1010c7730baa74f1a01263f7f233d489fd39f4aaa7783af5923f0457083f29ab

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab661df6e061c4b1919414207ae51176_JaffaCakes118.html
Size

218KB
MD5

ab661df6e061c4b1919414207ae51176
SHA1

bceae59ff2ae2466750ae8a94181c703505b6fc9
SHA256

1010c7730baa74f1a01263f7f233d489fd39f4aaa7783af5923f0457083f29ab
SHA512

9d1330e4e6f13d867544c1dc717c714af930a877c79b76947a5165fdb130f1bd10c6abdaad1b0cf07f7700378f4b7c88e59f599a2ef2f04c6bd5f0984d215f60
SSDEEP

3072:SJx/1HarVyfkMY+BES09JXAnyrZalI+YQ:SJxNHeAsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1860	msedge.exe
1860	msedge.exe
1624	msedge.exe
1624	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 5088	1624	msedge.exe	81
PID 1624 wrote to memory of 5088	1624	msedge.exe	81
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1896	1624	msedge.exe	82
PID 1624 wrote to memory of 1860	1624	msedge.exe	83
PID 1624 wrote to memory of 1860	1624	msedge.exe	83
PID 1624 wrote to memory of 640	1624	msedge.exe	84
PID 1624 wrote to memory of 640	1624	msedge.exe	84
PID 1624 wrote to memory of 640	1624	msedge.exe	84
PID 1624 wrote to memory of 640	1624	msedge.exe	84
PID 1624 wrote to memory of 640	1624	msedge.exe	84
PID 1624 wrote to memory of 640	1624	msedge.exe	84
PID 1624 wrote to memory of 640	1624	msedge.exe	84
PID 1624 wrote to memory of 640	1624	msedge.exe	84
PID 1624 wrote to memory of 640	1624	msedge.exe	84
PID 1624 wrote to memory of 640	1624	msedge.exe	84
PID 1624 wrote to memory of 640	1624	msedge.exe	84
PID 1624 wrote to memory of 640	1624	msedge.exe	84
PID 1624 wrote to memory of 640	1624	msedge.exe	84
PID 1624 wrote to memory of 640	1624	msedge.exe	84
PID 1624 wrote to memory of 640	1624	msedge.exe	84
PID 1624 wrote to memory of 640	1624	msedge.exe	84
PID 1624 wrote to memory of 640	1624	msedge.exe	84
PID 1624 wrote to memory of 640	1624	msedge.exe	84
PID 1624 wrote to memory of 640	1624	msedge.exe	84
PID 1624 wrote to memory of 640	1624	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ab661df6e061c4b1919414207ae51176_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffefebc46f8,0x7ffefebc4708,0x7ffefebc4718
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,997000997170808433,2011313877282078287,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,997000997170808433,2011313877282078287,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,997000997170808433,2011313877282078287,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,997000997170808433,2011313877282078287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,997000997170808433,2011313877282078287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,997000997170808433,2011313877282078287,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
39f878e5fb8355376d97b6a2421c6aae

SHA1
e34889d4690d0a88088eb75670f4aa99fd59703b

SHA256
125bc27fc32610d3742e6dcc724e0398e843927372fa6a0fba1fea019335836a

SHA512
8124ce38288405336a58c48a63f68620ebcce1614ec18b8a03111be07e6927f7c9a7aec9d7db0143cd8048c535b6a8c8f74b7e46705507473c3f16278716346f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2c637e43268c9171f8e0a7ec13e1091f

SHA1
384ce696343f87919b522688f1bec0136699025f

SHA256
ef4664c0cd3996477255fcde4fb6a44f656ca2a7e845901cf1325cdad1232aaf

SHA512
ddf6e9e51a45975ca98995af9734e7c61d9d0d3907f83f0673f0b35b0cf6d2462aea5ada51ca37728dbc8c6bcf50cc29c360f35b678c2a22a9d1d3e0c51fe040

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b84503b334f1f5e60f4ec32dea4fc07b

SHA1
4c98277dbad68e79c0c9a531980bed84579af864

SHA256
38ebc954e2c1b10fd0f310df8bccb8788ff648449443fe6ddd41af839afa481d

SHA512
f1653e054cf3dc3d5769be3264b8310b8b0391600b3ba8631710aa701cd4ad816d35a9cb48ffa2b2a9663dc0be01620d6246daa45de5f470de7b778da85ba59f

Download Submit