abde238d497aa75c77dcae59396d4e135f7c6a684c63c00f70153daed3f5206f

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 20:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8f471b6deb0f2e3908c1322409e5a532_JaffaCakes118.html
Size

139KB
MD5

8f471b6deb0f2e3908c1322409e5a532
SHA1

79e4ce7f30eecbd4b38c552df273689f1d2a4e91
SHA256

abde238d497aa75c77dcae59396d4e135f7c6a684c63c00f70153daed3f5206f
SHA512

16947d4dbc78fe310a40dc303324b8a347059abef6c5e90ada78739796e62b6e4280427d6de6d2969c7ff58d340306af47c8d884c8fd09ee9615b6c7a8f87e43
SSDEEP

1536:S6zUbndZETja7lgOyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3om:S6qd2JOyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
1824	msedge.exe
1824	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1824	msedge.exe
1824	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 4000	1824	msedge.exe	82
PID 1824 wrote to memory of 4000	1824	msedge.exe	82
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 1316	1824	msedge.exe	83
PID 1824 wrote to memory of 3236	1824	msedge.exe	84
PID 1824 wrote to memory of 3236	1824	msedge.exe	84
PID 1824 wrote to memory of 3876	1824	msedge.exe	85
PID 1824 wrote to memory of 3876	1824	msedge.exe	85
PID 1824 wrote to memory of 3876	1824	msedge.exe	85
PID 1824 wrote to memory of 3876	1824	msedge.exe	85
PID 1824 wrote to memory of 3876	1824	msedge.exe	85
PID 1824 wrote to memory of 3876	1824	msedge.exe	85
PID 1824 wrote to memory of 3876	1824	msedge.exe	85
PID 1824 wrote to memory of 3876	1824	msedge.exe	85
PID 1824 wrote to memory of 3876	1824	msedge.exe	85
PID 1824 wrote to memory of 3876	1824	msedge.exe	85
PID 1824 wrote to memory of 3876	1824	msedge.exe	85
PID 1824 wrote to memory of 3876	1824	msedge.exe	85
PID 1824 wrote to memory of 3876	1824	msedge.exe	85
PID 1824 wrote to memory of 3876	1824	msedge.exe	85
PID 1824 wrote to memory of 3876	1824	msedge.exe	85
PID 1824 wrote to memory of 3876	1824	msedge.exe	85
PID 1824 wrote to memory of 3876	1824	msedge.exe	85
PID 1824 wrote to memory of 3876	1824	msedge.exe	85
PID 1824 wrote to memory of 3876	1824	msedge.exe	85
PID 1824 wrote to memory of 3876	1824	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8f471b6deb0f2e3908c1322409e5a532_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e8f946f8,0x7ff9e8f94708,0x7ff9e8f94718
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2256,6156151433459808073,7932041901834553295,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2256,6156151433459808073,7932041901834553295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2256,6156151433459808073,7932041901834553295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,6156151433459808073,7932041901834553295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,6156151433459808073,7932041901834553295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2256,6156151433459808073,7932041901834553295,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4924 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5a898cddedcec2882ab8e16c82da8c16

SHA1
fdc973e13ef7c190023815f133e1ac219e00bc78

SHA256
4b4ef8453ba4cf874479d228f41c2a34c365d20e3f6fabbf0a2bf1d31cfa9a56

SHA512
e2220d4736a34f5d8218987ed6c233526240288d48a47975b690519c2fb22926e4e1fdf329bb73efd868c1afb686d8fc8bb165d8b726d2dc9c12dca8f686c538

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1cefdbad1bfd5b82a5ef497ca4354d2b

SHA1
78c4979cb36f0c67eaf84a385824919e9dd201c1

SHA256
92ab15d0b2be16abec16712a3b16d6348129861309771576ab0f3cd3afd4de6b

SHA512
5f9d21df91a2930d153d3e24e2dd019e5316a51c37bc7ed0d567573fedd826f079579fb132c8135930a08a3344088427ba34db414f7257de1dca7f232aa8f4ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fe4e991a40241c3cea41d2e4ca4ac825

SHA1
fce253e2128813775489ec229ced0b62cd511d6e

SHA256
1800012f87e98276451542e2603184f83658eb817f754cf1cbdad75fef385323

SHA512
6072152cc2b738bcf999b00dc05aadbb3396de132d71eabb14ffd6b51d4b1fc00e4571cdfeb07e4b0b49e4ecf43374e74c55216974a3e690c824a96456c4e688

Download Submit