5a9a442ce106c684912ba0dbfc07b380246b8e26faaf961ddd7dd8bc59f20c6c

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 21:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6c476f49c836afe00937d42d3df63098_JaffaCakes118.html
Size

36KB
MD5

6c476f49c836afe00937d42d3df63098
SHA1

f182e14a1c4b20173a286a7df1207005770287fd
SHA256

5a9a442ce106c684912ba0dbfc07b380246b8e26faaf961ddd7dd8bc59f20c6c
SHA512

23d9f0183b56de4d4752cdf5e14af7ca1b42cdf225c5c7d9a62a10ae21a4c630cc5c9ded8960b2c1cfdf5b64117c2d54cb76a8ecb286cd03551babced92830cb
SSDEEP

384:hhaGATWbTvvWXOnJvsUO9Chh5Dm57umwhnCiB8aMaijgcMKF18iTPfp:jATWn3VnJL5h3Dk7uBCiB8aWMKIePfp

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2164	msedge.exe
2164	msedge.exe
2800	msedge.exe
2800	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2800	msedge.exe
2800	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2420	2800	msedge.exe	85
PID 2800 wrote to memory of 2420	2800	msedge.exe	85
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 3540	2800	msedge.exe	86
PID 2800 wrote to memory of 2164	2800	msedge.exe	87
PID 2800 wrote to memory of 2164	2800	msedge.exe	87
PID 2800 wrote to memory of 856	2800	msedge.exe	88
PID 2800 wrote to memory of 856	2800	msedge.exe	88
PID 2800 wrote to memory of 856	2800	msedge.exe	88
PID 2800 wrote to memory of 856	2800	msedge.exe	88
PID 2800 wrote to memory of 856	2800	msedge.exe	88
PID 2800 wrote to memory of 856	2800	msedge.exe	88
PID 2800 wrote to memory of 856	2800	msedge.exe	88
PID 2800 wrote to memory of 856	2800	msedge.exe	88
PID 2800 wrote to memory of 856	2800	msedge.exe	88
PID 2800 wrote to memory of 856	2800	msedge.exe	88
PID 2800 wrote to memory of 856	2800	msedge.exe	88
PID 2800 wrote to memory of 856	2800	msedge.exe	88
PID 2800 wrote to memory of 856	2800	msedge.exe	88
PID 2800 wrote to memory of 856	2800	msedge.exe	88
PID 2800 wrote to memory of 856	2800	msedge.exe	88
PID 2800 wrote to memory of 856	2800	msedge.exe	88
PID 2800 wrote to memory of 856	2800	msedge.exe	88
PID 2800 wrote to memory of 856	2800	msedge.exe	88
PID 2800 wrote to memory of 856	2800	msedge.exe	88
PID 2800 wrote to memory of 856	2800	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6c476f49c836afe00937d42d3df63098_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc114846f8,0x7ffc11484708,0x7ffc11484718
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1476,3565046973188889264,4466526745186253012,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1476,3565046973188889264,4466526745186253012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1476,3565046973188889264,4466526745186253012,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,3565046973188889264,4466526745186253012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,3565046973188889264,4466526745186253012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1476,3565046973188889264,4466526745186253012,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4040 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
266B

MD5
89b056240af807a1278d46f325dc5f62

SHA1
1e66dd4c9e030c5d2c23047a085822a372f17887

SHA256
f5f9f29fbb067a58ba60bebb0f36a61c535a234e45ff52f47f192d2836bac9f7

SHA512
109696dba2069f9b711948a93ebb6be8ee851336b14512c613196ca495158e8e53c3ad9bbc07aed6ea037b432f1101492a0e3c761d658f78e6e04d87b2715044

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
222e27ed740d3c2b88e7ca99f0be5aad

SHA1
fbdfa74f7ce3a2f487038f69506a3067fd60fc3c

SHA256
e6dcb0cd6a25ab0df3e86ccf4ea89c5e08dd1be59da45a100a82bbc3f60c5a51

SHA512
a659d7b6d6201daeaa87428bd1c7dfdfa216e4794d8d4addf4f181d4659dfb73903daef980cd42a5d065eaddf30c833ff270d870d6b5f61004282d8f75ec98fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e8c972f52233bf07a072186a70655513

SHA1
e864c4c9e541b8a130e30cdb7f7d2b0945174992

SHA256
558713d722e7ffac1760030f724d70bec517982888fa4b007639af51eea34d9c

SHA512
73985135465af5edc234c50299809a09b7290356ef8c44887263ea81654fab2c80d64197d1d1f636c44ab68cace81f9c06f00ee4f18db7ef72c707b0e4358aba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
640f0f21b21c4be7ebca8a84eecf7794

SHA1
0205a671bb816eacf20e2b386eca97796cb66d72

SHA256
2b2812623fcdc8021315aac2dab3abe781aabbac8105e770fc91f08722a1a8b0

SHA512
badb3f2c37aeaf0e3ca05c5d4e3064d6a3f514b0acd352c13cf27e26aef69b2ff61317cf1906221b089015b2b14cb05da5472601cedb1b2a71346d3c85805917

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
394c1182a6d19c0a073f2e5b7344e4af

SHA1
d4ca24740308f27fb558fcf7ad3f6dd0ee0ca995

SHA256
db79e247011719450b49462b3f7d3cd930af0fb81ebaf85d57be2285edec02ad

SHA512
1654f9697499daeec72309f90f0bc94a44887c87be1b62c8eaab18566bfb0a76754c0397395bd5048287dbe2520928fdf0c0ba0804d568cae3dea0e59364941c

Download Submit