a36ce7109fd6c638927a06a9daf81ce915e814695d54a4f4674493373a7abc56

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 21:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a259545519077cc4da67d344cdd54982_JaffaCakes118.html
Size

214KB
MD5

a259545519077cc4da67d344cdd54982
SHA1

b84494e55e2a4168bc72af3fa1e75fb356ec958e
SHA256

a36ce7109fd6c638927a06a9daf81ce915e814695d54a4f4674493373a7abc56
SHA512

107884f401193f048f9928a18443d28487898b57f01ecac6f4c3e0d92fa7123e9cc88fb3e06cd4da6ef9f6effbaed606e643620d69771738a3667ba0700a4ac0
SSDEEP

3072:arhB9CyHxX7Be7iAvtLPbAwuBNKifXTJL:yz9VxLY7iAVLTBQJlL

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
116	msedge.exe
116	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
116	msedge.exe
116	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 3792	116	msedge.exe	81
PID 116 wrote to memory of 3792	116	msedge.exe	81
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2568	116	msedge.exe	83
PID 116 wrote to memory of 2172	116	msedge.exe	84
PID 116 wrote to memory of 2172	116	msedge.exe	84
PID 116 wrote to memory of 552	116	msedge.exe	85
PID 116 wrote to memory of 552	116	msedge.exe	85
PID 116 wrote to memory of 552	116	msedge.exe	85
PID 116 wrote to memory of 552	116	msedge.exe	85
PID 116 wrote to memory of 552	116	msedge.exe	85
PID 116 wrote to memory of 552	116	msedge.exe	85
PID 116 wrote to memory of 552	116	msedge.exe	85
PID 116 wrote to memory of 552	116	msedge.exe	85
PID 116 wrote to memory of 552	116	msedge.exe	85
PID 116 wrote to memory of 552	116	msedge.exe	85
PID 116 wrote to memory of 552	116	msedge.exe	85
PID 116 wrote to memory of 552	116	msedge.exe	85
PID 116 wrote to memory of 552	116	msedge.exe	85
PID 116 wrote to memory of 552	116	msedge.exe	85
PID 116 wrote to memory of 552	116	msedge.exe	85
PID 116 wrote to memory of 552	116	msedge.exe	85
PID 116 wrote to memory of 552	116	msedge.exe	85
PID 116 wrote to memory of 552	116	msedge.exe	85
PID 116 wrote to memory of 552	116	msedge.exe	85
PID 116 wrote to memory of 552	116	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a259545519077cc4da67d344cdd54982_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc47d446f8,0x7ffc47d44708,0x7ffc47d44718
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,1915259729427728971,1379569880605550679,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,1915259729427728971,1379569880605550679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,1915259729427728971,1379569880605550679,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1915259729427728971,1379569880605550679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1915259729427728971,1379569880605550679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,1915259729427728971,1379569880605550679,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1260 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
477462b6ad8eaaf8d38f5e3a4daf17b0

SHA1
86174e670c44767c08a39cc2a53c09c318326201

SHA256
e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d

SHA512
a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b704c9ca0493bd4548ac9c69dc4a4f27

SHA1
a3e5e54e630dabe55ca18a798d9f5681e0620ba7

SHA256
2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411

SHA512
69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
60c6cc6a5ac4c11a033065c28c4957e3

SHA1
bf22e52820f7450415bba0d8cd28c54cee2879f8

SHA256
f890f2a24774a4d330519e530b47875fe26b01292a0f487e92d94e61bbe84013

SHA512
04819c07a9c2bee3997c573209526c3b00023c2d91bd0aaba8e55cb43e7a5de8f1738abf00eb977e280ba041c5e7adca4b953118cc55dce260b95defa93df280

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
38ec438286752d6f4f7bd368e15ddc64

SHA1
2ad6fa7ba6fcb7ce53991c8298100a09f4b3123c

SHA256
6a3bef82969abd5c090be7c6356a03da2d4432e154ea5e24cb6eb574a2d60323

SHA512
cef4a8f810c43284504d1e7368c6b48d6076470f20e398147597813ed31826fb26be09a267c01d17b59a7a4a701ab4746c2b3b264d69d1c0daddd89fdf8991d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3686df67c06c116274d4ad5a101772d6

SHA1
13f3cf01ca1163d6fbd2b39e16cb4d20b70db583

SHA256
c5f482cef0fd88f2c4919724c1e7c1b92db8964c5fd85eb2caf7cd3e5388cf22

SHA512
c5c73faf53920469f62f5df673dd6b4c23b66670a531769c043443a543211c1c9919c10eb1d357b7d1bac9fccdd541b8600d27115a63506492c63eefa48b83ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7f1a0d877baef21a7dc835c53535001d

SHA1
9a35333fcc022c3f121affa8bd7a09c2a3cdda9e

SHA256
fffe659d5924b1d37870a9fbe1996e7f774b8fb9735480aff8eaf004bd9f5d9a

SHA512
f556106376633c98bd18068d66b94df62a5c8d99a3acfd98ff00ad693a2143dcad8c610c91ee0b3c965d491c11424dfdb68b128891399ec4de6435c5104c28d1

Download Submit