895766c9befc216c914fc8ad90c2a32e84c05118b7df98d88bcd1357c490aaae

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 16:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87a7ba02369e45796e95fcb09be50fc5_JaffaCakes118.html
Size

284KB
MD5

87a7ba02369e45796e95fcb09be50fc5
SHA1

9cbb9f97645bc5104126aa1ad67b0a6c34d49024
SHA256

895766c9befc216c914fc8ad90c2a32e84c05118b7df98d88bcd1357c490aaae
SHA512

e0ae59177b1f80c545415694d57d81a0cecb65f18c597368906f667719d1267f2146d9f8262871c70ff64c1eea8b81ac73c1c9fe67d8c5f6b169daca5fa66ea0
SSDEEP

3072:Bypyhbr7fk13tp+4p0oqKN6vtLW1rMeMjeeRAP5uLkgYGyrQlc7Svd+4gKF6hX9H:Dbr7fO3tp+4p0oqKj15wybb

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3196	msedge.exe
3196	msedge.exe
932	msedge.exe
932	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
932	msedge.exe
932	msedge.exe
932	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 2356	932	msedge.exe	83
PID 932 wrote to memory of 2356	932	msedge.exe	83
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3044	932	msedge.exe	84
PID 932 wrote to memory of 3196	932	msedge.exe	85
PID 932 wrote to memory of 3196	932	msedge.exe	85
PID 932 wrote to memory of 1968	932	msedge.exe	86
PID 932 wrote to memory of 1968	932	msedge.exe	86
PID 932 wrote to memory of 1968	932	msedge.exe	86
PID 932 wrote to memory of 1968	932	msedge.exe	86
PID 932 wrote to memory of 1968	932	msedge.exe	86
PID 932 wrote to memory of 1968	932	msedge.exe	86
PID 932 wrote to memory of 1968	932	msedge.exe	86
PID 932 wrote to memory of 1968	932	msedge.exe	86
PID 932 wrote to memory of 1968	932	msedge.exe	86
PID 932 wrote to memory of 1968	932	msedge.exe	86
PID 932 wrote to memory of 1968	932	msedge.exe	86
PID 932 wrote to memory of 1968	932	msedge.exe	86
PID 932 wrote to memory of 1968	932	msedge.exe	86
PID 932 wrote to memory of 1968	932	msedge.exe	86
PID 932 wrote to memory of 1968	932	msedge.exe	86
PID 932 wrote to memory of 1968	932	msedge.exe	86
PID 932 wrote to memory of 1968	932	msedge.exe	86
PID 932 wrote to memory of 1968	932	msedge.exe	86
PID 932 wrote to memory of 1968	932	msedge.exe	86
PID 932 wrote to memory of 1968	932	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\87a7ba02369e45796e95fcb09be50fc5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffca1246f8,0x7fffca124708,0x7fffca124718
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,2086043672011355487,16279187091229415116,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,2086043672011355487,16279187091229415116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,2086043672011355487,16279187091229415116,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,2086043672011355487,16279187091229415116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,2086043672011355487,16279187091229415116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,2086043672011355487,16279187091229415116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,2086043672011355487,16279187091229415116,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5268 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
d735d9b18a8a8c73491936fdec0d5349

SHA1
b2999ae9810832aec303bd4d49d7b30a48a2ce99

SHA256
5ea9eeb48e36579d102c2e12af47b786b6712924ccb82fc4355e53e7fd327e57

SHA512
fa5999a89f4253fc9be0d744c45c6c6ab5601af95f3577b8943134da0da80b5d0de083d94063a6380c40166ac8929a0b39543809c36e2118ba2fddcade74b0f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
d88a5570a5728d141e4731e5b632094f

SHA1
2f56362bfc1103bcf3027d50604fa6ddbba15cb6

SHA256
2b1bfddc0a4f31685865b34516983989220863ef28f9088b940d37f959ee48ef

SHA512
f178a1686acfbc3a43ea9cf069779830e6f343644a7e6368794f7636a828998328e43cbebf86891492db3e14e3bbf111cec94dc6726eb880ceaa72c8a1500ba6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
92d20680a25dd448c2bd51d75c955143

SHA1
2c98533e4535bf9e47c5a1f973113794f1027fcb

SHA256
b974831dd2179a69c1de755d5f41780bae790e2d6abbd1cb9bc80ea2daf8f40e

SHA512
b0a133cebbc638a99aa522627048341e890b2bff9ca2611baa668fe703f07bf3b0d2951607a0d0be89b2b3a6c1faf0c7e15899c2bfd63d4730bd0fc192b7e6c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
55554b8da2f1bc7dca53449a9dbab3ca

SHA1
064fc244995fc7f28ab82cde8aa1efb75f41b2d3

SHA256
aa20687ec406685e2f075dce8dab67b20caf0e98ce2c5f0fbf07c2b7b1d6fa73

SHA512
286eb0b2c77422c4ad11a9c6b763cd3b1a38182c69050f0e4c08669d1306ad109aec3c9d082f460bcb1354f7b6dd6cff4905286b3c507bb2a70502db983006db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
467b3bb7cf6c09e00e67e2b8653f597c

SHA1
e836d3e9ae31b8b2ca927f87fbaa373a3adb0974

SHA256
290f051724bb67480394aaa2101cdb318bf28b770d32c464cbb94b3255861666

SHA512
5361a87fd9a24ae5b307979a235906f0e1e22f0110de5d96a6c4d70b9434383666e1734032e80627f065f0c3e11d044dfe3679267a2c57d6c9ae27a368bd67ba

Download Submit