39a3f6284cb326dd7901dc3766faa44b79088ad74f451e544d5321b332622de0

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 23:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

825930a901828d4743b00a407c505887_JaffaCakes118.html
Size

18KB
MD5

825930a901828d4743b00a407c505887
SHA1

f9ee297a015b19cb98ff074f37b3e1a74b824b9c
SHA256

39a3f6284cb326dd7901dc3766faa44b79088ad74f451e544d5321b332622de0
SHA512

b1c7fd65a207c07ffa4431dd8df0f70f60da4b211adae20d95b038b001383475ba5fe7d8dec30b77549110ba650896695ed8cdc3278cca089d1ab3ee65539f2d
SSDEEP

384:SIMd0I5nvH5SOyKKQAAoSRmnssvP0XVxDB8:SEIRA

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3912	msedge.exe
3912	msedge.exe
4612	msedge.exe
4612	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4612	msedge.exe
4612	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 2776	4612	msedge.exe	82
PID 4612 wrote to memory of 2776	4612	msedge.exe	82
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 5060	4612	msedge.exe	83
PID 4612 wrote to memory of 3912	4612	msedge.exe	84
PID 4612 wrote to memory of 3912	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	85
PID 4612 wrote to memory of 2156	4612	msedge.exe	85
PID 4612 wrote to memory of 2156	4612	msedge.exe	85
PID 4612 wrote to memory of 2156	4612	msedge.exe	85
PID 4612 wrote to memory of 2156	4612	msedge.exe	85
PID 4612 wrote to memory of 2156	4612	msedge.exe	85
PID 4612 wrote to memory of 2156	4612	msedge.exe	85
PID 4612 wrote to memory of 2156	4612	msedge.exe	85
PID 4612 wrote to memory of 2156	4612	msedge.exe	85
PID 4612 wrote to memory of 2156	4612	msedge.exe	85
PID 4612 wrote to memory of 2156	4612	msedge.exe	85
PID 4612 wrote to memory of 2156	4612	msedge.exe	85
PID 4612 wrote to memory of 2156	4612	msedge.exe	85
PID 4612 wrote to memory of 2156	4612	msedge.exe	85
PID 4612 wrote to memory of 2156	4612	msedge.exe	85
PID 4612 wrote to memory of 2156	4612	msedge.exe	85
PID 4612 wrote to memory of 2156	4612	msedge.exe	85
PID 4612 wrote to memory of 2156	4612	msedge.exe	85
PID 4612 wrote to memory of 2156	4612	msedge.exe	85
PID 4612 wrote to memory of 2156	4612	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\825930a901828d4743b00a407c505887_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc74146f8,0x7ffcc7414708,0x7ffcc7414718
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,8562165814427774580,2552761326488339821,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,8562165814427774580,2552761326488339821,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,8562165814427774580,2552761326488339821,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8562165814427774580,2552761326488339821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8562165814427774580,2552761326488339821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,8562165814427774580,2552761326488339821,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a6d274a0a34ae6f3ef0398e2b42e1cbb

SHA1
5d495e263a885e8ff70448e07f5423045bc6d2ac

SHA256
846213ef69eb169b7704ee3318ac74cf03d7c2b7308b4cb91cf064ff00ca27d0

SHA512
07667c4e7515a168c61726a69b26d9bcb591098439dcc65a3c4ffee100a730166c2d906525d61af8bf73daa817c0d5826ffeed788e39842743d88520e9b6e93f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e20acbafd4096be982a4cfb4ddea458f

SHA1
f7abb7cafdb192131759f8ba0c37aa69b0325417

SHA256
ec7103a40f33e16bcd8c77250b3c654c5f639c001bf29c60fee129d3bd086de5

SHA512
be538375ca3d08d3ed26d858af536f9c967a8fda013f2f4212d2946bff42fbe1cccbcff923976f3eb891a0a8ee2c5c773c443bf79acedb1c0fbf4f7d8d80df0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6c661eae1ef29803bda46ba9f279a8ce

SHA1
dae10dc7087f7ac18496b4f15b2a5ec31f6afa51

SHA256
b54f16e3c65a0e041b2aeb3481f8a37bb47b6fb3217e33a6df05876f6f22b431

SHA512
34353059c794d530b206ebf9da59e0563add08eff96f16b2705355e8d9e27c7459ecb8ddc95ecb32ff08b102525f842a4be20ff9963c1ef02bdc74b5da974160

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
acfaebb3267813340c8ed39217f227ce

SHA1
a8abea2fe7a7e8e2de58f8345a986b080a24718f

SHA256
f9a78adfa8541f45305a842f14531902580aacd64cfeccf4a0d0086dcca321a5

SHA512
d63296c587afd112bbe5af0500c4b0af6e31ca8dfddbe8a8e9d7e9a17448a143277c5aa8d0e49751e697cd8e8e9ed3bec45fc31da24394ceb02b3148f51f8bd6

Download Submit