620d186f5d703f09f27d2a25f78497d36e063fd2d49c0fec7c3353918ecf6235

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 19:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2950b4450a41df341636977e0a817fa5_JaffaCakes118.html
Size

461KB
MD5

2950b4450a41df341636977e0a817fa5
SHA1

18eefa18b527cc9ed2196ce914d0201b5bd43448
SHA256

620d186f5d703f09f27d2a25f78497d36e063fd2d49c0fec7c3353918ecf6235
SHA512

f62719b0c70be4d93be1a095528576c87cc2d21446d678c9113518afb1d17d9eaadda746fd22001ac50b1b230473d56ad57daf1eb9a437ca5cb4e37fd6766274
SSDEEP

6144:VsMYod+X3oI+YhsMYod+X3oI+YTNIsMYod+X3oI+YUsMYod+X3oI+YW:B5d+X3T5d+X3dNW5d+X3Y5d+X3c

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe
4052	msedge.exe
4052	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4052	msedge.exe
4052	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 2508	4052	msedge.exe	82
PID 4052 wrote to memory of 2508	4052	msedge.exe	82
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1860	4052	msedge.exe	83
PID 4052 wrote to memory of 1044	4052	msedge.exe	84
PID 4052 wrote to memory of 1044	4052	msedge.exe	84
PID 4052 wrote to memory of 2908	4052	msedge.exe	85
PID 4052 wrote to memory of 2908	4052	msedge.exe	85
PID 4052 wrote to memory of 2908	4052	msedge.exe	85
PID 4052 wrote to memory of 2908	4052	msedge.exe	85
PID 4052 wrote to memory of 2908	4052	msedge.exe	85
PID 4052 wrote to memory of 2908	4052	msedge.exe	85
PID 4052 wrote to memory of 2908	4052	msedge.exe	85
PID 4052 wrote to memory of 2908	4052	msedge.exe	85
PID 4052 wrote to memory of 2908	4052	msedge.exe	85
PID 4052 wrote to memory of 2908	4052	msedge.exe	85
PID 4052 wrote to memory of 2908	4052	msedge.exe	85
PID 4052 wrote to memory of 2908	4052	msedge.exe	85
PID 4052 wrote to memory of 2908	4052	msedge.exe	85
PID 4052 wrote to memory of 2908	4052	msedge.exe	85
PID 4052 wrote to memory of 2908	4052	msedge.exe	85
PID 4052 wrote to memory of 2908	4052	msedge.exe	85
PID 4052 wrote to memory of 2908	4052	msedge.exe	85
PID 4052 wrote to memory of 2908	4052	msedge.exe	85
PID 4052 wrote to memory of 2908	4052	msedge.exe	85
PID 4052 wrote to memory of 2908	4052	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2950b4450a41df341636977e0a817fa5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa709346f8,0x7ffa70934708,0x7ffa70934718
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,1168245394056765986,9114714056220119066,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,1168245394056765986,9114714056220119066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,1168245394056765986,9114714056220119066,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1168245394056765986,9114714056220119066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1168245394056765986,9114714056220119066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,1168245394056765986,9114714056220119066,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5004 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a27d8876d0de41d0d8ddfdc4f6fd4b15

SHA1
11f126f8b8bb7b63217f3525c20080f9e969eff3

SHA256
d32983bba248ff7a82cc936342414b06686608013d84ec5c75614e06a9685cfe

SHA512
8298c2435729f5f34bba5b82f31777c07f830076dd7087f07aab4337e679251dc2cfe276aa89a0131755fe946f05e6061ef9080e0fbe120e6c88cf9f3265689c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f060e9a30a0dde4f5e3e80ae94cc7e8e

SHA1
3c0cc8c3a62c00d7210bb2c8f3748aec89009d17

SHA256
c0e69c9f7453ef905de11f65d69b66cf8a5a2d8e42b7f296fa8dfde5c25abc79

SHA512
af97b8775922a2689d391d75defff3afe92842b8ab0bba5ddaa66351f633da83f160522aa39f6c243cb5e8ea543000f06939318bc52cb535103afc6c33e16bc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ad88d1db1ee3350265fa41e4421ce7b8

SHA1
f94c91d6f11278d8e83c83ca9bbfa0398398b74a

SHA256
7a3eaebbf75fb22e8d6a1cf4af26588f4ae68fbdd2f4df8e09491b61f5a330c0

SHA512
d077e6eab2816197cf22d4c8a184432baa1ad8d7d8648e0b5d0f2927be31239fdccb931cec180c3a39ed8610d179d8f093679bafae704763e8a91c0eec4f7aad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
97bfc94f3cb0691d338afa75876acf36

SHA1
0fd66d3437645ef3fab129d90c46aff01f1703ff

SHA256
58f84e448752769a967bd6ff42f9d79e30561392d43507c2693480d5d20e41e3

SHA512
93c76aab6aaa9c062a22e5b565b6e005bb58d2c8f870a7d471c0433ba484d3979957d5bf4d95160bd7c70ed4ed56f3d21f76e4221b3c1cb4d9ab0f8e711f8206

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1572db5fb16b1f8601fc2ac134f27271

SHA1
3153dde03dd6bfcbcf52e96a06a39ddacf2c6b92

SHA256
de05193def70cb44d893112ce5399f5a3fd5e023cdb05666fd9462018115c51a

SHA512
a52228d2745873af6dbc0a60f67db6342dfc1b7bc4398d29eeb89c818286e223fa5657db13f816b2555c925f8343035c2835ad4702160209e2c97acd732f7e8f

Download Submit