memory of 5020	4680	msedge.exe	86
PID 4680 wrote to memory of 5020	4680	msedge.exe	86
PID 4680 wrote to memory of 5020	4680	msedge.exe	86
PID 4680 wrote to memory of 5020	4680	msedge.exe	86
PID 4680 wrote to memory of 5020	4680	msedge.exe	86
PID 4680 wrote to memory of 5020	4680	msedge.exe	86
PID 4680 wrote to memory of 5020	4680	msedge.exe	86
PID 4680 wrote to memory of 5020	4680	msedge.exe	86
PID 4680 wrote to memory of 5020	4680	msedge.exe	86
PID 4680 wrote to memory of 5020	4680	msedge.exe	86
PID 4680 wrote to memory of 5020	4680	msedge.exe	86
PID 4680 wrote to memory of 5020	4680	msedge.exe	86
PID 4680 wrote to memory of 5020	4680	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\67eb9f0794da82cc0b4248d538cb8da9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa84ef46f8,0x7ffa84ef4708,0x7ffa84ef4718
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,5296332691138779499,9619579548196749760,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,5296332691138779499,9619579548196749760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,5296332691138779499,9619579548196749760,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5296332691138779499,9619579548196749760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5296332691138779499,9619579548196749760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5296332691138779499,9619579548196749760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,5296332691138779499,9619579548196749760,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3052 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bed43590fdac4fdceb8de9eb6adaa23a

SHA1
33ed58bd89b28ff981bd0ea0a6b078f0f52fe5fb

SHA256
b23779703aa1f7537b1dbbca8fe5a4be8eb2797cc9ded36584013e796e14362f

SHA512
33d034e4aba2f94322249ef79c98f8f8da5d0dcc2d3e0699a60e9dbb570736046460b660bd4d0fba7a18eed301ad6ebf0a6eaa7f1f5347e3a15b6d24925c5af3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
57449df7b4f22230682d16daaa69204d

SHA1
4b1972e9eababa88e135eb14dcf422cf4d931048

SHA256
491488fe1477029dc1105645f5b0fd501de6ffd9a81e742b2e872c95d41d158c

SHA512
deb49ef578bacf06b31d74c66df8ee29944f2c150c31fc45c65c53ba824f57b389c9cc64a7fba9057d3f94c62a259dbb94abdc7d608dd1f0de1ce0df6f9c456f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1e835b6e941ebc58ae521060303507f9

SHA1
b998462161f115689f50e80e16dd0edc607827cc

SHA256
2911e78876a064f18c98ef838669023dfd0a979d0b04f0570515f8eb4d75d016

SHA512
6465a1c015464582657e185779c8eb6c417eae09b89a93897cbb0723d8a1b4004b801c17a93cc85e3db559407ee0afdd0412a3ad566ee8e3f57fa789cb228a6d

Download Submit