61036bec2577eb98cdd9a33bb33b9e5a7498eeca279161d005be13b555111254

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 20:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31cf4be161510541026426e5451f9f92_JaffaCakes118.html
Size

120KB
MD5

31cf4be161510541026426e5451f9f92
SHA1

aa6bb51f5f84afef408a4ca40f4e3ead8fdb2377
SHA256

61036bec2577eb98cdd9a33bb33b9e5a7498eeca279161d005be13b555111254
SHA512

a8c41211f91ed61d417ff38189e002e8e4ca79907577a481ecfb24c5a2d5294b5c934ce7679df71afcf11e199a1b6c5fecfd423b560533322a6a7be2a2a23946
SSDEEP

1536:YPP0nrVp0el3S0pjk5054mwuH+iqrHwzpsw6F:ZoQS0SS5qbyM

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4780	msedge.exe
4780	msedge.exe
376	msedge.exe
376	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 3556	376	msedge.exe	81
PID 376 wrote to memory of 3556	376	msedge.exe	81
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 2416	376	msedge.exe	83
PID 376 wrote to memory of 4780	376	msedge.exe	84
PID 376 wrote to memory of 4780	376	msedge.exe	84
PID 376 wrote to memory of 1504	376	msedge.exe	85
PID 376 wrote to memory of 1504	376	msedge.exe	85
PID 376 wrote to memory of 1504	376	msedge.exe	85
PID 376 wrote to memory of 1504	376	msedge.exe	85
PID 376 wrote to memory of 1504	376	msedge.exe	85
PID 376 wrote to memory of 1504	376	msedge.exe	85
PID 376 wrote to memory of 1504	376	msedge.exe	85
PID 376 wrote to memory of 1504	376	msedge.exe	85
PID 376 wrote to memory of 1504	376	msedge.exe	85
PID 376 wrote to memory of 1504	376	msedge.exe	85
PID 376 wrote to memory of 1504	376	msedge.exe	85
PID 376 wrote to memory of 1504	376	msedge.exe	85
PID 376 wrote to memory of 1504	376	msedge.exe	85
PID 376 wrote to memory of 1504	376	msedge.exe	85
PID 376 wrote to memory of 1504	376	msedge.exe	85
PID 376 wrote to memory of 1504	376	msedge.exe	85
PID 376 wrote to memory of 1504	376	msedge.exe	85
PID 376 wrote to memory of 1504	376	msedge.exe	85
PID 376 wrote to memory of 1504	376	msedge.exe	85
PID 376 wrote to memory of 1504	376	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\31cf4be161510541026426e5451f9f92_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ccfe46f8,0x7ff8ccfe4708,0x7ff8ccfe4718
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,14221788808116935378,13724959730842142748,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,14221788808116935378,13724959730842142748,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,14221788808116935378,13724959730842142748,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,14221788808116935378,13724959730842142748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,14221788808116935378,13724959730842142748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,14221788808116935378,13724959730842142748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,14221788808116935378,13724959730842142748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,14221788808116935378,13724959730842142748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,14221788808116935378,13724959730842142748,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4896 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\828c4c3d-3210-4941-a139-3c702b55aadb.tmp

Filesize
11KB

MD5
a5b545a2bcd276dcd72fe8c9dfebe8f7

SHA1
92374537afa16335ed68d06c17d4262fc211248e

SHA256
252bcf09b3ee23c2766561a79abd35ff96a7a34797485dac10a75652d221d7a4

SHA512
f53d851edb0f6d04fc59d618b0a6dd2b8b8dab2f118d37e141c73f9ed0f4f45f28a954af5584105140e5a929437ae4afd9df7eabac11305cd044377e789448e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2f842025e22e522658c640cfc7edc529

SHA1
4c2b24b02709acdd159f1b9bbeb396e52af27033

SHA256
1191573f2a7c12f0b9b8460e06dc36ca5386305eb8c883ebbbc8eb15f4d8e23e

SHA512
6e4393fd43984722229020ef662fc5981f253de31f13f30fadd6660bbc9ededcbfd163f132f6adaf42d435873322a5d0d3eea60060cf0e7f2e256262632c5d05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54aadd2d8ec66e446f1edb466b99ba8d

SHA1
a94f02b035dc918d8d9a46e6886413f15be5bff0

SHA256
1971045943002ef01930add9ba1a96a92ddc10d6c581ce29e33c38c2120b130e

SHA512
7e077f903463da60b5587aed4f5352060df400ebda713b602b88c15cb2f91076531ea07546a9352df772656065e0bf27bd285905a60f036a5c5951076d35e994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e891cb8becb18e78e16d286505c261f7

SHA1
2f1db9279babfc58df557403aa432fdab8250d8e

SHA256
f2a3896b65253b9603b71f01d2848cfa3e8b5426d78bf28bb4b84667817a7d38

SHA512
ad904c2df3ef1c24d2409322cccc2c680396387079c568acdb15d3f7790a75fdef5bc88573a7eb2190013a7f9cacf69a49d09d59e3598935c69767a95a77be77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aee8b1bced93007210a2be3d7da15a23

SHA1
14ce887c3b7276c849907e0675b0596be6a42a2e

SHA256
deecf0969294d7a9d703c8d8e8b959f1e1193d1a519620683b0c14bb7029bc2b

SHA512
2a14d6ac208e97bc526f527f3dd35e3ee0a57308813a23413e90ef08ff3343fba8d9f22664a1ccbf4d9d593cdd8c438b18663c25a3bef5d0df33d4d55e95227f

Download Submit