00257a31d7f0a6dcc859b78d1d7785c13aa4af866f8d06bba36fd6e890d278a7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 21:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a27278fbe649150b060afec1ad4c31ef_JaffaCakes118.html
Size

18KB
MD5

a27278fbe649150b060afec1ad4c31ef
SHA1

ae4c7715fb8eec63f096f2ba0813b36aa1af3a27
SHA256

00257a31d7f0a6dcc859b78d1d7785c13aa4af866f8d06bba36fd6e890d278a7
SHA512

c2b47045df06949412ea35fc2d33664942a3139ff84a67ea2844e1fea4bd928e1865636e73d19f0fa0a9b735985797ff5db548aa76f41193ac7b0ce03ce4e7d7
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIM4GzUnjBh6c82qDB8:SIMd0I5nvH3sv6vxDB8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4516	msedge.exe
4516	msedge.exe
5104	msedge.exe
5104	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 824	5104	msedge.exe	87
PID 5104 wrote to memory of 824	5104	msedge.exe	87
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 1840	5104	msedge.exe	88
PID 5104 wrote to memory of 4516	5104	msedge.exe	89
PID 5104 wrote to memory of 4516	5104	msedge.exe	89
PID 5104 wrote to memory of 2292	5104	msedge.exe	90
PID 5104 wrote to memory of 2292	5104	msedge.exe	90
PID 5104 wrote to memory of 2292	5104	msedge.exe	90
PID 5104 wrote to memory of 2292	5104	msedge.exe	90
PID 5104 wrote to memory of 2292	5104	msedge.exe	90
PID 5104 wrote to memory of 2292	5104	msedge.exe	90
PID 5104 wrote to memory of 2292	5104	msedge.exe	90
PID 5104 wrote to memory of 2292	5104	msedge.exe	90
PID 5104 wrote to memory of 2292	5104	msedge.exe	90
PID 5104 wrote to memory of 2292	5104	msedge.exe	90
PID 5104 wrote to memory of 2292	5104	msedge.exe	90
PID 5104 wrote to memory of 2292	5104	msedge.exe	90
PID 5104 wrote to memory of 2292	5104	msedge.exe	90
PID 5104 wrote to memory of 2292	5104	msedge.exe	90
PID 5104 wrote to memory of 2292	5104	msedge.exe	90
PID 5104 wrote to memory of 2292	5104	msedge.exe	90
PID 5104 wrote to memory of 2292	5104	msedge.exe	90
PID 5104 wrote to memory of 2292	5104	msedge.exe	90
PID 5104 wrote to memory of 2292	5104	msedge.exe	90
PID 5104 wrote to memory of 2292	5104	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a27278fbe649150b060afec1ad4c31ef_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb186d46f8,0x7ffb186d4708,0x7ffb186d4718
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,15003728205195908522,16404127372001862931,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,15003728205195908522,16404127372001862931,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,15003728205195908522,16404127372001862931,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15003728205195908522,16404127372001862931,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15003728205195908522,16404127372001862931,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,15003728205195908522,16404127372001862931,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4904 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
257c0005d0c4d0bb282cb470925e4376

SHA1
f9b8efb511ed64292568977c9f2ec255509e8f7d

SHA256
8185c36aaacfc71e42f94fad8e198fe7fb2d868398ceabb89261cae94341cb22

SHA512
2f3e8f352ed3ef88e8c28650390f93f98c92174d268330b886f3ebd1ba0163999051298ee12a054606b4986005452a241c6864cd292e69492d79c37d500556f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4819fbc4513c82d92618f50a379ee232

SHA1
ab618827ff269655283bf771fc957c8798ab51ee

SHA256
05e479e8ec96b7505e01e5ec757ccfe35cb73cd46b27ff4746dce90d43d9237c

SHA512
bc24fb972d04b55505101300e268f91b11e5833f1a18e925b5ded7e758b5e3e08bee1aa8f3a0b65514d6df981d0cbfa8798344db7f2a3675307df8de12ae475b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8576d9d5436a3ec287ede6f68940d11d

SHA1
bc6626acffed411ecb27e137ae28e4d5cba8eb66

SHA256
c1ee5e316dbd98a679cbfcc1d1a0e1990a61e61b33c0f6dfccefd3e5e8130e07

SHA512
d949db10fc9fa4bfaf4fcf51541e3ec5cb47d35003ea5da97f5e12a2dddbbb83a0a74c7dad8cf1565b7802e8bf1006cf2c37293375e48fb46b73bafad98edc34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4182cff47a1bca27d4346542d38bebad

SHA1
326c0678c0b6bd341e6420a34466d4fda74ac939

SHA256
5f2400542a30a293102aa4d03137a4f7e90e97100ec7f285535c022b08fa4906

SHA512
53e55af7eacfb44248768080c0856fe21cb21e981b3af9d74a644423e650a884db73818b21dc52d96dcfd05c61d1c44f9c8be6b7056ca5d6eb5ead1d1c1ae197

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d006b74537d8be8ed0176dd330740c94

SHA1
865ccb3cd7853a2a32898c041727a4f623bd4c8f

SHA256
7a89896fcaa3511ab51cf394999a3ac6e81275220569d736dcefeb5088632981

SHA512
79a598298327a12ebab1c88aa27c5cbbb883db29782702ac112a1eb322537eb6b22d5dd77409835ee2c5bf22b55e861a4e94d256d7507984c83ad913a847852d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
95cd1581c30a5c26f698a8210bcab430

SHA1
5e8e551a47dd682ec51a7d6808fe8e0f2af39e86

SHA256
d58162c5ae5e18fc06604c285e024c01686093d70994dc93b4ae9d85b4c3f7b9

SHA512
e49403df10177053634c431203a91d26df5dfb23cbbb88847459ecdf4b6107040d0944a3e84ee6bb26cb4e8017a35c8c31b658387cd1b6938ba4cb9f59606ece

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cd0da0cf2ca1c9e341c2842e6b663718

SHA1
8ea2b05a1f0446d9290ae117f7c568ba6153c20f

SHA256
fdefb23a7dd41903d4f2a15fde22e871618cc589a1b66008422a3b0f42ad7637

SHA512
cf87918e834bc7e35eae7bf7978cd080e1eb4f48573fdcc164a9a7595c5333a036300a648d1645bc0785df9d953a541ce0e064c301184675d123efcefb123867

Download Submit