6e95f5be2b11b24aad8308e86103d3c72cef75e45ec7316481573500083663fb

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 05:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

896f5482fe7c06ed423f48d6c09102d0_JaffaCakes118.html
Size

184KB
MD5

896f5482fe7c06ed423f48d6c09102d0
SHA1

b7ea6c6ab2d48ea6c3475df66af711607ee16133
SHA256

6e95f5be2b11b24aad8308e86103d3c72cef75e45ec7316481573500083663fb
SHA512

f7997130d897176ad0a0723b50ce86337f72b9cde1928594797d504760c75cd63b7395f4b7f526cac9917dda30d5a0ec49edfda532f8e4f17ce57b0f0817abe0
SSDEEP

3072:SV2nyfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFis:SV2ysMYod+X3oI+Yn86/U9jFis

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
348	msedge.exe
348	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
348	msedge.exe
348	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 348 wrote to memory of 1316	348	msedge.exe	84
PID 348 wrote to memory of 1316	348	msedge.exe	84
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 1176	348	msedge.exe	85
PID 348 wrote to memory of 4816	348	msedge.exe	86
PID 348 wrote to memory of 4816	348	msedge.exe	86
PID 348 wrote to memory of 4088	348	msedge.exe	87
PID 348 wrote to memory of 4088	348	msedge.exe	87
PID 348 wrote to memory of 4088	348	msedge.exe	87
PID 348 wrote to memory of 4088	348	msedge.exe	87
PID 348 wrote to memory of 4088	348	msedge.exe	87
PID 348 wrote to memory of 4088	348	msedge.exe	87
PID 348 wrote to memory of 4088	348	msedge.exe	87
PID 348 wrote to memory of 4088	348	msedge.exe	87
PID 348 wrote to memory of 4088	348	msedge.exe	87
PID 348 wrote to memory of 4088	348	msedge.exe	87
PID 348 wrote to memory of 4088	348	msedge.exe	87
PID 348 wrote to memory of 4088	348	msedge.exe	87
PID 348 wrote to memory of 4088	348	msedge.exe	87
PID 348 wrote to memory of 4088	348	msedge.exe	87
PID 348 wrote to memory of 4088	348	msedge.exe	87
PID 348 wrote to memory of 4088	348	msedge.exe	87
PID 348 wrote to memory of 4088	348	msedge.exe	87
PID 348 wrote to memory of 4088	348	msedge.exe	87
PID 348 wrote to memory of 4088	348	msedge.exe	87
PID 348 wrote to memory of 4088	348	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\896f5482fe7c06ed423f48d6c09102d0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5c0e46f8,0x7ffa5c0e4708,0x7ffa5c0e4718
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,15551541975791342497,17877786391195053035,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,15551541975791342497,17877786391195053035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,15551541975791342497,17877786391195053035,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15551541975791342497,17877786391195053035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15551541975791342497,17877786391195053035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,15551541975791342497,17877786391195053035,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7194e87594c936a5e18cd81d726542d9

SHA1
8233e5fda188ca78d7859b8540b4ea9dbe640362

SHA256
2ca8b6be30a5bc8d64fdadf44034d52793f1e1f91e9c2e9a53a156adc65ace59

SHA512
94d206364ae99b1669f293a146afc7ccb0770d37341c111494c3b7304b9583fb446d6807334c86826038e57b0e11d33369f7ab7cf15f14793ea8379b58522b39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4eb0ba5aad7fc37d4a001c7cb1604ae6

SHA1
737480754faef53fbc5ddddc25cceeb5df93a9ba

SHA256
203da84c696b66deeacff31f5630686c8c64e95009effbce64fab0d8618a6ea2

SHA512
8026bc7bc70d8995b55353fe1cee2b4b7348517866cb8c79954b48608364eeb441fa0c29c197ec6b702017f811745d94f9b5319fa0f438c1eb4008b90f7a3196

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
560079e14afd5c9810e05a6c00b1d7d2

SHA1
0dcaf33aef075c69c06f19aec5afe09db9f2002e

SHA256
0012bb7023418d09b9dc5ad1bbaaeb9f6e6f9a43d33ce5c0e36c59879346020f

SHA512
4f1f984911c34f7b1c639146d78b0cbee1633f758d3ae7171ac3b0da4ebc3496c23a32442b0b14667c1903358ed21e28e8edec97462a1ebbae176bd9f5f990ae

Download Submit