9a1f0c00c0383f449663efd0f976c3fdb6392f214bef141ccc0317642607579d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 11:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a692e2e19c4f86cf77625d1ab67066d_JaffaCakes118.html
Size

349KB
MD5

8a692e2e19c4f86cf77625d1ab67066d
SHA1

c718664c582881236893aa1e11b121eb5b29ba8c
SHA256

9a1f0c00c0383f449663efd0f976c3fdb6392f214bef141ccc0317642607579d
SHA512

8bd234f683242c8fbaf4743a295093639323cc6274a17de4bb48727452ff795e52d58df90c3e1abd95a748a933fa952ca7529b4e94aa4bea89b14b44ec182e7e
SSDEEP

6144:S3sMYod+X3oI+YZkvsMYod+X3oI+YAsMYod+X3oI+YQ:+5d+X385d+X3Y5d+X3+

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1948	msedge.exe
1948	msedge.exe
1404	msedge.exe
1404	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1404	msedge.exe
1404	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 1516	1404	msedge.exe	81
PID 1404 wrote to memory of 1516	1404	msedge.exe	81
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 2776	1404	msedge.exe	82
PID 1404 wrote to memory of 1948	1404	msedge.exe	83
PID 1404 wrote to memory of 1948	1404	msedge.exe	83
PID 1404 wrote to memory of 5064	1404	msedge.exe	84
PID 1404 wrote to memory of 5064	1404	msedge.exe	84
PID 1404 wrote to memory of 5064	1404	msedge.exe	84
PID 1404 wrote to memory of 5064	1404	msedge.exe	84
PID 1404 wrote to memory of 5064	1404	msedge.exe	84
PID 1404 wrote to memory of 5064	1404	msedge.exe	84
PID 1404 wrote to memory of 5064	1404	msedge.exe	84
PID 1404 wrote to memory of 5064	1404	msedge.exe	84
PID 1404 wrote to memory of 5064	1404	msedge.exe	84
PID 1404 wrote to memory of 5064	1404	msedge.exe	84
PID 1404 wrote to memory of 5064	1404	msedge.exe	84
PID 1404 wrote to memory of 5064	1404	msedge.exe	84
PID 1404 wrote to memory of 5064	1404	msedge.exe	84
PID 1404 wrote to memory of 5064	1404	msedge.exe	84
PID 1404 wrote to memory of 5064	1404	msedge.exe	84
PID 1404 wrote to memory of 5064	1404	msedge.exe	84
PID 1404 wrote to memory of 5064	1404	msedge.exe	84
PID 1404 wrote to memory of 5064	1404	msedge.exe	84
PID 1404 wrote to memory of 5064	1404	msedge.exe	84
PID 1404 wrote to memory of 5064	1404	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8a692e2e19c4f86cf77625d1ab67066d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa4a9b46f8,0x7ffa4a9b4708,0x7ffa4a9b4718
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2635307230481416397,745025094822422343,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,2635307230481416397,745025094822422343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,2635307230481416397,745025094822422343,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2635307230481416397,745025094822422343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2635307230481416397,745025094822422343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2635307230481416397,745025094822422343,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f0be088f6cc569d200ecf04ba3c6799a

SHA1
9aa0f6ed74c4bbf74dd144682d0c1883570596e0

SHA256
cacfcf6b70663f524985f9eaea3572a0be3a4981b7c0048194bb4e510fd34352

SHA512
2b020c6176c1ed1933835fcc7817419a7296f29b7f56f768da3d5987e3712c4bd3394cb9d7792f9a66f7ea305cb8b284afcae92dce8bebd0c66e7ff3b18899bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1804f8d0ea4d1c4d3857b72c35311574

SHA1
7ec24005c04e5b0e502c665894c1ce3804d92619

SHA256
f1e4a3a590dfcfe0ba51aebc92cd59e2510a7c111482e0c4948053a6c7357e39

SHA512
7e7f9ff46b61b97193235ae370f391081df5000ab73964bb63ef57a1c1e912108855043ae29fd7fabb4d7b0ec263e024bcf9e01adbde665740da145c618bc85b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7bbbf46b63a24ac3c9dc58ab88f715ee

SHA1
6dedf4ee6ef9b91b9268914fe66078b8989bed7d

SHA256
472b786a497dd65255310c1f18421ba8149008a41fa9d8d1401cef4f44fa93db

SHA512
e6ed02658c802ec19a59b877ba034a1d64dec31c5311073eb68410c19389c54208708a16f1b0a0ff5429af63b1bbbf77227aee9a9aca0610c63fe794746da443

Download Submit