d884485fe378d3fe0d62e6479fe56bb0f5cab5c5b6cb349aecd049fd46945b82

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 14:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9af91e50215029df20a9d91ebbe659e8_JaffaCakes118.html
Size

139KB
MD5

9af91e50215029df20a9d91ebbe659e8
SHA1

17badf05cb2ecda507b11f207b899e0cf9668ffc
SHA256

d884485fe378d3fe0d62e6479fe56bb0f5cab5c5b6cb349aecd049fd46945b82
SHA512

685218fcb104a58dec7da050458baf219b0124a2768fb48e98441eb305f562dcf6fdc004208739a65534ab229d0c48ec8aeb193fcdd8a48f64a9c41889d340c6
SSDEEP

1536:SFVuJ6NClvyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTs:SFE2syfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3184	msedge.exe
3184	msedge.exe
1556	msedge.exe
1556	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1556	msedge.exe
1556	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 880	1556	msedge.exe	81
PID 1556 wrote to memory of 880	1556	msedge.exe	81
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 4540	1556	msedge.exe	82
PID 1556 wrote to memory of 3184	1556	msedge.exe	83
PID 1556 wrote to memory of 3184	1556	msedge.exe	83
PID 1556 wrote to memory of 4392	1556	msedge.exe	84
PID 1556 wrote to memory of 4392	1556	msedge.exe	84
PID 1556 wrote to memory of 4392	1556	msedge.exe	84
PID 1556 wrote to memory of 4392	1556	msedge.exe	84
PID 1556 wrote to memory of 4392	1556	msedge.exe	84
PID 1556 wrote to memory of 4392	1556	msedge.exe	84
PID 1556 wrote to memory of 4392	1556	msedge.exe	84
PID 1556 wrote to memory of 4392	1556	msedge.exe	84
PID 1556 wrote to memory of 4392	1556	msedge.exe	84
PID 1556 wrote to memory of 4392	1556	msedge.exe	84
PID 1556 wrote to memory of 4392	1556	msedge.exe	84
PID 1556 wrote to memory of 4392	1556	msedge.exe	84
PID 1556 wrote to memory of 4392	1556	msedge.exe	84
PID 1556 wrote to memory of 4392	1556	msedge.exe	84
PID 1556 wrote to memory of 4392	1556	msedge.exe	84
PID 1556 wrote to memory of 4392	1556	msedge.exe	84
PID 1556 wrote to memory of 4392	1556	msedge.exe	84
PID 1556 wrote to memory of 4392	1556	msedge.exe	84
PID 1556 wrote to memory of 4392	1556	msedge.exe	84
PID 1556 wrote to memory of 4392	1556	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9af91e50215029df20a9d91ebbe659e8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb2e0646f8,0x7ffb2e064708,0x7ffb2e064718
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,2883049589687077902,10581700521604381227,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,2883049589687077902,10581700521604381227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,2883049589687077902,10581700521604381227,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2883049589687077902,10581700521604381227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2883049589687077902,10581700521604381227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,2883049589687077902,10581700521604381227,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4868 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
83d354b979a08501d8726c49e3efe491

SHA1
0d303d8d8962d494fd3e178b61ac06697465b6b7

SHA256
560293b157cb444a635feaa8f248d54380c2411cc6bdfecb1daa2a96f1b29836

SHA512
c6cfc919c60a3730ecb0c6472d3b569f4ce3b6ceea12ec48d10b5c32e1c7036c168ce3a988165988ce11f43f700d7e1d6f5e6a683e09ae3d5a44f82366cbdf1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
47e4c6cc1d96e04b7097877f15270742

SHA1
ca7d81f892636a8ffa8092b6ef05ef4cfc96bd44

SHA256
d6289013b903ca1423823484bc7a11518bbd54ede5c7989dea03e241e9e87a71

SHA512
88842d959d6c45c409baf00b487f8ca118a9416315260c70f6c6c69e03355311d2b619feeb7bcc680abe9fb962d0c5a62a7cffd48403a24ce693a7bf7cfab3f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f090a33aa52d881531752f913a7e1724

SHA1
4598ef7aa1283726e15b3309efdce19bf2300cea

SHA256
7f4200b1ca46386ed2a47304c362afff2d2738fdc403f502d90c9c2056a32b20

SHA512
c5ad6462cd843b7beaf8dbc74ac5e7c4ea0c2054ffe705be93cd3b8aa9aaafb537dae4463a985a807bab4b68f2a6d1bcf2cf4b34616e42e99ffdb0c23e5194c3

Download Submit