43e81a8fe751aab4e5e26e3b86e82f97f32a8c3918a54569b3a6f7a53fab05c6

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9610ab9976d907d1184618d22d605c8c_JaffaCakes118.html
Size

66KB
MD5

9610ab9976d907d1184618d22d605c8c
SHA1

c463abbce555f4956b10a328a3051f77c471af84
SHA256

43e81a8fe751aab4e5e26e3b86e82f97f32a8c3918a54569b3a6f7a53fab05c6
SHA512

59036349e9711c2c045eea0bdbeb73d791aee4275e0ad0a3d13de06396b1f69013f0cbf7155083887c1b80e92ce9e45e3923072028a369460f1985acedbbb911
SSDEEP

768:dHgn6R3gvsjnycH+5zVokloq0MURL6yuSIJne15Kxp5wWfIHPAHbB2SOr:dHg3/kkl30MURL6y4Jne15AWWf1Hbe

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2036	msedge.exe
2036	msedge.exe
644	msedge.exe
644	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
644	msedge.exe
644	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 1320	644	msedge.exe	83
PID 644 wrote to memory of 1320	644	msedge.exe	83
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 3748	644	msedge.exe	84
PID 644 wrote to memory of 2036	644	msedge.exe	85
PID 644 wrote to memory of 2036	644	msedge.exe	85
PID 644 wrote to memory of 4196	644	msedge.exe	86
PID 644 wrote to memory of 4196	644	msedge.exe	86
PID 644 wrote to memory of 4196	644	msedge.exe	86
PID 644 wrote to memory of 4196	644	msedge.exe	86
PID 644 wrote to memory of 4196	644	msedge.exe	86
PID 644 wrote to memory of 4196	644	msedge.exe	86
PID 644 wrote to memory of 4196	644	msedge.exe	86
PID 644 wrote to memory of 4196	644	msedge.exe	86
PID 644 wrote to memory of 4196	644	msedge.exe	86
PID 644 wrote to memory of 4196	644	msedge.exe	86
PID 644 wrote to memory of 4196	644	msedge.exe	86
PID 644 wrote to memory of 4196	644	msedge.exe	86
PID 644 wrote to memory of 4196	644	msedge.exe	86
PID 644 wrote to memory of 4196	644	msedge.exe	86
PID 644 wrote to memory of 4196	644	msedge.exe	86
PID 644 wrote to memory of 4196	644	msedge.exe	86
PID 644 wrote to memory of 4196	644	msedge.exe	86
PID 644 wrote to memory of 4196	644	msedge.exe	86
PID 644 wrote to memory of 4196	644	msedge.exe	86
PID 644 wrote to memory of 4196	644	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9610ab9976d907d1184618d22d605c8c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd5eb246f8,0x7ffd5eb24708,0x7ffd5eb24718
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1464,9659820437895759514,16602647981122880258,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1464,9659820437895759514,16602647981122880258,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1464,9659820437895759514,16602647981122880258,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,9659820437895759514,16602647981122880258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,9659820437895759514,16602647981122880258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1464,9659820437895759514,16602647981122880258,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4760 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
595B

MD5
0dd1aaa31b66c00c0509cc0321668bfb

SHA1
c1aec4f928182fb6b72898126eb7cd7910b7d3d8

SHA256
b6693b71184eb48a2fa8502c38853d37157b3be6a49b555addd692e6656cbb04

SHA512
02465e663a9512a6a6e3694cb27e492f760970b78e94d33cd848fa0498f7aa752279101e356e72d722c4c14aa8dae4fc97dc85b8e6153ad888ba0f095d4e6e57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f613091820d96b3803813e881d5087d9

SHA1
75cc292b676eb5c496794fe6689d26cfcafbcf14

SHA256
dedda636eeb30fa82b8f431fc181210bd647116e297579b864fa5d3edad3b714

SHA512
52bc4123b2f9949c2ee7209fba0d338d0ac720728cb51bc305841c55be8ddd0e0e6631bc02ed3c58c3394763a97db0de9335d3f66547752a8d6f9ae20ea466dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
36c405ad145506edc9f7b360bea53bb4

SHA1
bc34742946a764bd080439c1c908bacc5505c310

SHA256
e07e64c63a03e1af20ea721f5e6dfd78bbfa848a56620375ada02e94a693b1b1

SHA512
5b9b7d9e94228beee1dea2560ebf99df7b04ca51984d7e0da708a23a9b69bad8b36d631bf430ff1b63653f810a7c50d12bf28e8a587e16ce35bb8e9854c74d64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b053659aeb3f7090881a54bd17d3f056

SHA1
e26bb99584bef7e50bd3f24784dff55fcc7a6496

SHA256
f79f44a499b8da60e60b08a88285a64a69140163512e8e7e06a8d4b4cb462491

SHA512
29910f5327bce5604a1d31f8534e5d746327b407aa471a36ff9b755f203593d388dcd39a8cc494afe3ca5d3731ab4dd8107f896c52451c01edd0e041c3e227de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bfb88c205418ae35c8f06bffa303ea04

SHA1
6dc339f72ffc7e34e888ecd15625b07a10d4f167

SHA256
c11cabd8997856e356ee4c260d43a525285fd9c9438d6c77f03f885a4c031468

SHA512
85597b47ef3d1cbe3a46626ca151f65d04691773113bc10eb2605a61fc66952f997fc89d00c75c4322159eb23684bb9938ef03f0cdd7070179fa6108f2ff7a5d

Download Submit