3f8fb69b5b0ecab0b6d44f326129c5a0a1852696245f9aa1ceccd78290703cf9

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30-05-2024 04:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

830e5fac6cbbc4d396ee425cb09c83fd_JaffaCakes118.html
Size

18KB
MD5

830e5fac6cbbc4d396ee425cb09c83fd
SHA1

8b5f052a1f84324327bb3bb514ae084df23fb1a7
SHA256

3f8fb69b5b0ecab0b6d44f326129c5a0a1852696245f9aa1ceccd78290703cf9
SHA512

9b39af1d69158b4038d624b354a07cdb34baea83bfa7452583f3ed51fe38ad81feb3016db8f081a6c4f7a898870af255e810b3ffa8d50550f33673811fcc7d1e
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIEWyWqB4lwgYQCZCD6zUnjBhdu1Y82qDB8:SIMd0I5nvHfsvoBxDB8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2568	msedge.exe
2568	msedge.exe
4936	msedge.exe
4936	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe
844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 3788	4936	msedge.exe	82
PID 4936 wrote to memory of 3788	4936	msedge.exe	82
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 3428	4936	msedge.exe	83
PID 4936 wrote to memory of 2568	4936	msedge.exe	84
PID 4936 wrote to memory of 2568	4936	msedge.exe	84
PID 4936 wrote to memory of 992	4936	msedge.exe	85
PID 4936 wrote to memory of 992	4936	msedge.exe	85
PID 4936 wrote to memory of 992	4936	msedge.exe	85
PID 4936 wrote to memory of 992	4936	msedge.exe	85
PID 4936 wrote to memory of 992	4936	msedge.exe	85
PID 4936 wrote to memory of 992	4936	msedge.exe	85
PID 4936 wrote to memory of 992	4936	msedge.exe	85
PID 4936 wrote to memory of 992	4936	msedge.exe	85
PID 4936 wrote to memory of 992	4936	msedge.exe	85
PID 4936 wrote to memory of 992	4936	msedge.exe	85
PID 4936 wrote to memory of 992	4936	msedge.exe	85
PID 4936 wrote to memory of 992	4936	msedge.exe	85
PID 4936 wrote to memory of 992	4936	msedge.exe	85
PID 4936 wrote to memory of 992	4936	msedge.exe	85
PID 4936 wrote to memory of 992	4936	msedge.exe	85
PID 4936 wrote to memory of 992	4936	msedge.exe	85
PID 4936 wrote to memory of 992	4936	msedge.exe	85
PID 4936 wrote to memory of 992	4936	msedge.exe	85
PID 4936 wrote to memory of 992	4936	msedge.exe	85
PID 4936 wrote to memory of 992	4936	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\830e5fac6cbbc4d396ee425cb09c83fd_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec2bb46f8,0x7ffec2bb4708,0x7ffec2bb4718
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,830757796414858828,9763364058008812564,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,830757796414858828,9763364058008812564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,830757796414858828,9763364058008812564,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,830757796414858828,9763364058008812564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,830757796414858828,9763364058008812564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,830757796414858828,9763364058008812564,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0629ebd98d1ae43e954e7b81876580d5

SHA1
15b779b4e95ccfb4e06f17aac6a3ba6c4839d971

SHA256
1479d8ef0674de682f993c913b6637473896ce5382bcb7512141965ba15d9065

SHA512
772a27b0879add3392898e0fdf495201f10f8c257a960433aa8b39214c7bb7ebdf1ff794205d8a1564a407953d0c4b43a8cd9e4321a6be30cd964bdc14955355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
710a16dff66ad998548093826ca7e0c4

SHA1
b54b82f7e1e2fa2c4c9563be5054bd78b61cd1f4

SHA256
2ab830eba30323b2a82abe33fda199f5af9ce7aaec90501c90216ec4efe70d21

SHA512
e517ba291837bb8763753fb3ca4187cf7e87eae5fdd8da04dcc0f03a9fe5e4fd93fbf5e32aac5d1a07b8c231fabe5fa3ce327baba2a40e9fe26311b939121ddb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1b978b39b565a015378d4aedf92a0f48

SHA1
424a19db9c21e908e4c9d87ae283536b7af9329f

SHA256
be1da2f79f42dc2effe7251d758c35079e2ca41399870251c3dd9b0240b6ecd7

SHA512
89406835c831f1f794a6871cd340bcaba75270a38353b3acb660e5e6d911229272ee2174b966dc1ad5dd841e3918dfa4ba58efa14c722de196b8b2d2af3fb39a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
88c2a56a215812ff9449ab44cfab4e8d

SHA1
715a732db7bcd5b6eb51331cd720e7cfaae2129f

SHA256
9ba585359af9223f03aa281da2c3826a6a915a8554a3dbb4c3a3b07f5dc8ca52

SHA512
4584d88e6d007fc3a10e0716ab233c8ee79720f4206662f871992a0730adfc6e34a08f16dcc2dde76de79932f1db3fda9c8ebc7d3a6ceb49171adb4d8c37457b

Download Submit