f376b59fa1b6da56d6b12542d6c5e5fbe5c8ac952704780f5aa6a3e5d82f52ba

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6884302b78e36e247b091df9a3287a9d_JaffaCakes118.html
Size

139KB
MD5

6884302b78e36e247b091df9a3287a9d
SHA1

19142e5209792671ca91b6bf84de5082dffaec66
SHA256

f376b59fa1b6da56d6b12542d6c5e5fbe5c8ac952704780f5aa6a3e5d82f52ba
SHA512

22f6dd0f610e482b7532d2a598f2b3b002d3092643cccb16e40acbbff8987ce788cb7da0b37b809b14927e1e02ad0ab892f05e7a3646a952f5f8b4cd2d6e95b4
SSDEEP

1536:SCNgCNGHlmXZtyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:SCmfgZtyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2232	msedge.exe
2232	msedge.exe
4700	msedge.exe
4700	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 4664	4700	msedge.exe	83
PID 4700 wrote to memory of 4664	4700	msedge.exe	83
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 3704	4700	msedge.exe	84
PID 4700 wrote to memory of 2232	4700	msedge.exe	85
PID 4700 wrote to memory of 2232	4700	msedge.exe	85
PID 4700 wrote to memory of 3316	4700	msedge.exe	86
PID 4700 wrote to memory of 3316	4700	msedge.exe	86
PID 4700 wrote to memory of 3316	4700	msedge.exe	86
PID 4700 wrote to memory of 3316	4700	msedge.exe	86
PID 4700 wrote to memory of 3316	4700	msedge.exe	86
PID 4700 wrote to memory of 3316	4700	msedge.exe	86
PID 4700 wrote to memory of 3316	4700	msedge.exe	86
PID 4700 wrote to memory of 3316	4700	msedge.exe	86
PID 4700 wrote to memory of 3316	4700	msedge.exe	86
PID 4700 wrote to memory of 3316	4700	msedge.exe	86
PID 4700 wrote to memory of 3316	4700	msedge.exe	86
PID 4700 wrote to memory of 3316	4700	msedge.exe	86
PID 4700 wrote to memory of 3316	4700	msedge.exe	86
PID 4700 wrote to memory of 3316	4700	msedge.exe	86
PID 4700 wrote to memory of 3316	4700	msedge.exe	86
PID 4700 wrote to memory of 3316	4700	msedge.exe	86
PID 4700 wrote to memory of 3316	4700	msedge.exe	86
PID 4700 wrote to memory of 3316	4700	msedge.exe	86
PID 4700 wrote to memory of 3316	4700	msedge.exe	86
PID 4700 wrote to memory of 3316	4700	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6884302b78e36e247b091df9a3287a9d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffda88e46f8,0x7ffda88e4708,0x7ffda88e4718
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,18221839753458025767,5745867361505671129,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,18221839753458025767,5745867361505671129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,18221839753458025767,5745867361505671129,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2960 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,18221839753458025767,5745867361505671129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,18221839753458025767,5745867361505671129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,18221839753458025767,5745867361505671129,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2428 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
969b164ed065136b18c694f84c4acd51

SHA1
e7fddfb84eb82341aa4c0315e2e7e81ab3d7cf07

SHA256
becc00a1917268fa5f6bd86b8657cbeecc27acf58a960b090989b7ca1af7635f

SHA512
65d6a0338de2475521247ad45020aa44f2d20248513fe9ea55fff94c243fbe932cb53306a844a00bc70016615f4688a303e2faafa73f37b2c6632bb5e48afbaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1c6565a12db6109296bf9f1a1210457a

SHA1
e1437fafc0cfd9669395fa5540896151d1350e78

SHA256
7f1997644f3b336425e8bdd19e8285c78ce53a01e8cbb60ed162e74e4800585d

SHA512
6d3b1c60360573bb659009c9f64d44f10077b23cabeac952b248128fc78d57f9c79f89bce12ecb31eb5ad7c4a7a32b5019b4bc05f5badb75470ec87b443ff051

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8531ebe299a5748787077f1dc44a1eb4

SHA1
ed7d08f4233c1de3f14fca5c77fe8235be7bc788

SHA256
c0ebfb8f80482111d7ded591f80e00cb06815db4509ca952bea7c3d3f0eeba98

SHA512
59bf2701d8329d3dba987ed64ccdd02aced8f1ceb3c38377f3397412213f720412a38d3449db1194b8b58bda328aba3900d867960a380096cd66fdcf4db4edb9

Download Submit