513f1522898839c8fa88e2108e3ee6d17a2d0a26e506795d26711f97f9c84eb9

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 04:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93a531ef23fbf3a967b4c72ce7d9a195_JaffaCakes118.html
Size

139KB
MD5

93a531ef23fbf3a967b4c72ce7d9a195
SHA1

39f7cf0984edca4261a866643f163ecc3ee94a69
SHA256

513f1522898839c8fa88e2108e3ee6d17a2d0a26e506795d26711f97f9c84eb9
SHA512

8527e2072d7df7c3ffcb34b1319b9682923ebea30e0eb4db56e95f04fcdc240902f0fad3ed040b1c74c16bf0ac0b698515215d1b6d2cf0a7e0b06b07ab1c8463
SSDEEP

1536:SUwRoYdVip60U+Uzepc+oQF/lGayLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EXe:SUwKWuuayfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1488	msedge.exe
1488	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4904	msedge.exe
4904	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 4200	4904	msedge.exe	86
PID 4904 wrote to memory of 4200	4904	msedge.exe	86
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 4408	4904	msedge.exe	87
PID 4904 wrote to memory of 1488	4904	msedge.exe	88
PID 4904 wrote to memory of 1488	4904	msedge.exe	88
PID 4904 wrote to memory of 2516	4904	msedge.exe	89
PID 4904 wrote to memory of 2516	4904	msedge.exe	89
PID 4904 wrote to memory of 2516	4904	msedge.exe	89
PID 4904 wrote to memory of 2516	4904	msedge.exe	89
PID 4904 wrote to memory of 2516	4904	msedge.exe	89
PID 4904 wrote to memory of 2516	4904	msedge.exe	89
PID 4904 wrote to memory of 2516	4904	msedge.exe	89
PID 4904 wrote to memory of 2516	4904	msedge.exe	89
PID 4904 wrote to memory of 2516	4904	msedge.exe	89
PID 4904 wrote to memory of 2516	4904	msedge.exe	89
PID 4904 wrote to memory of 2516	4904	msedge.exe	89
PID 4904 wrote to memory of 2516	4904	msedge.exe	89
PID 4904 wrote to memory of 2516	4904	msedge.exe	89
PID 4904 wrote to memory of 2516	4904	msedge.exe	89
PID 4904 wrote to memory of 2516	4904	msedge.exe	89
PID 4904 wrote to memory of 2516	4904	msedge.exe	89
PID 4904 wrote to memory of 2516	4904	msedge.exe	89
PID 4904 wrote to memory of 2516	4904	msedge.exe	89
PID 4904 wrote to memory of 2516	4904	msedge.exe	89
PID 4904 wrote to memory of 2516	4904	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\93a531ef23fbf3a967b4c72ce7d9a195_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa292946f8,0x7ffa29294708,0x7ffa29294718
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9475007496851331120,13928281291030503083,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,9475007496851331120,13928281291030503083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,9475007496851331120,13928281291030503083,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9475007496851331120,13928281291030503083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9475007496851331120,13928281291030503083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9475007496851331120,13928281291030503083,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2660 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
844a00aaff0d75e640b391a55b000630

SHA1
5981ec35be84690a3cf52bf50761f8b562f632ce

SHA256
cd5f4908517c5180c08288bd80467554a739c2ff6bcaef2284c358da54a3ac83

SHA512
8b1a27e962640b8e31a7bdee85766a0513019496fbdec38a416aaac37c757e311bbbd690cfa5ae0e48bc3a538510f57444c001b4e59d256307b7afa6e099a49b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2ba5cf9e42430125d08367f7afca2db1

SHA1
884cb7bee468c71d66c46269e80b2f64c7a1c041

SHA256
7c5cf9b2383e6fe3ba6f44c706a2f2b2795303a77800bf1f45d681639fa6d1a8

SHA512
b294c671c68ca620e0e51a9215753e8d615f8676c2f46d36c644a635e699c884e8286f132c38066b1c29f50715a7963a5fa9633e5587d67411d3eee01cc5e3c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1e9082ee0f91c6eb9a610734b76f1ec3

SHA1
9d6dfa3446d58a3237abecf22df711535f118620

SHA256
21a19bc258da32e7030d49925f2b8c81f7d022f9559f27b2410081c8fd031489

SHA512
f975fad2083a9d867c2e96c7096af042eaeac9db09951a4da8dca239ad209127a03d7671704c03157eafa7fd7850d8becf94e8237f8bf30c3fb31c1c87165664

Download Submit