7efb0c0c047ed11559f34e07c63bd8f9b4d743b095df49361208a8919b3852b3

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 01:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

859f179d4692b270002a9ec95025df46_JaffaCakes118.html
Size

214KB
MD5

859f179d4692b270002a9ec95025df46
SHA1

f90fe0463a326f6326e6347e7d91e9f4c775a821
SHA256

7efb0c0c047ed11559f34e07c63bd8f9b4d743b095df49361208a8919b3852b3
SHA512

fa03dbfaa05dafa852768ffddc7963a1692d66537a8df88823caf2cb9f058967e96e2860e668045bb31e3d84cb884f1b1f430b1f7d203186be8d44d650f77ef2
SSDEEP

3072:57rhB9CyHxX7Be7iAvtLPbAwuBNKifXTJZ:5Pz9VxLY7iAVLTBQJlZ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3400	msedge.exe
3400	msedge.exe
8	msedge.exe
8	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
8	msedge.exe
8	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 1956	8	msedge.exe	82
PID 8 wrote to memory of 1956	8	msedge.exe	82
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 4516	8	msedge.exe	83
PID 8 wrote to memory of 3400	8	msedge.exe	84
PID 8 wrote to memory of 3400	8	msedge.exe	84
PID 8 wrote to memory of 1364	8	msedge.exe	85
PID 8 wrote to memory of 1364	8	msedge.exe	85
PID 8 wrote to memory of 1364	8	msedge.exe	85
PID 8 wrote to memory of 1364	8	msedge.exe	85
PID 8 wrote to memory of 1364	8	msedge.exe	85
PID 8 wrote to memory of 1364	8	msedge.exe	85
PID 8 wrote to memory of 1364	8	msedge.exe	85
PID 8 wrote to memory of 1364	8	msedge.exe	85
PID 8 wrote to memory of 1364	8	msedge.exe	85
PID 8 wrote to memory of 1364	8	msedge.exe	85
PID 8 wrote to memory of 1364	8	msedge.exe	85
PID 8 wrote to memory of 1364	8	msedge.exe	85
PID 8 wrote to memory of 1364	8	msedge.exe	85
PID 8 wrote to memory of 1364	8	msedge.exe	85
PID 8 wrote to memory of 1364	8	msedge.exe	85
PID 8 wrote to memory of 1364	8	msedge.exe	85
PID 8 wrote to memory of 1364	8	msedge.exe	85
PID 8 wrote to memory of 1364	8	msedge.exe	85
PID 8 wrote to memory of 1364	8	msedge.exe	85
PID 8 wrote to memory of 1364	8	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\859f179d4692b270002a9ec95025df46_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc763c46f8,0x7ffc763c4708,0x7ffc763c4718
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5657441950130221724,9115294405434138679,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,5657441950130221724,9115294405434138679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,5657441950130221724,9115294405434138679,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5657441950130221724,9115294405434138679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5657441950130221724,9115294405434138679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5657441950130221724,9115294405434138679,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4904 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
80eb7878ee58d567f8e9ee8f9c990daf

SHA1
0d1b41c8b96d34ed48aa99f11d803e719b2ed790

SHA256
4571df032373ed7fde10d94fcb26aac6949742e5e0f37ca09a0059ee3161bf11

SHA512
f66b5d8e66fceb645b55b074304b8beddbd7388d04db7282f4ede454c11402c6f9ce4f47f1d833e1cd4ba298b31469b34a039e612f8e14048c9c8a16b8b1cb20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1ec3a2ac8be1dabbb60fede939a6844f

SHA1
c961bb5b6479e4895538a7ed455167d2580750ab

SHA256
6b919f7afbd0c698455017d1a352498fb78148c5ce2d5ac681af46bec1909b63

SHA512
a6c158580027b9df671a552a5e4af35976e5172888c7e8a27945c44be3fac8b61ecbf92fac602ce8f518ad50e89b6ce0f431c316e686767b5fda7ba009c34b1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6ec2610496e8452e56188f18db441bd7

SHA1
837f52b41c7fbb9560deb324ff1ac938bbeb9612

SHA256
16264515b769154497bc6b38a19555c24ae27cfbd0709cff0f670af4e65fd633

SHA512
c1023c0ca10b0312807dbc2ac49e4835681aec1f4425c4448939be39a8361094c5871ad7a8256c6c4e62090c32e06d83be1fbb5a297f947ad499b63e31dd354f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
66f9788637b6c2bae28700e08ff2281b

SHA1
2ea9a220c870a9c02c2641b5ca05e227d9db2ef0

SHA256
ee6da3fd844c0076fdb9ee4109da2242c7810e833d5327d87a44e285931bb83e

SHA512
0e5c0cf65ee8dad50542931141b3b23d38702de276a9d0fc0afd63b4f786b359ceaf793852d3f6b07d42c93fa1b033552f071d26592a0be0bc21d8e480396c9a

Download Submit