5136f20f7a5a256cce3b482bf0bd625ddf1d9ed7a5da2a026f74e94b076d6ee5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 20:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6c32f3f9edc95901d66d6321609d5791_JaffaCakes118.html
Size

158KB
MD5

6c32f3f9edc95901d66d6321609d5791
SHA1

7528405cb36a94a46833a8a089ca06c701a5e4f0
SHA256

5136f20f7a5a256cce3b482bf0bd625ddf1d9ed7a5da2a026f74e94b076d6ee5
SHA512

e7099fe9e7ab62b54bf97f6bcb059f8cbb73634e3e4c3df06ca73e5ff9ba24c761dd0e525389d9dfcc5dd809c12a39bb1c75bf836b04561898b95f1c2f4a0e3a
SSDEEP

1536:SW2V0ZmQ7z1FXUvSolLkqCyCFeyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1o:SWB5DnFeyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
1708	msedge.exe
1708	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1708	msedge.exe
1708	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 4808	1708	msedge.exe	84
PID 1708 wrote to memory of 4808	1708	msedge.exe	84
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 3292	1708	msedge.exe	85
PID 1708 wrote to memory of 4972	1708	msedge.exe	86
PID 1708 wrote to memory of 4972	1708	msedge.exe	86
PID 1708 wrote to memory of 2144	1708	msedge.exe	87
PID 1708 wrote to memory of 2144	1708	msedge.exe	87
PID 1708 wrote to memory of 2144	1708	msedge.exe	87
PID 1708 wrote to memory of 2144	1708	msedge.exe	87
PID 1708 wrote to memory of 2144	1708	msedge.exe	87
PID 1708 wrote to memory of 2144	1708	msedge.exe	87
PID 1708 wrote to memory of 2144	1708	msedge.exe	87
PID 1708 wrote to memory of 2144	1708	msedge.exe	87
PID 1708 wrote to memory of 2144	1708	msedge.exe	87
PID 1708 wrote to memory of 2144	1708	msedge.exe	87
PID 1708 wrote to memory of 2144	1708	msedge.exe	87
PID 1708 wrote to memory of 2144	1708	msedge.exe	87
PID 1708 wrote to memory of 2144	1708	msedge.exe	87
PID 1708 wrote to memory of 2144	1708	msedge.exe	87
PID 1708 wrote to memory of 2144	1708	msedge.exe	87
PID 1708 wrote to memory of 2144	1708	msedge.exe	87
PID 1708 wrote to memory of 2144	1708	msedge.exe	87
PID 1708 wrote to memory of 2144	1708	msedge.exe	87
PID 1708 wrote to memory of 2144	1708	msedge.exe	87
PID 1708 wrote to memory of 2144	1708	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6c32f3f9edc95901d66d6321609d5791_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa6f946f8,0x7ffaa6f94708,0x7ffaa6f94718
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,15209004097187270601,15023796091252373908,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,15209004097187270601,15023796091252373908,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,15209004097187270601,15023796091252373908,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15209004097187270601,15023796091252373908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15209004097187270601,15023796091252373908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,15209004097187270601,15023796091252373908,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=212 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
190f820bb29c3b9357e9749191677582

SHA1
d9222d814ee0acacc9f01108ee9287a413c03f4c

SHA256
4e92486237e402bfeaa3bc18c03c930947f25e1eb6b4bdd37946edd53ab065a3

SHA512
055ebf25cba0e81604d78d62560fd8f1ef24f34ea054bc6f7741158666577c4024e0fb9d6bf44769b25c6668f4332489cffdcac72aef8aa32e1b938e5e561a76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
26fbd155469a8740741d425c016e0eb9

SHA1
2ceb91473bf5b567a1fdf0557a867524459b4301

SHA256
3e1a4bb6f973b37feb87204d869b7b4a6f11957f49d448f5136ecaf17bf3fe12

SHA512
0a25e78821b1e8bb4a847417317621ff86d16f58f423af7f0bc6218cb9d0f968a2d229fe339bd786fbb06a8bd71379b5275701529b58e926e17ea449167e6564

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
225c07803e1da8eebdc0dbd4396a34c4

SHA1
52fecc8cd100f5226fbbcc8c95e8c2c63062bdc3

SHA256
103ea13a62370feeda19994d93bd0b55369dec1ff33ac54c4f2b1ec059a35753

SHA512
befbfbcf51e6588e53624b075dcacb3f068af9e6d9f4f8d367b1b9041a3770f80f37d157e72fdbd47352d131dda09614d86e5b10c06dfac8e45d2e0a48d55e75

Download Submit