6026ca9dd587aecd049f4dc1cc212f882fc717d857889d35dacc7d25022f3cf5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f1ed205bf7c0dfa6037789fe8d5007d_JaffaCakes118.html
Size

70KB
MD5

6f1ed205bf7c0dfa6037789fe8d5007d
SHA1

71299370d4138ec173ca38a1735b6727f8d6ad6b
SHA256

6026ca9dd587aecd049f4dc1cc212f882fc717d857889d35dacc7d25022f3cf5
SHA512

be7628b701cd598a83c5b77d631d406ce2e59f05de23c8461bf4d1dc1529c8236ea1476a1118e60fea9e928ef19151d91f92a939a9be8c21dc1573331fc53dfb
SSDEEP

1536:5nk8vJVEOr+6XKZVU03Y/lWvQW8Xz+LKtzF3iAv1nXyZiqJ6Q:W8vJV1r+6X+xvQWQz+LKtB3i+1nCZiqf

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
4972	msedge.exe
4972	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 536	4972	msedge.exe	85
PID 4972 wrote to memory of 536	4972	msedge.exe	85
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4804	4972	msedge.exe	86
PID 4972 wrote to memory of 4496	4972	msedge.exe	87
PID 4972 wrote to memory of 4496	4972	msedge.exe	87
PID 4972 wrote to memory of 4432	4972	msedge.exe	88
PID 4972 wrote to memory of 4432	4972	msedge.exe	88
PID 4972 wrote to memory of 4432	4972	msedge.exe	88
PID 4972 wrote to memory of 4432	4972	msedge.exe	88
PID 4972 wrote to memory of 4432	4972	msedge.exe	88
PID 4972 wrote to memory of 4432	4972	msedge.exe	88
PID 4972 wrote to memory of 4432	4972	msedge.exe	88
PID 4972 wrote to memory of 4432	4972	msedge.exe	88
PID 4972 wrote to memory of 4432	4972	msedge.exe	88
PID 4972 wrote to memory of 4432	4972	msedge.exe	88
PID 4972 wrote to memory of 4432	4972	msedge.exe	88
PID 4972 wrote to memory of 4432	4972	msedge.exe	88
PID 4972 wrote to memory of 4432	4972	msedge.exe	88
PID 4972 wrote to memory of 4432	4972	msedge.exe	88
PID 4972 wrote to memory of 4432	4972	msedge.exe	88
PID 4972 wrote to memory of 4432	4972	msedge.exe	88
PID 4972 wrote to memory of 4432	4972	msedge.exe	88
PID 4972 wrote to memory of 4432	4972	msedge.exe	88
PID 4972 wrote to memory of 4432	4972	msedge.exe	88
PID 4972 wrote to memory of 4432	4972	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6f1ed205bf7c0dfa6037789fe8d5007d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc5b1c46f8,0x7ffc5b1c4708,0x7ffc5b1c4718
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,3515667103752198102,16530820397735419978,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1976,3515667103752198102,16530820397735419978,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1976,3515667103752198102,16530820397735419978,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,3515667103752198102,16530820397735419978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,3515667103752198102,16530820397735419978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,3515667103752198102,16530820397735419978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,3515667103752198102,16530820397735419978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,3515667103752198102,16530820397735419978,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
986169738e1da246b3bd94f5991250af

SHA1
28ff6c8f28b87f23d46d8eaa052211fa8680ee47

SHA256
d13ffc9d213f8004bb777df67a6666dfcd56110898ffe8beb65da74a5c06182c

SHA512
3c81e4eb0f97d3d6ab82a79763bbfcb8df3e4491bcf1e2558c2c5cf749d84d744b07832ab0aea9805de8cfc9fdb7a06c42682b3126df27da9c23eab4e0093be4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
261B

MD5
091241544895f2b470459382d670dc74

SHA1
153aeb4c2fe23f2e0b631e46933abe3d7e5fbe2c

SHA256
8f33e6929500d4b63836d8dcb44b65884ccd3a0e1e1aa313bb0813f89c0c2d9b

SHA512
a2b85a978fe65ecdb51dcb8b698e781065c1af5a67f0b63eb00c04c1c05dce3e9d93608e03086d87bdf44add5611e1ef98dda422781aeca41c23167a24be3fa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3b2033f8c817d9399e20972c6d066ee6

SHA1
45231857f2b9c6c42d9fcd1bf8fb5e5b17e53076

SHA256
9cef04337b732283d0768c2e80daf9f136ceca254ecf5ed9351d8bb2f70fc251

SHA512
2ed8f16934c787cab4740e5d3dd4d762a27c9ae94af382196cbfb930ae187702e829e0f4b520e7b37d807c8aa376813bc474893649b5d1db68d2e0f4a0fac281

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c44cd760bda90e05d391976bccd915e2

SHA1
38d61313c60063861a009cf0f41b3afa34d94def

SHA256
a9138c81e70b27fb9de9bb60a73bd2e4857a4895ed910ac33b502ace8a726270

SHA512
34774fd05abacb182b33d3635d8d48c07699d881246a9d30f552cbeeeb0068328af364ec52464ee40483c489cbadd230811600cf5d34c57173f369cadfcd159f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
43f6031534f08d5d40d090a1b6d7bcc1

SHA1
3ada8c47dda20b6348ff7849083bcdfc9ba4a613

SHA256
97e332a17785c47025b8c789b18f56151d98c8f3fb2ef948380911cff7ed693a

SHA512
bb075e4185ca7e51b9852ed3058bc2b4d455c5cc2ed29ee553898286872b049d29cfc140c0fde4f3ebfa505d9beb14d23d6b170d62d1e7c1e2efe4f243183afa

Download Submit