26f782d15adb6b04dd74b0c37e68eef444e94202619c79907a5841594464b4e8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 00:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

775bc5d3ac7ea089af4266b494cf716c_JaffaCakes118.html
Size

149KB
MD5

775bc5d3ac7ea089af4266b494cf716c
SHA1

a4b4f87be507ae8e06755148dd71cb5309812c07
SHA256

26f782d15adb6b04dd74b0c37e68eef444e94202619c79907a5841594464b4e8
SHA512

4a6b47e8a43d746da18789799656c9c301afa7f06bd597e73601422dfe7cf503b3611840193d4886e93b043eb11c5a8ae188721c18a123fd9aba7542aaeac820
SSDEEP

1536:kDNG8E16hC16hvS1L7w/JuKvpxKOqwQ0tDE3yLi+rffMxqNisaQx4V5roEIfGJZI:Y4p1FmhsyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
628	msedge.exe
628	msedge.exe
5088	msedge.exe
5088	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 4916	5088	msedge.exe	81
PID 5088 wrote to memory of 4916	5088	msedge.exe	81
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 3928	5088	msedge.exe	84
PID 5088 wrote to memory of 628	5088	msedge.exe	85
PID 5088 wrote to memory of 628	5088	msedge.exe	85
PID 5088 wrote to memory of 1872	5088	msedge.exe	86
PID 5088 wrote to memory of 1872	5088	msedge.exe	86
PID 5088 wrote to memory of 1872	5088	msedge.exe	86
PID 5088 wrote to memory of 1872	5088	msedge.exe	86
PID 5088 wrote to memory of 1872	5088	msedge.exe	86
PID 5088 wrote to memory of 1872	5088	msedge.exe	86
PID 5088 wrote to memory of 1872	5088	msedge.exe	86
PID 5088 wrote to memory of 1872	5088	msedge.exe	86
PID 5088 wrote to memory of 1872	5088	msedge.exe	86
PID 5088 wrote to memory of 1872	5088	msedge.exe	86
PID 5088 wrote to memory of 1872	5088	msedge.exe	86
PID 5088 wrote to memory of 1872	5088	msedge.exe	86
PID 5088 wrote to memory of 1872	5088	msedge.exe	86
PID 5088 wrote to memory of 1872	5088	msedge.exe	86
PID 5088 wrote to memory of 1872	5088	msedge.exe	86
PID 5088 wrote to memory of 1872	5088	msedge.exe	86
PID 5088 wrote to memory of 1872	5088	msedge.exe	86
PID 5088 wrote to memory of 1872	5088	msedge.exe	86
PID 5088 wrote to memory of 1872	5088	msedge.exe	86
PID 5088 wrote to memory of 1872	5088	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\775bc5d3ac7ea089af4266b494cf716c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83e1046f8,0x7ff83e104708,0x7ff83e104718
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,5069943877759978817,13670845965873327418,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,5069943877759978817,13670845965873327418,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,5069943877759978817,13670845965873327418,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5069943877759978817,13670845965873327418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5069943877759978817,13670845965873327418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,5069943877759978817,13670845965873327418,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3968 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
00c502e1408dbda984e154b29c12f0d8

SHA1
32f209e2c5cbd9e991a9e2d1c17eeab607d2ecbb

SHA256
8cecf14183dd72c5d9cd0a18a2579522f6e84001869dfb15d4cffd11c94d82a8

SHA512
ba76fb15b3c73e473cd77441e0e82acbd1218eb1b5f4aece9f67f623f22b2870dc7b75bfcfd7b2b113ab8571522524e019730315537a5b5b518996de55617e95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c71b3b4d-b115-4d97-9ca5-9fab2b40cc93.tmp

Filesize
6KB

MD5
dd9188637b9f5c6d8346e7963383c47b

SHA1
e9a7ad9f927d9ba5aa65e5a6790766a20b2afdd3

SHA256
d4e08bd7fc920c549edd947a5c9741dacb79ae25cdde94d69ef5ea1c4e7c83d6

SHA512
a918b2b094406eaa905c350d258765c53a1e51790bc75cca0ec05533e95440eda70c178a9dfc0a7246c6b27e7a83869fef7be4e981e8cab9c6d81521ef2b8fea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
845cdf552135be3140b0b4a92182bb71

SHA1
d06a837278e1be3f8988e44285d45f2085dbfdab

SHA256
3b939544738595009204b6bbc229bda5fa3f50da08d971482b29a5975b2a7d88

SHA512
06b5617e3009cef2451c9ffbbc87e82d1cddb9a562e0f811dce2ea2fe25ffd21b6f68534d0fae67612757459debc975e982c802cd8fd3fd6fb14a0ad216cedd5

Download Submit