e811d23a52cc1353598d104e48e392d82953ef5812a312bccf29e825f9453ad2

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 17:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72bd083eed2d7b79108542c5d15bc3a6_JaffaCakes118.html
Size

213KB
MD5

72bd083eed2d7b79108542c5d15bc3a6
SHA1

dc561bce830a9f4f3f2bbcd572ff3f37fb325c93
SHA256

e811d23a52cc1353598d104e48e392d82953ef5812a312bccf29e825f9453ad2
SHA512

4a772209562438d93da790dd68eb307e70d455964f5c596fc64e302679d65693cf778efdbc7abbf9260bf36f31989b2d7cc2928b898755d79ed5140619a1373e
SSDEEP

3072:SlLAnlwuKqOwEyfkMY+BES09JXAnyrZalI+YQ:SlaJJsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3036	msedge.exe
3036	msedge.exe
1896	msedge.exe
1896	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1896	msedge.exe
1896	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 1332	1896	msedge.exe	82
PID 1896 wrote to memory of 1332	1896	msedge.exe	82
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 4532	1896	msedge.exe	83
PID 1896 wrote to memory of 3036	1896	msedge.exe	84
PID 1896 wrote to memory of 3036	1896	msedge.exe	84
PID 1896 wrote to memory of 2400	1896	msedge.exe	85
PID 1896 wrote to memory of 2400	1896	msedge.exe	85
PID 1896 wrote to memory of 2400	1896	msedge.exe	85
PID 1896 wrote to memory of 2400	1896	msedge.exe	85
PID 1896 wrote to memory of 2400	1896	msedge.exe	85
PID 1896 wrote to memory of 2400	1896	msedge.exe	85
PID 1896 wrote to memory of 2400	1896	msedge.exe	85
PID 1896 wrote to memory of 2400	1896	msedge.exe	85
PID 1896 wrote to memory of 2400	1896	msedge.exe	85
PID 1896 wrote to memory of 2400	1896	msedge.exe	85
PID 1896 wrote to memory of 2400	1896	msedge.exe	85
PID 1896 wrote to memory of 2400	1896	msedge.exe	85
PID 1896 wrote to memory of 2400	1896	msedge.exe	85
PID 1896 wrote to memory of 2400	1896	msedge.exe	85
PID 1896 wrote to memory of 2400	1896	msedge.exe	85
PID 1896 wrote to memory of 2400	1896	msedge.exe	85
PID 1896 wrote to memory of 2400	1896	msedge.exe	85
PID 1896 wrote to memory of 2400	1896	msedge.exe	85
PID 1896 wrote to memory of 2400	1896	msedge.exe	85
PID 1896 wrote to memory of 2400	1896	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\72bd083eed2d7b79108542c5d15bc3a6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc53246f8,0x7ffcc5324708,0x7ffcc5324718
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,17154943571847701894,2546223164674201359,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,17154943571847701894,2546223164674201359,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,17154943571847701894,2546223164674201359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17154943571847701894,2546223164674201359,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17154943571847701894,2546223164674201359,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,17154943571847701894,2546223164674201359,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
10f74e7e11f52fb917683cc55b09eb50

SHA1
399bdad33c9256eaa0c0f8fad517bee31a9132fc

SHA256
e6084abd2feab2e6d6fd36f46a03f2c170661ddf273718444bf4d9b11693bdd2

SHA512
d208ad9d840ca9b438183cbbbfd51fdab7e57f61c9c0d4a6d5bfa049017741f2cbe7f23016a7f3c2af5a831b422ca36ce330b366ea2e85fec5c0f0897d1c5f0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1e36a803582f37dd0a2d438b5381624f

SHA1
ce1377e891571fa543b14788937449e85fec714f

SHA256
fb9a05e2e9cfeb2a7609eb80933fac4728af6e977cce65405c3d98ee51423978

SHA512
8b27dce5d8375a33083be41d73bb6f9183fe74e3201218477463c4ce83131e17313b8b9a0d1588a96a897aa3320511dfe6232217adca821023365130a7645154

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bd449b09bc4c937a7bc7b23bec6367ea

SHA1
ac2fa252d6e578023ae1b6884aa44cc4b25816f1

SHA256
d824aa32ea43c5aa4a525be49563186394edd2a160a0e97a93a4dd9b301486ea

SHA512
246bfe2f7b68e62e37b3bf185ebb4f39d7c8ee5f3baf305abee506c4e85af5e80adbcd3c6779d4bfd3982dc3b0410f7799ee00aba1f3d706c80812cc84ca6325

Download Submit