6273b3f1fbf34ce1e2c0075ff24dd875258f69c96fe95c0cec3b7e5762fd6865

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 15:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

16908f41dad6c5c7c8112f29c512ce93_JaffaCakes118.html
Size

124KB
MD5

16908f41dad6c5c7c8112f29c512ce93
SHA1

23cac5218fa35f9d5448715493be8dd798251271
SHA256

6273b3f1fbf34ce1e2c0075ff24dd875258f69c96fe95c0cec3b7e5762fd6865
SHA512

364b022e8d99b5463fdfd13349287415ca31e4fc0a5b6d3e518dfd9e94eedde8a88d3cd8743bcf67b4d6af6262a414c73f401477dbb7e2eb7c57c28cca0e95ec
SSDEEP

1536:U8cnGL1csWODWm6MSY0eoUHVZE6Oic1QXUPd:enA1csWKoUH1LXw

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1780	msedge.exe
1780	msedge.exe
2096	msedge.exe
2096	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 1140	2096	msedge.exe	81
PID 2096 wrote to memory of 1140	2096	msedge.exe	81
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1708	2096	msedge.exe	82
PID 2096 wrote to memory of 1780	2096	msedge.exe	83
PID 2096 wrote to memory of 1780	2096	msedge.exe	83
PID 2096 wrote to memory of 4068	2096	msedge.exe	84
PID 2096 wrote to memory of 4068	2096	msedge.exe	84
PID 2096 wrote to memory of 4068	2096	msedge.exe	84
PID 2096 wrote to memory of 4068	2096	msedge.exe	84
PID 2096 wrote to memory of 4068	2096	msedge.exe	84
PID 2096 wrote to memory of 4068	2096	msedge.exe	84
PID 2096 wrote to memory of 4068	2096	msedge.exe	84
PID 2096 wrote to memory of 4068	2096	msedge.exe	84
PID 2096 wrote to memory of 4068	2096	msedge.exe	84
PID 2096 wrote to memory of 4068	2096	msedge.exe	84
PID 2096 wrote to memory of 4068	2096	msedge.exe	84
PID 2096 wrote to memory of 4068	2096	msedge.exe	84
PID 2096 wrote to memory of 4068	2096	msedge.exe	84
PID 2096 wrote to memory of 4068	2096	msedge.exe	84
PID 2096 wrote to memory of 4068	2096	msedge.exe	84
PID 2096 wrote to memory of 4068	2096	msedge.exe	84
PID 2096 wrote to memory of 4068	2096	msedge.exe	84
PID 2096 wrote to memory of 4068	2096	msedge.exe	84
PID 2096 wrote to memory of 4068	2096	msedge.exe	84
PID 2096 wrote to memory of 4068	2096	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\16908f41dad6c5c7c8112f29c512ce93_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa80746f8,0x7fffa8074708,0x7fffa8074718
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,7052680259057015608,155886022547389109,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,7052680259057015608,155886022547389109,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,7052680259057015608,155886022547389109,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7052680259057015608,155886022547389109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7052680259057015608,155886022547389109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7052680259057015608,155886022547389109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7052680259057015608,155886022547389109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7052680259057015608,155886022547389109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,7052680259057015608,155886022547389109,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5240 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
496e74d483e73c43856c550fa194289d

SHA1
eb54cff07bfaa92d0109ec93642e4b60c2a7d04a

SHA256
91133de7b8585daf1ab4fad9fab48e708e642033919c59532ef3ab7fd7e14393

SHA512
e53ab1ff8e43dff3d79f4223a58ed17b63d0ab44dde222c1982a4095ae00cfc1cd84c5d43f0aa08eca478c6280735f8e732ad4505e6ffe908cde654b78041213

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0df763f8ff24cf06735c7bad70b19813

SHA1
4c8cb25243738dadbc9c4453b7ccded3b9767156

SHA256
24b13cd8776e7ff2344dca3d612305244ea9b2fc9a0cbbe8e7606a75cff813b7

SHA512
4d73da3be9da7addaf623fd5ccf23031f472cbe59e9c1b23989f469637e1eef10a25b3dc5c64fff39a12e82d1f46281c711971f58003025846045107fa31e68d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e1eeffbc2b81f91bbb6a2634874819aa

SHA1
e7529e8980bc7d4ad4e6ebbb4e2cc27d164c1714

SHA256
21ff6c79698d301e7193d593ee8701d4d730554b16661a0fba0319f3605a5591

SHA512
c61522a03b75ae863cdbdddbf25cc050fd698239d845e0408436b83c08199ea2dbdaa8fc03425ad21ec2b7da8eb0d1dbaa8c24c389943dcdfe75751c3ea52dab

Download Submit