3fe14bb030b9db8e726cea491b2863bc8a5a6efa85787675ec7eb6d8f50183cd

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 08:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d8f81ea15ad57cffcec5b644a3ced88_JaffaCakes118.html
Size

83KB
MD5

9d8f81ea15ad57cffcec5b644a3ced88
SHA1

ffc5e185f1578f3457644a8587f1af8948d05b54
SHA256

3fe14bb030b9db8e726cea491b2863bc8a5a6efa85787675ec7eb6d8f50183cd
SHA512

005bc3792fd70aad74379187c4f2c587aa30c4fcc3953b9d6b8304f8e8ed24fa7827f2779be7de0290ea03f5d6278647a23054916c69113b1e61fd9a52e610be
SSDEEP

1536:zRu7h0i6BRmUw05EinI+qk/ewaluQWjLGH/CacVdmyr2mMh65pgO31R:gii6BRmUw05EinI+VkCTVdNrrMh65pgm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3888	msedge.exe
3888	msedge.exe
5300	msedge.exe
5300	msedge.exe
5300	msedge.exe
5300	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3888	msedge.exe
3888	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 5412	3888	msedge.exe	80
PID 3888 wrote to memory of 5412	3888	msedge.exe	80
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 2928	3888	msedge.exe	81
PID 3888 wrote to memory of 3444	3888	msedge.exe	82
PID 3888 wrote to memory of 3444	3888	msedge.exe	82
PID 3888 wrote to memory of 452	3888	msedge.exe	83
PID 3888 wrote to memory of 452	3888	msedge.exe	83
PID 3888 wrote to memory of 452	3888	msedge.exe	83
PID 3888 wrote to memory of 452	3888	msedge.exe	83
PID 3888 wrote to memory of 452	3888	msedge.exe	83
PID 3888 wrote to memory of 452	3888	msedge.exe	83
PID 3888 wrote to memory of 452	3888	msedge.exe	83
PID 3888 wrote to memory of 452	3888	msedge.exe	83
PID 3888 wrote to memory of 452	3888	msedge.exe	83
PID 3888 wrote to memory of 452	3888	msedge.exe	83
PID 3888 wrote to memory of 452	3888	msedge.exe	83
PID 3888 wrote to memory of 452	3888	msedge.exe	83
PID 3888 wrote to memory of 452	3888	msedge.exe	83
PID 3888 wrote to memory of 452	3888	msedge.exe	83
PID 3888 wrote to memory of 452	3888	msedge.exe	83
PID 3888 wrote to memory of 452	3888	msedge.exe	83
PID 3888 wrote to memory of 452	3888	msedge.exe	83
PID 3888 wrote to memory of 452	3888	msedge.exe	83
PID 3888 wrote to memory of 452	3888	msedge.exe	83
PID 3888 wrote to memory of 452	3888	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9d8f81ea15ad57cffcec5b644a3ced88_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a06c46f8,0x7ff9a06c4708,0x7ff9a06c4718
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,4571168032026386411,11368766355529465695,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,4571168032026386411,11368766355529465695,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,4571168032026386411,11368766355529465695,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4571168032026386411,11368766355529465695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4571168032026386411,11368766355529465695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,4571168032026386411,11368766355529465695,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
778B

MD5
25978acca9ead14120f045f75c925384

SHA1
5c27d0bea425f5e4862c0d5c79e677ebddae91f8

SHA256
7b3bf398d65d3dfe2a2d72a8dd2b6401cf13ef1cf2f5e345675077e8cd5b48f2

SHA512
34ecd7341f17a969fcf6e2be76fcece0b42d0cb6868098c56080ba865eddc60e4d443430098414776aed825736279c6261e83b7cea48b0ebb476a055d999a877

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e6cd83d843a4034f77ca9c4e75acd3da

SHA1
597635798bc5b2573703883578d3fce3e8870e9f

SHA256
0bfecabf5f38d1ec78b34458e8259069eb4235058d06fa029e6803b5a1f15ee7

SHA512
5c2c0844ec4a205c08b155fd05a10cd3229ac9ab240c4142b285298a64c5328a6f6b4f60764d4183ac5d1834c74461e408ee131ec3ca0a1ae1da8b544b506424

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
251b8b50ff3e0e53bb5fbb414a7433cb

SHA1
0cfaaacdce32f720a345647c6318e2ca0b8bd6a0

SHA256
cb0bafb47f087e7f9fc5db38b41c72accdc4d60479e144ae61b1c8adbac6ceaf

SHA512
3841be148ea87095428424407b84367c66ad97d49d74a1f2a5d4054329f27a0eddebe7580fc3a8b29f5c46fd32bc915759fbbcbbf3003c972cc526b49197af61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d83e36d6337ebd7eadf0e095a5c97ba1

SHA1
cc0b4fa90fc7e234c725a35611248e40ed305154

SHA256
a3eebb86805d05a5630fa3c3cc8603d6c4b7d9af2e661a3385ba6eec995b85f3

SHA512
d64d8089f5dafbda52472956ffec5540e42094bfa1be7e349e7dfb5d30d99358ae92a3c95e5b8c8692db1fc5c2e1edf989ee7932bc25d190a3e86df30cac70dd

Download Submit