b3e61be97c0401c452c0c3a91c9632f8498bb6b9f0ec44fec1ba8ab52cb2c774

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30-05-2024 04:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

830a6c1eb807f944f7c9903f07b81a02_JaffaCakes118.html
Size

39KB
MD5

830a6c1eb807f944f7c9903f07b81a02
SHA1

195d07aa503b4af348ea9c9b0ad1f7d63e89a5a7
SHA256

b3e61be97c0401c452c0c3a91c9632f8498bb6b9f0ec44fec1ba8ab52cb2c774
SHA512

f50a2203238d5bfbae15e4a884e24f60be40111b7fb04d70ca1324c3bdb2e8c421444ad9291c3a01d6542fb2bee68e8c16751b8e7d415af9545578c7210f1148
SSDEEP

768:z4KiPO7I20W6x6f34TG9dlqY5B0XQkPpL3k20XVEuFV0XV4Vq9:UKsII256xrC97zgQnrVEAmV4Vq9

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1792	msedge.exe
1792	msedge.exe
4472	msedge.exe
4472	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 2972	4472	msedge.exe	82
PID 4472 wrote to memory of 2972	4472	msedge.exe	82
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 2352	4472	msedge.exe	83
PID 4472 wrote to memory of 1792	4472	msedge.exe	84
PID 4472 wrote to memory of 1792	4472	msedge.exe	84
PID 4472 wrote to memory of 3048	4472	msedge.exe	85
PID 4472 wrote to memory of 3048	4472	msedge.exe	85
PID 4472 wrote to memory of 3048	4472	msedge.exe	85
PID 4472 wrote to memory of 3048	4472	msedge.exe	85
PID 4472 wrote to memory of 3048	4472	msedge.exe	85
PID 4472 wrote to memory of 3048	4472	msedge.exe	85
PID 4472 wrote to memory of 3048	4472	msedge.exe	85
PID 4472 wrote to memory of 3048	4472	msedge.exe	85
PID 4472 wrote to memory of 3048	4472	msedge.exe	85
PID 4472 wrote to memory of 3048	4472	msedge.exe	85
PID 4472 wrote to memory of 3048	4472	msedge.exe	85
PID 4472 wrote to memory of 3048	4472	msedge.exe	85
PID 4472 wrote to memory of 3048	4472	msedge.exe	85
PID 4472 wrote to memory of 3048	4472	msedge.exe	85
PID 4472 wrote to memory of 3048	4472	msedge.exe	85
PID 4472 wrote to memory of 3048	4472	msedge.exe	85
PID 4472 wrote to memory of 3048	4472	msedge.exe	85
PID 4472 wrote to memory of 3048	4472	msedge.exe	85
PID 4472 wrote to memory of 3048	4472	msedge.exe	85
PID 4472 wrote to memory of 3048	4472	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\830a6c1eb807f944f7c9903f07b81a02_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ff84d3746f8,0x7ff84d374708,0x7ff84d374718
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2385092754968213692,14793234349179352282,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,2385092754968213692,14793234349179352282,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,2385092754968213692,14793234349179352282,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2385092754968213692,14793234349179352282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2385092754968213692,14793234349179352282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2385092754968213692,14793234349179352282,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1256 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
23KB

MD5
3f43547cfdc18e5a940c39aa72e0eba3

SHA1
5105f5c293d83d4dc0930ba91fe3e7ca5be39259

SHA256
e4a7b714be04434217808adab489be475c2293f5f59aaddcf3ae3dbef1dc9f60

SHA512
c63478fc7cde2b01fe4aa616ce8145a6e1bd7751a24b57f6cd37f6fd98588060cade4ca85eb36050a29e90377883d071953439b4c109898ca8003531278969ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
394B

MD5
5c78c202ae450c1c432f86df28dbc7bc

SHA1
9e4025748934e0c347e25b290b841d830f0feb6c

SHA256
deda0d180f2da53e59f81c7e7e70279209ee5f62600c7841152dfc946ad371be

SHA512
27a2e3c15ec29c6f0d378c39f08e2aeb78531bcb12c2fd8473bafda0d9b2a06f9c728ea301c2efd7643bc907b163c0a9a0c97472001986f685c565e49d765c38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6976fac16f64a2c39a3724aebfeb84d8

SHA1
54b5ef95d2fbbe2cb4d263aff85b3b5082cbbf7c

SHA256
8c8a63883a359b786cae4ba7664e5edde57881f03e9fbc44267bf6fd58e2731a

SHA512
360750b6da10f1d3930797a2512597ce26ea9d689ea125dac09e1e868d1b3e07bbbd618d6067460ca305f87a6dab83b7825065c7bbe693762b91c3552caef28e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cc3594f023fdca163475bb97046b28ea

SHA1
eb537566667930286f9c38fad9ffee0bb7a6e97a

SHA256
0f2058cf2e6d18d2b9fc0f6273f2291bbda00241f5cb854c2e6906d3b6c51aaf

SHA512
1d404a552f3c08b8ff809903c36061c76638eca346db9ef0761b1eef986215cddba55f6f61d349faf5077e9dfeef2688b133bdd99a7453aa6b166c855575096b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0e49db051c7e9c44276802ba2e5ac579

SHA1
8e10cccda7a8b174bd72cf613437a5c8f232c38c

SHA256
382c3321f79f6b80269df364eed556e64843ab266ce7474c02442ac36a0433c3

SHA512
78543e5f0f0645d6849c40fea1f64d2a760ecbb1e035a9122e22aa0ca8b135dc160f6fd845cf0b29735828c2030f4dede065b02286129a170264004d7f70589b

Download Submit