0add7ece7da7c57eb614db1acfc9f0d6c6272660cdb71afadc2eb8359fea357d

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 04:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99fd4a4a612399b55924aef0c70c72f4_JaffaCakes118.html
Size

139KB
MD5

99fd4a4a612399b55924aef0c70c72f4
SHA1

ec1b2f6747981cfd759cd1fa744a05e6a4958114
SHA256

0add7ece7da7c57eb614db1acfc9f0d6c6272660cdb71afadc2eb8359fea357d
SHA512

1cf52de05bbc9542123a529b4a6fa00590bc06dfd1b2dfd1fa90582d43fa7c1c80a012deacd8278272508666236f5177222c7ae2186d95e08a26b2998d00fdd7
SSDEEP

1536:SMyv8RAbk1BTVI1eZIy3Ptln1yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1Ul:SMyg1yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1376	msedge.exe
1376	msedge.exe
4596	msedge.exe
4596	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 4588	4596	msedge.exe	84
PID 4596 wrote to memory of 4588	4596	msedge.exe	84
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1152	4596	msedge.exe	85
PID 4596 wrote to memory of 1376	4596	msedge.exe	86
PID 4596 wrote to memory of 1376	4596	msedge.exe	86
PID 4596 wrote to memory of 4284	4596	msedge.exe	87
PID 4596 wrote to memory of 4284	4596	msedge.exe	87
PID 4596 wrote to memory of 4284	4596	msedge.exe	87
PID 4596 wrote to memory of 4284	4596	msedge.exe	87
PID 4596 wrote to memory of 4284	4596	msedge.exe	87
PID 4596 wrote to memory of 4284	4596	msedge.exe	87
PID 4596 wrote to memory of 4284	4596	msedge.exe	87
PID 4596 wrote to memory of 4284	4596	msedge.exe	87
PID 4596 wrote to memory of 4284	4596	msedge.exe	87
PID 4596 wrote to memory of 4284	4596	msedge.exe	87
PID 4596 wrote to memory of 4284	4596	msedge.exe	87
PID 4596 wrote to memory of 4284	4596	msedge.exe	87
PID 4596 wrote to memory of 4284	4596	msedge.exe	87
PID 4596 wrote to memory of 4284	4596	msedge.exe	87
PID 4596 wrote to memory of 4284	4596	msedge.exe	87
PID 4596 wrote to memory of 4284	4596	msedge.exe	87
PID 4596 wrote to memory of 4284	4596	msedge.exe	87
PID 4596 wrote to memory of 4284	4596	msedge.exe	87
PID 4596 wrote to memory of 4284	4596	msedge.exe	87
PID 4596 wrote to memory of 4284	4596	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\99fd4a4a612399b55924aef0c70c72f4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffa597346f8,0x7ffa59734708,0x7ffa59734718
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16416370063102449441,14185244317398761337,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,16416370063102449441,14185244317398761337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,16416370063102449441,14185244317398761337,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16416370063102449441,14185244317398761337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16416370063102449441,14185244317398761337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16416370063102449441,14185244317398761337,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9eb1f9c09f2aaa4a7dddbba74bf33033

SHA1
3a5a7d35d7d8d84bb29fe9fd89e8b6dd27eee17e

SHA256
a74c60e266cfd31cab5a6689ff9f4ead4a8666fda26ac47e61f7ea6242fde06b

SHA512
71d20ec70f25ffddcbac7636463930acb44521b71e9ce53f1f07149bc05d02871a7776c7c053e42a4fed920b39f7aff1d8e3e74b570f39f4f492e83405bc789d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df60fed24bccbd22e31c6f655b2985da

SHA1
b577bb73c02e8aa5503f32d5ed86fbf92bfd4fb0

SHA256
92e188d83d4abca2b990ab441fce8c799357af0ab7b10be31022653a8423aeac

SHA512
2d5f0e7904ce9ae67038e5c647247d8de509dcf86add9e89a53dd2fe92b737ba135cd0bb7c349e82cb15617fbe73a46e46a134127f75e40e0561c4413d67ebb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
84bf525642f03897ae93d8d45b87e3b7

SHA1
9ae38d928a5491fcac285b5bbe9d9693b08ae26d

SHA256
2d40cf5604319ee0aac900b514fb4345263006a64637dab60d762eaff75b175d

SHA512
9630e93784fdd795cf2c534a4c87bcc48f42816892b1e6e55ebd7b05a7c700a8fe2d48430a1a4b4734b9bf5098f00a59a6a39fbf00832ee11e28d4fa54a97626

Download Submit