295e6f2bf62035033f1c7a60e2ef6009f93735d12e015d01f3b400a7ecdd36c3

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 00:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c54cf354b5bdd93a2f5d402266e6814_JaffaCakes118.html
Size

19KB
MD5

8c54cf354b5bdd93a2f5d402266e6814
SHA1

61e5548de2f69e85ed03a8bab63ef94dc8e03dd3
SHA256

295e6f2bf62035033f1c7a60e2ef6009f93735d12e015d01f3b400a7ecdd36c3
SHA512

259c9fc650333e4ae50b9ec6a110ecb3faf912a0a628beb5097c9331f07bcb2413a05cec972b04462c370eafc92b8100f8128214edcb018fb31aa42898d03169
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAId4PzUnjBhBL82qDB8:SIMd0I5nO9HlsvBwxDB8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
3516	msedge.exe
3516	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 4352	3516	msedge.exe	82
PID 3516 wrote to memory of 4352	3516	msedge.exe	82
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 2316	3516	msedge.exe	83
PID 3516 wrote to memory of 1528	3516	msedge.exe	84
PID 3516 wrote to memory of 1528	3516	msedge.exe	84
PID 3516 wrote to memory of 2964	3516	msedge.exe	85
PID 3516 wrote to memory of 2964	3516	msedge.exe	85
PID 3516 wrote to memory of 2964	3516	msedge.exe	85
PID 3516 wrote to memory of 2964	3516	msedge.exe	85
PID 3516 wrote to memory of 2964	3516	msedge.exe	85
PID 3516 wrote to memory of 2964	3516	msedge.exe	85
PID 3516 wrote to memory of 2964	3516	msedge.exe	85
PID 3516 wrote to memory of 2964	3516	msedge.exe	85
PID 3516 wrote to memory of 2964	3516	msedge.exe	85
PID 3516 wrote to memory of 2964	3516	msedge.exe	85
PID 3516 wrote to memory of 2964	3516	msedge.exe	85
PID 3516 wrote to memory of 2964	3516	msedge.exe	85
PID 3516 wrote to memory of 2964	3516	msedge.exe	85
PID 3516 wrote to memory of 2964	3516	msedge.exe	85
PID 3516 wrote to memory of 2964	3516	msedge.exe	85
PID 3516 wrote to memory of 2964	3516	msedge.exe	85
PID 3516 wrote to memory of 2964	3516	msedge.exe	85
PID 3516 wrote to memory of 2964	3516	msedge.exe	85
PID 3516 wrote to memory of 2964	3516	msedge.exe	85
PID 3516 wrote to memory of 2964	3516	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8c54cf354b5bdd93a2f5d402266e6814_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe676e46f8,0x7ffe676e4708,0x7ffe676e4718
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,7294941306951276528,1598455714097882127,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,7294941306951276528,1598455714097882127,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,7294941306951276528,1598455714097882127,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7294941306951276528,1598455714097882127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7294941306951276528,1598455714097882127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,7294941306951276528,1598455714097882127,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4588 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b677a0fcf97c29c98a50496e8fd52543

SHA1
705a7650dddfc03e787953aa0b99a2ce36cf2d44

SHA256
0033445190f708766059fe7dc50951c0c9efd8a16c14a1dbadc60999e798f74e

SHA512
c4f5a088b94063520701372558c94ee6f7523c3ea292570471112e7d9e72618c6c08d0ebfb63995a37ba5d59927925ff87d6e6cc07b5c3e7dc1d54ff4c5258bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bd62b3eed05b92717a8acb142120ff81

SHA1
fde5ec1b9a0e019f239ad2225be1a810b524dbc9

SHA256
ffb2e277f212c8e7d6df4336eeaf42f782f1aba763605b2d493c8d4ab34a1393

SHA512
09dbe9f07df9906c71e1764b1c982b79e4b5bd5404994ef0523006d0e72587576020c7285a8d66cdc9b443c60c7fca589de98a92057993cdea9bfb496ace72e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ccab12fd6ef72cd4aaaf7bac90fc4e76

SHA1
61a3067e7c8871da2af86128677a48ba09ac54d2

SHA256
10217c26b022d6a2a16b6368cab568da94a4fdb626f5dd5ad9bad42db5ea2828

SHA512
f81d89ddf7a30143939079ad9b967fdc80b960f51460804748d68e7001e9383c38fcd42cc3c74bc95bec8bdc5def02479875324d16abde29b53f03cf4da51249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
83af747fbcdd6e5845a55b5b410ddf11

SHA1
26e5b8a7fc33d64253fc3cfebd478c24644be074

SHA256
4a82a06f40bd6a981bc5df751bc089b7611b8c749da8db1daebdebab16778e9a

SHA512
83580ee7b6310a4116a77eae6a8d8be3e4c58ae655d6e9e1d54b7e4a8b2f6475b1d58b537f685a95f8a5d740a3d4ec269b553b352992574648c976cf0a231cef

Download Submit