940b65f03833aa08f5bf68b674644db4f96c271b3a0fd8d62f3602f4cc268ae1

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 03:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f548b6e684934bb83855eca44d4ab11_JaffaCakes118.html
Size

69KB
MD5

7f548b6e684934bb83855eca44d4ab11
SHA1

59968ae472d1f3c6f9d77668b4e62b0bf0318db9
SHA256

940b65f03833aa08f5bf68b674644db4f96c271b3a0fd8d62f3602f4cc268ae1
SHA512

59445c1fecc364c8d0800cf69fdbf5251677072c3debbf4d29a3964348191c707c170bd18143dc7e586e6628dd545324458dab9ce2b27c65245d051c77446db1
SSDEEP

1536:ocS5orQ7J44+SwIg4glgEgegJL+DOz2pg+WcMUefCTRRmSODJ1lk4gRb0hrQ4kg/:ocS5orQi49

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
2624	msedge.exe
2624	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 996	2624	msedge.exe	84
PID 2624 wrote to memory of 996	2624	msedge.exe	84
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1796	2624	msedge.exe	85
PID 2624 wrote to memory of 1784	2624	msedge.exe	86
PID 2624 wrote to memory of 1784	2624	msedge.exe	86
PID 2624 wrote to memory of 4120	2624	msedge.exe	87
PID 2624 wrote to memory of 4120	2624	msedge.exe	87
PID 2624 wrote to memory of 4120	2624	msedge.exe	87
PID 2624 wrote to memory of 4120	2624	msedge.exe	87
PID 2624 wrote to memory of 4120	2624	msedge.exe	87
PID 2624 wrote to memory of 4120	2624	msedge.exe	87
PID 2624 wrote to memory of 4120	2624	msedge.exe	87
PID 2624 wrote to memory of 4120	2624	msedge.exe	87
PID 2624 wrote to memory of 4120	2624	msedge.exe	87
PID 2624 wrote to memory of 4120	2624	msedge.exe	87
PID 2624 wrote to memory of 4120	2624	msedge.exe	87
PID 2624 wrote to memory of 4120	2624	msedge.exe	87
PID 2624 wrote to memory of 4120	2624	msedge.exe	87
PID 2624 wrote to memory of 4120	2624	msedge.exe	87
PID 2624 wrote to memory of 4120	2624	msedge.exe	87
PID 2624 wrote to memory of 4120	2624	msedge.exe	87
PID 2624 wrote to memory of 4120	2624	msedge.exe	87
PID 2624 wrote to memory of 4120	2624	msedge.exe	87
PID 2624 wrote to memory of 4120	2624	msedge.exe	87
PID 2624 wrote to memory of 4120	2624	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7f548b6e684934bb83855eca44d4ab11_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaef7f46f8,0x7ffaef7f4708,0x7ffaef7f4718
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14593373444552139853,12296201255675028905,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,14593373444552139853,12296201255675028905,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,14593373444552139853,12296201255675028905,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2992 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14593373444552139853,12296201255675028905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14593373444552139853,12296201255675028905,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14593373444552139853,12296201255675028905,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3b9ac4c991a864a5237f4cf5057b9b0c

SHA1
c6398acbf64b411f9233c8a5e721a35fbbb3298b

SHA256
fc71cfd6e213c38c8a009b43254f9a7ff7f762191bac7b3cd65b7071b32b3fb6

SHA512
16911b7dafbe7a135b64489b43120af9e1cd07471e438d207f009cef5f363dcf988a5f53e7afad5160b906d847d10236ba616f94b858a553ce3f832fd9318bbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
31fb72a474eefccd7b1c0870c123fe5b

SHA1
fbc09890e1bdba3df30e14f70e9270904f08eae6

SHA256
03581e3c403e3a58b02b1f4fce0f6f3c284e686ff6c97c510ffbd62b4f45d183

SHA512
289e1bcb78ccb94e3c980e166c46fa57f9a29e038bdea3391895172d7b847a8920bc16c008ce6849eb84b2959c57cd0dffd978a26ca40c8b126dcd6259c43543

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b5b2d1a36b009d9f06f66760ec492a78

SHA1
cdf69c95ad981e589c3147a02f08923c6be2439f

SHA256
24e0cfb9aa6b60f4117f691472c8b90684472a41c39ba3abe91e0ed6cd1474a7

SHA512
c3998a052367d98b77c6b7c8754714c976e11d2aaa44baa1ee30cef0eadafd9cb87fbf608a6c65a86d89fdf749068730ed36abef5f6601bc89f703cc27f51cda

Download Submit