13bf22d5d0e4ed693cdac2dad739747ac8210c95e47885ed801084264e897424

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 08:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9ffef2e3e16939a94c5fbcb7047726f8_JaffaCakes118.html
Size

214KB
MD5

9ffef2e3e16939a94c5fbcb7047726f8
SHA1

56bc81d1938ea77abe10b2df5d3c59b9674f43a9
SHA256

13bf22d5d0e4ed693cdac2dad739747ac8210c95e47885ed801084264e897424
SHA512

e8642bd0d892f852dc77172fafe7b40022e19cbcac28a0397a34d5bc813ec2dde312d2974fa890491e9a21da48fcbe3865fd8cd20df0e2874c65846c9bf1a1a0
SSDEEP

3072:7rhB9CyHxX7Be7iAvtLPbAwuBNKifXTJAf:Pz9VxLY7iAVLTBQJl+

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4308	msedge.exe
4308	msedge.exe
3812	msedge.exe
3812	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3812	msedge.exe
3812	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3812 wrote to memory of 2504	3812	msedge.exe	80
PID 3812 wrote to memory of 2504	3812	msedge.exe	80
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 3488	3812	msedge.exe	82
PID 3812 wrote to memory of 4308	3812	msedge.exe	83
PID 3812 wrote to memory of 4308	3812	msedge.exe	83
PID 3812 wrote to memory of 4612	3812	msedge.exe	84
PID 3812 wrote to memory of 4612	3812	msedge.exe	84
PID 3812 wrote to memory of 4612	3812	msedge.exe	84
PID 3812 wrote to memory of 4612	3812	msedge.exe	84
PID 3812 wrote to memory of 4612	3812	msedge.exe	84
PID 3812 wrote to memory of 4612	3812	msedge.exe	84
PID 3812 wrote to memory of 4612	3812	msedge.exe	84
PID 3812 wrote to memory of 4612	3812	msedge.exe	84
PID 3812 wrote to memory of 4612	3812	msedge.exe	84
PID 3812 wrote to memory of 4612	3812	msedge.exe	84
PID 3812 wrote to memory of 4612	3812	msedge.exe	84
PID 3812 wrote to memory of 4612	3812	msedge.exe	84
PID 3812 wrote to memory of 4612	3812	msedge.exe	84
PID 3812 wrote to memory of 4612	3812	msedge.exe	84
PID 3812 wrote to memory of 4612	3812	msedge.exe	84
PID 3812 wrote to memory of 4612	3812	msedge.exe	84
PID 3812 wrote to memory of 4612	3812	msedge.exe	84
PID 3812 wrote to memory of 4612	3812	msedge.exe	84
PID 3812 wrote to memory of 4612	3812	msedge.exe	84
PID 3812 wrote to memory of 4612	3812	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9ffef2e3e16939a94c5fbcb7047726f8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe748d46f8,0x7ffe748d4708,0x7ffe748d4718
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,444468007686746194,8263949510813486357,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,444468007686746194,8263949510813486357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,444468007686746194,8263949510813486357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,444468007686746194,8263949510813486357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,444468007686746194,8263949510813486357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,444468007686746194,8263949510813486357,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4956 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5cc07127ab154399101f3e3d8859015f

SHA1
0b88425ae276f0caadd253380c35bbae4fd0bc28

SHA256
4493bb8f1be77719d9a04a608d6176ff2f2ec75c2a53d39f817b92234439c279

SHA512
a89d2765173c4bb734467b5363071bccc0b44f23a7d1356672e3b3ec22791684f7d85919de2683d5d9bc7967bc8521d93e7ce18e3b8eea74e5eadb6fa05113a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
099a1a0dd99ba2022bab8ff00558c36f

SHA1
16822c7b3722037af71315f4f59a3d7a5f76cbb2

SHA256
4fb350a516b3f3d8012f429cb0ddfecf81a0105ce595da328bd9f98f6b24fe1b

SHA512
563eb8937b4cdfcdac3d3e0269a97827003860287f50abba97d924d180dde3f1a072122f759e4525796c59f764915f4a076bd06fa262e983fbc7ee90c2888ef7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c2e1ddb4ae315e8be11981cc50cdb792

SHA1
d1c1a7b005f7ee0bd8364192ae6ca003493fa4f1

SHA256
b829514a65b72d683aa43d73a0bd8e13a17be77ec2b0da9c15623d6c94da13fd

SHA512
fd96c4d0281c16b0aa41a40a2168e1b3d1c3b705bbd0ebc3f1fba3f89aea1855c5e459ace98f162155f66704a79c07654b3f8c3851b66c739ac3ba0304cceb93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dfb87467c68ad70f1bc2c474bd676ac6

SHA1
035e128c5f249b2d048d605c6ee91384289d162b

SHA256
bf40a4e783aa776243822e6082d0c13ce6daa5863b8bd2fa1ae5b0a1f57f01a2

SHA512
35cf7e33d7bd26d0604b5c10c8f46109424953095336fc8c9d91c99f089dc96a898364e2455af520a060015a45e85da7e57c61e3765ea31a6a60ec5b35447d5d

Download Submit