63686c3dc7516acbd59fbd72c63e2b1a3cc11feb1ba115f72f4ffddc820b9dc3

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 18:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b529df89d29fc0e1fa167e46b04bcfb_JaffaCakes118.html
Size

213KB
MD5

8b529df89d29fc0e1fa167e46b04bcfb
SHA1

fa3883d9dd6f97358bdc3a9e914d4a53c8bdd406
SHA256

63686c3dc7516acbd59fbd72c63e2b1a3cc11feb1ba115f72f4ffddc820b9dc3
SHA512

b88b5ed27e6671b9cd6a773d99c6dbb6651c8d322b5caa269412401a5aaa1f65033e478a0c2ce914aa677f362f16e64fddeb7a367de17fed8461aae1ec62d645
SSDEEP

3072:SdchmuSQc+MyfkMY+BES09JXAnyrZalI+YQ:SdOHxsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe
3056	msedge.exe
3056	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3056	msedge.exe
3056	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 692	3056	msedge.exe	82
PID 3056 wrote to memory of 692	3056	msedge.exe	82
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 404	3056	msedge.exe	83
PID 3056 wrote to memory of 2128	3056	msedge.exe	84
PID 3056 wrote to memory of 2128	3056	msedge.exe	84
PID 3056 wrote to memory of 3052	3056	msedge.exe	85
PID 3056 wrote to memory of 3052	3056	msedge.exe	85
PID 3056 wrote to memory of 3052	3056	msedge.exe	85
PID 3056 wrote to memory of 3052	3056	msedge.exe	85
PID 3056 wrote to memory of 3052	3056	msedge.exe	85
PID 3056 wrote to memory of 3052	3056	msedge.exe	85
PID 3056 wrote to memory of 3052	3056	msedge.exe	85
PID 3056 wrote to memory of 3052	3056	msedge.exe	85
PID 3056 wrote to memory of 3052	3056	msedge.exe	85
PID 3056 wrote to memory of 3052	3056	msedge.exe	85
PID 3056 wrote to memory of 3052	3056	msedge.exe	85
PID 3056 wrote to memory of 3052	3056	msedge.exe	85
PID 3056 wrote to memory of 3052	3056	msedge.exe	85
PID 3056 wrote to memory of 3052	3056	msedge.exe	85
PID 3056 wrote to memory of 3052	3056	msedge.exe	85
PID 3056 wrote to memory of 3052	3056	msedge.exe	85
PID 3056 wrote to memory of 3052	3056	msedge.exe	85
PID 3056 wrote to memory of 3052	3056	msedge.exe	85
PID 3056 wrote to memory of 3052	3056	msedge.exe	85
PID 3056 wrote to memory of 3052	3056	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8b529df89d29fc0e1fa167e46b04bcfb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff968ca46f8,0x7ff968ca4708,0x7ff968ca4718
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,16498314486625945275,5595797958080773632,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,16498314486625945275,5595797958080773632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,16498314486625945275,5595797958080773632,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,16498314486625945275,5595797958080773632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,16498314486625945275,5595797958080773632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,16498314486625945275,5595797958080773632,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1256 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0389272c8229119a4b6b31d2755c7755

SHA1
61b8cb0802eee15c07f7c7ce6cab7ab86f32d933

SHA256
52acfd85aee9abe5bd4cf31aa512d159a7f91421c64aeec161f53e6a1e982abf

SHA512
4a62ec6415f1071834086762810877a56b879d3b6b2263217219b972fdf704e8abd252629f2f761d5deb494660373acf3ac79dc9b693bba38a179fb389fbe3be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
31431ff7d7966972475458ef9a458a7b

SHA1
58f25ff1934dad52e58df7ddcb573b18b34979b5

SHA256
affad741fa77c1924ca4de0981df251ec95b258f37f9d438a362427dc2673bda

SHA512
75513c6e67c35cab0a415e6d60d33989527f98e23da6a7e321819b6a64fdbb743aaf174e30811a701f32d8ec3b7d2d10a1336a0ecc3d9b9a49347fcd0f7f70a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
da124f7525cdb3fbd11184032d452adc

SHA1
4b7524857d4d94d19c778dc13ed2df80e32ce549

SHA256
003e8aee49ce0e21f0a76ff1380ceaf8dc74cdfcdbc083feab0a3c183541219c

SHA512
820a47e0074ec083bfcdd69f51d403ba847f45aa2d24a0cf122172165ae04a14760eca362b723cf5c41489b6db1471079cc4c5a6075f71d208003519f12ab31f

Download Submit