d090947e27a56af78fbbf03f9ced660399bbf9d071fcac9a3766ce66c9dceaa8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2024 16:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

957eb4bb4baed73859e368b3918a99a7_JaffaCakes118.html
Size

220KB
MD5

957eb4bb4baed73859e368b3918a99a7
SHA1

075f7846c4aa4ee5abde33e84f252704145b8e11
SHA256

d090947e27a56af78fbbf03f9ced660399bbf9d071fcac9a3766ce66c9dceaa8
SHA512

3b215aa235d1ac66ee4444591989216f622b6cb34e832103338429f1637fdae96a774eb07cd4d7d5da8507d75ea8409d8af0279a60f74a74581419f16eab31b4
SSDEEP

3072:Sw0igWudo01eTyfkMY+BES09JXAnyrZalI+YQ:SHDnZsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
2136	msedge.exe
2136	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2136	msedge.exe
2136	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 3104	2136	msedge.exe	82
PID 2136 wrote to memory of 3104	2136	msedge.exe	82
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4640	2136	msedge.exe	83
PID 2136 wrote to memory of 4948	2136	msedge.exe	84
PID 2136 wrote to memory of 4948	2136	msedge.exe	84
PID 2136 wrote to memory of 4228	2136	msedge.exe	85
PID 2136 wrote to memory of 4228	2136	msedge.exe	85
PID 2136 wrote to memory of 4228	2136	msedge.exe	85
PID 2136 wrote to memory of 4228	2136	msedge.exe	85
PID 2136 wrote to memory of 4228	2136	msedge.exe	85
PID 2136 wrote to memory of 4228	2136	msedge.exe	85
PID 2136 wrote to memory of 4228	2136	msedge.exe	85
PID 2136 wrote to memory of 4228	2136	msedge.exe	85
PID 2136 wrote to memory of 4228	2136	msedge.exe	85
PID 2136 wrote to memory of 4228	2136	msedge.exe	85
PID 2136 wrote to memory of 4228	2136	msedge.exe	85
PID 2136 wrote to memory of 4228	2136	msedge.exe	85
PID 2136 wrote to memory of 4228	2136	msedge.exe	85
PID 2136 wrote to memory of 4228	2136	msedge.exe	85
PID 2136 wrote to memory of 4228	2136	msedge.exe	85
PID 2136 wrote to memory of 4228	2136	msedge.exe	85
PID 2136 wrote to memory of 4228	2136	msedge.exe	85
PID 2136 wrote to memory of 4228	2136	msedge.exe	85
PID 2136 wrote to memory of 4228	2136	msedge.exe	85
PID 2136 wrote to memory of 4228	2136	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\957eb4bb4baed73859e368b3918a99a7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa088046f8,0x7ffa08804708,0x7ffa08804718
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6053964868268472994,12626918812361837126,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,6053964868268472994,12626918812361837126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,6053964868268472994,12626918812361837126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6053964868268472994,12626918812361837126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6053964868268472994,12626918812361837126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6053964868268472994,12626918812361837126,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c532ef4eebefa657d72af9debdd0c932

SHA1
bc496dbb8db03bd0d1719ea48cc3b40f5896e2ce

SHA256
9892fb388555bd48d3a23dfa72ba52db424b91e75c43ce491784a86507b2f8ee

SHA512
981789fb6aa3db97efdc023ef2c082fc058ca0092d8d3a3404dc11ccc01be3da73938ac58a604ec401c2294c396d154d7e9a43b0f1cc9f505298f288e8c938d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6fc7216b22742dae0fb7f3b61ca8bcb1

SHA1
7ac28cbc11467b0c0ac27fe4874a17d32ae2b075

SHA256
6e1456b9ae59c390fc56255744f9dbe7f935c8b274f0e201e0386c820b27ace0

SHA512
af8ee8797469fb3ac0efdba94f62c49a4aeb548b3fd37b65fd0feb0a440589abdb794dcce175817a13572192b237722a6558e853884e67d8d18193a777d62bdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1d39c79b596440e04791091d92a1f6b8

SHA1
779bc396537a07ef5394615255785bf01849d0dd

SHA256
93e9202d01e69de02b34ea1e26f6d996d57adb3d79955014adcc7fbcbc15ed12

SHA512
0768e2c069123ac8475d9f512819cf74193a5476197e1b29afb707673d20b69d8a6b30357cba07b8b30501f7395e764ab6c8cd3f1716fad3b08d6fa2bc12c993

Download Submit