8500e53295c799144d7e6caf138d6345a46c59cc71baf5706742c0b5b36499d1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 21:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76d8dac80473687d6bd9ddc441e59559_JaffaCakes118.html
Size

147KB
MD5

76d8dac80473687d6bd9ddc441e59559
SHA1

6b6414a47ae5c4c582338c474d4f75cce745992d
SHA256

8500e53295c799144d7e6caf138d6345a46c59cc71baf5706742c0b5b36499d1
SHA512

04a05616c84366ef33d667c70e9f6ce0df87b2a7995ee066ec956dc76865dd42e31fbce27fbe9aaf9ab362506b569aca6f511854a6ea6ca7d2f22972cd819f77
SSDEEP

1536:SGLkkpsFair8lKyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:So1YyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4908	msedge.exe
4908	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 1692	4908	msedge.exe	83
PID 4908 wrote to memory of 1692	4908	msedge.exe	83
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 2208	4908	msedge.exe	84
PID 4908 wrote to memory of 4236	4908	msedge.exe	85
PID 4908 wrote to memory of 4236	4908	msedge.exe	85
PID 4908 wrote to memory of 2800	4908	msedge.exe	86
PID 4908 wrote to memory of 2800	4908	msedge.exe	86
PID 4908 wrote to memory of 2800	4908	msedge.exe	86
PID 4908 wrote to memory of 2800	4908	msedge.exe	86
PID 4908 wrote to memory of 2800	4908	msedge.exe	86
PID 4908 wrote to memory of 2800	4908	msedge.exe	86
PID 4908 wrote to memory of 2800	4908	msedge.exe	86
PID 4908 wrote to memory of 2800	4908	msedge.exe	86
PID 4908 wrote to memory of 2800	4908	msedge.exe	86
PID 4908 wrote to memory of 2800	4908	msedge.exe	86
PID 4908 wrote to memory of 2800	4908	msedge.exe	86
PID 4908 wrote to memory of 2800	4908	msedge.exe	86
PID 4908 wrote to memory of 2800	4908	msedge.exe	86
PID 4908 wrote to memory of 2800	4908	msedge.exe	86
PID 4908 wrote to memory of 2800	4908	msedge.exe	86
PID 4908 wrote to memory of 2800	4908	msedge.exe	86
PID 4908 wrote to memory of 2800	4908	msedge.exe	86
PID 4908 wrote to memory of 2800	4908	msedge.exe	86
PID 4908 wrote to memory of 2800	4908	msedge.exe	86
PID 4908 wrote to memory of 2800	4908	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\76d8dac80473687d6bd9ddc441e59559_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffffc5d46f8,0x7ffffc5d4708,0x7ffffc5d4718
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,18031673167986896789,15498774894143505038,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,18031673167986896789,15498774894143505038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,18031673167986896789,15498774894143505038,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,18031673167986896789,15498774894143505038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,18031673167986896789,15498774894143505038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,18031673167986896789,15498774894143505038,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\24c34a2d-f908-42f6-9462-d7ea9cd94c1d.tmp

Filesize
11KB

MD5
9d78650fc7affa147ed17ffa8d7e790b

SHA1
08f87a910176e0005d5b1c34cf7847ef7f19003f

SHA256
fd6e02bd08c09d494fed5f9a7b5a59926cbea3febefddcfe0ab4d075c9be3840

SHA512
9c015d6e8d4cc50e3bb806750bbe95c9247209a28cbc1184b2dbf5f00d30c6dc6e5592fddb882588c30519c7101f06bab0c89344cb9b95da19b73586b33dbb18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
59b97fb900cbdd3813889b4b6734ccf0

SHA1
17cab1d19a21bbb090e9502f25ddd8d9d5cb6fd0

SHA256
115a60b7e99431be3e5ee5dda67ab01bd4201272079d20b786406ec18a77f474

SHA512
d9d32069b19515eb901ba0d18d29094f78675bbae39983cb9319a57a28447b7c6a3f11c8006ccfb99d2c5ce666ec0152becbd470cde9f50df1cc51d356604edd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
559d93806c1d85282515a7796c6d11f8

SHA1
9dffa124959733f7e8cb45ad04bda8afff6c3baf

SHA256
14f88e9ea02f6a3cb7e9ce2bfa562ce336b8f5c1ceea74f0887ad128b87fe334

SHA512
d2a2e39f4b8c2c9647668862befc458cf284719912b77a7d4bea16c65ec174abd39066a9f2ed37ca87fe9f0d0979dd07f9e07a51ca41bd275ff2b29704df8384

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2fcb4869badb8247159c29439ddb13d6

SHA1
588f496455eb59f049aa0caabbbece4332bc86ba

SHA256
a49d178074f241131113b69425bcb81b9dcf8ae9f9b66dde581ea18023d59a77

SHA512
e289415487e2048dbc44d96b0746321d9a752fcb2775c924dd7426ffcd6b60731edcc96215559d34a281b8ad150e4a3b19dc324d5b9bd4105005877457a56385

Download Submit