a127f6f3cf55784cece9f597b024970d2992036bb1485756258c1ce4174f8543

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 09:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e0cdd169ac56dcde0172e57c1c1d510_JaffaCakes118.html
Size

140KB
MD5

6e0cdd169ac56dcde0172e57c1c1d510
SHA1

46e21824a692efdce4544535e52ef44cdaa91f8e
SHA256

a127f6f3cf55784cece9f597b024970d2992036bb1485756258c1ce4174f8543
SHA512

1368607f633759a8e381d20ceb0a05d832a62cdadebd82e121d2b87070724daf45768426d3474079f9d8702ee993813c6ae50fdf148d1fb29148bce55e8cf1c8
SSDEEP

1536:SddyNVn3lKwlYyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:Sdm6yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1512	msedge.exe
1512	msedge.exe
4512	msedge.exe
4512	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 2828	4512	msedge.exe	85
PID 4512 wrote to memory of 2828	4512	msedge.exe	85
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1056	4512	msedge.exe	86
PID 4512 wrote to memory of 1512	4512	msedge.exe	87
PID 4512 wrote to memory of 1512	4512	msedge.exe	87
PID 4512 wrote to memory of 2524	4512	msedge.exe	88
PID 4512 wrote to memory of 2524	4512	msedge.exe	88
PID 4512 wrote to memory of 2524	4512	msedge.exe	88
PID 4512 wrote to memory of 2524	4512	msedge.exe	88
PID 4512 wrote to memory of 2524	4512	msedge.exe	88
PID 4512 wrote to memory of 2524	4512	msedge.exe	88
PID 4512 wrote to memory of 2524	4512	msedge.exe	88
PID 4512 wrote to memory of 2524	4512	msedge.exe	88
PID 4512 wrote to memory of 2524	4512	msedge.exe	88
PID 4512 wrote to memory of 2524	4512	msedge.exe	88
PID 4512 wrote to memory of 2524	4512	msedge.exe	88
PID 4512 wrote to memory of 2524	4512	msedge.exe	88
PID 4512 wrote to memory of 2524	4512	msedge.exe	88
PID 4512 wrote to memory of 2524	4512	msedge.exe	88
PID 4512 wrote to memory of 2524	4512	msedge.exe	88
PID 4512 wrote to memory of 2524	4512	msedge.exe	88
PID 4512 wrote to memory of 2524	4512	msedge.exe	88
PID 4512 wrote to memory of 2524	4512	msedge.exe	88
PID 4512 wrote to memory of 2524	4512	msedge.exe	88
PID 4512 wrote to memory of 2524	4512	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6e0cdd169ac56dcde0172e57c1c1d510_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb611046f8,0x7ffb61104708,0x7ffb61104718
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,15401535556193450634,9277934686144322419,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,15401535556193450634,9277934686144322419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,15401535556193450634,9277934686144322419,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15401535556193450634,9277934686144322419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15401535556193450634,9277934686144322419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,15401535556193450634,9277934686144322419,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
165dcf4cede1aaeb189c918d472426b8

SHA1
b0278acebff807cbe45cb240da0e83c043692d10

SHA256
d198aeab7eef01814aeab1349f09ce700f00d089bf10e943c2adc2b4800b8b56

SHA512
698297129ca10ac5a58a5212352970d2a4794c2d0d81a02f994cb9d4849fe446769247a2164f70a7eecc70efd502d7e6564b8fe0f1428a00f7e7b9b9a6c1e91e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
49ac145d1baa28864abab6e01f71c4f7

SHA1
7703494832a78feccc62f50bb5620fc4a427c1ca

SHA256
f2dc91042f9a2c15431b8acb83c37fe6d8fe68ed7d91e327f7fc4b2ebdcbf5b5

SHA512
159a65411042719c0f93a7aeb6d2730a1d2b4d2555b717308490abf95160369546ed72617fdc861397b4341667834a8f0c73e827d36d53493472f540c33b3864

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8daa10821c890f3e78b764354d2959bf

SHA1
50a050c3e275236edc41a157c381dc77da185787

SHA256
ae4bd7be51acc479b5b9f150cf105138e6a6c08efcf19eeb88259f4cb8e3a756

SHA512
d49b545fdd41eb4413878af115c59ff71cf3fd8521e9fb5ac83c727b3174e82609764d5d941bd07fa4c0fef8d52053515269040af769e3fc8fbfaf58e4f45645

Download Submit