06ba221f49b5d4d83bcf30d48ca606ff30b8e3b59e3bf101bd2b9398c32f3bf1

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

738a03cb8d6b4081b3351b9f052b7eb3_JaffaCakes118.html
Size

207KB
MD5

738a03cb8d6b4081b3351b9f052b7eb3
SHA1

140c2f3ca75ee46e8e275052f34618d160f018c7
SHA256

06ba221f49b5d4d83bcf30d48ca606ff30b8e3b59e3bf101bd2b9398c32f3bf1
SHA512

bb392b7c468c8c8af38c738363e88dfc17e446c950adc7117231d2127256b157d8607df221f4614d8e8dc35b406fa6e3a4b7cb70eda8007ad129847c83096cb7
SSDEEP

6144:g530DH6NEQwjcHXxQRVufJc/09H1ksY5R:guDHQmjcxQRVufJc/ZR

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1872	msedge.exe
1872	msedge.exe
3308	msedge.exe
3308	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 2992	3308	msedge.exe	83
PID 3308 wrote to memory of 2992	3308	msedge.exe	83
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1476	3308	msedge.exe	84
PID 3308 wrote to memory of 1872	3308	msedge.exe	85
PID 3308 wrote to memory of 1872	3308	msedge.exe	85
PID 3308 wrote to memory of 2428	3308	msedge.exe	86
PID 3308 wrote to memory of 2428	3308	msedge.exe	86
PID 3308 wrote to memory of 2428	3308	msedge.exe	86
PID 3308 wrote to memory of 2428	3308	msedge.exe	86
PID 3308 wrote to memory of 2428	3308	msedge.exe	86
PID 3308 wrote to memory of 2428	3308	msedge.exe	86
PID 3308 wrote to memory of 2428	3308	msedge.exe	86
PID 3308 wrote to memory of 2428	3308	msedge.exe	86
PID 3308 wrote to memory of 2428	3308	msedge.exe	86
PID 3308 wrote to memory of 2428	3308	msedge.exe	86
PID 3308 wrote to memory of 2428	3308	msedge.exe	86
PID 3308 wrote to memory of 2428	3308	msedge.exe	86
PID 3308 wrote to memory of 2428	3308	msedge.exe	86
PID 3308 wrote to memory of 2428	3308	msedge.exe	86
PID 3308 wrote to memory of 2428	3308	msedge.exe	86
PID 3308 wrote to memory of 2428	3308	msedge.exe	86
PID 3308 wrote to memory of 2428	3308	msedge.exe	86
PID 3308 wrote to memory of 2428	3308	msedge.exe	86
PID 3308 wrote to memory of 2428	3308	msedge.exe	86
PID 3308 wrote to memory of 2428	3308	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\738a03cb8d6b4081b3351b9f052b7eb3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c0a746f8,0x7ff8c0a74708,0x7ff8c0a74718
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,8107312247981764776,12993779490662518220,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,8107312247981764776,12993779490662518220,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,8107312247981764776,12993779490662518220,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,8107312247981764776,12993779490662518220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,8107312247981764776,12993779490662518220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,8107312247981764776,12993779490662518220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,8107312247981764776,12993779490662518220,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4224 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
0d6b1e8d34fa2ff042ff22d055724224

SHA1
dcbd66a001eecf3f9400c5a717003327822beb24

SHA256
e0752efaffdbce131d7945ae60b41edd10225bee23a3083594fc2ef24c653b28

SHA512
be2ceef60cec0e9144a39d41cf0ef4f2630724b4bed5330a9ecb53ad8a82f6c91bc42f4174543dd17324dc827e97bdc88b7ed9e9f90512bee89c65bfb3998e72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
38befc8e92099a61aef4a6d57f138629

SHA1
393a7af22a6f90dbd902e958f236e13caf6496a7

SHA256
c0fb1d4bf49b2f3dd60f030b9950ad3c3c647d321f1c64bef4d93b1ca135b118

SHA512
70385fdcd69686f38cb8cf34bef45c8c4525950b1efcf5d4a41191b59edd8ca5bb70aa73bf30c2d14f446f48d0d6328ef685d06017fc3e36ff803ca5e956b811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1a03f5cce0e7235bb7586fc3e1b6fd9c

SHA1
dd4575c8cf88109ea2b71acec8d00b2b09ef3516

SHA256
10b5db67324a9db348c2204cf0ad23cdbfa4c7afa4f2bb634d0301110ee1f912

SHA512
cdd6a9dd86328abd950656989c7a1d4884e8abb92d2aed6e4f1a4a8aab75a7cc8db8e68f93bc8837564624a41b0376dbca8aa6a55d2b7e5fc4e655c8e31b0944

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d1d4ac1cefd3b6f629fe06c036d3e842

SHA1
cef92b73d2a5390cdc652382d58d0ef392ba5261

SHA256
97db88f5df3de3fa2af5a37ae88999ddce60acc21105ee66657b7e54e37dd470

SHA512
5c4e6fdaac4986b7ad7bfed821fa50d4089935996e9a99edc26f25ca33c914074f97f16480e2fb005e4ac7c5456eefa066eca4e315f838a192b43146bf2d5d5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
42acb21f15da0b4273040d99fbaad5b4

SHA1
5711f08f45260b173217a8906439b4a030b10c49

SHA256
819bdd3f01eab9895dea94ab8936d91e2c2c07350db2883a9b22ae3aeb0ca9a9

SHA512
d30df0916fa8b377990944a47aaf023b5797cc4125ec623426120f2f49bd5941a1acd2d83bfabf862076ac3ab863af13ab228e058ae28d1d512edd2d5c37ed5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a9dc.TMP

Filesize
707B

MD5
f1686d7b2d72dcee867b8a78b494037f

SHA1
3dfdd2f375083687056db1850b39e3a36275e0ab

SHA256
414d4cef72f88609747b65c444a5485a9702e43db746e813a339ff28a2561afa

SHA512
f2cc202579bb73652b6738695f9f267f0cc5690ba21b94183f483c4be305c1ed86429c9142e3596d16175727fb66cf606a3f3e1636fdaabcf7cffec2eb691275

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
42f64319586c537a243bf2559a115ab2

SHA1
58fe618a7a32d59f12890171a272e6f480e68b54

SHA256
b26030132a185af621694eeff744fe40202345efddc772fb709744f4fa80c375

SHA512
edf69a8b9756036263052e55de0b4c60b09a7456520930b5721ceb1b8fb4a966ad0c8f90355edd3734cf12388854c05603bb309f04478a56332f9ad8b78d4091

Download Submit