606cfeaa17227b769f39d44c9e6b417b995f6dba65431e35c7e77f212f7f6476

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 07:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d440e08bbdb922d36465f54cbef0653_JaffaCakes118.html
Size

118KB
MD5

4d440e08bbdb922d36465f54cbef0653
SHA1

20060bcd16c70c608efa1bff0a1815575dd0e6e1
SHA256

606cfeaa17227b769f39d44c9e6b417b995f6dba65431e35c7e77f212f7f6476
SHA512

cd04d45ea15ed44067b5c7a42b954636524e2dc0eb13ad8a321f04afd941a990edc5b46aee0a87d593fce0cd1814586ed3d8cbd03b554fe9344cba0487be6d44
SSDEEP

768:7xr/50H975KovtPIJOOvFrAgJBsb1GU6wdwzU8CCJRFh7rqITUMzJ1WIKu:7leHZF9GxA0sbcRwdwI8CaFTUMN1x

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
3192	msedge.exe
3192	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 5072	3192	msedge.exe	83
PID 3192 wrote to memory of 5072	3192	msedge.exe	83
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 556	3192	msedge.exe	84
PID 3192 wrote to memory of 5064	3192	msedge.exe	85
PID 3192 wrote to memory of 5064	3192	msedge.exe	85
PID 3192 wrote to memory of 752	3192	msedge.exe	86
PID 3192 wrote to memory of 752	3192	msedge.exe	86
PID 3192 wrote to memory of 752	3192	msedge.exe	86
PID 3192 wrote to memory of 752	3192	msedge.exe	86
PID 3192 wrote to memory of 752	3192	msedge.exe	86
PID 3192 wrote to memory of 752	3192	msedge.exe	86
PID 3192 wrote to memory of 752	3192	msedge.exe	86
PID 3192 wrote to memory of 752	3192	msedge.exe	86
PID 3192 wrote to memory of 752	3192	msedge.exe	86
PID 3192 wrote to memory of 752	3192	msedge.exe	86
PID 3192 wrote to memory of 752	3192	msedge.exe	86
PID 3192 wrote to memory of 752	3192	msedge.exe	86
PID 3192 wrote to memory of 752	3192	msedge.exe	86
PID 3192 wrote to memory of 752	3192	msedge.exe	86
PID 3192 wrote to memory of 752	3192	msedge.exe	86
PID 3192 wrote to memory of 752	3192	msedge.exe	86
PID 3192 wrote to memory of 752	3192	msedge.exe	86
PID 3192 wrote to memory of 752	3192	msedge.exe	86
PID 3192 wrote to memory of 752	3192	msedge.exe	86
PID 3192 wrote to memory of 752	3192	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4d440e08bbdb922d36465f54cbef0653_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb3e9046f8,0x7ffb3e904708,0x7ffb3e904718
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,8333204016677081699,13507231183294364718,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,8333204016677081699,13507231183294364718,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,8333204016677081699,13507231183294364718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8333204016677081699,13507231183294364718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8333204016677081699,13507231183294364718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8333204016677081699,13507231183294364718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8333204016677081699,13507231183294364718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8333204016677081699,13507231183294364718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,8333204016677081699,13507231183294364718,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5060 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c532be1d64f0ea042d582ade3b6580f6

SHA1
3c8dabba7be3a8cfce071e5fae958d1f28cf46a1

SHA256
f7cf3b27677aca2544added1041cc0fea1a67607e5d4001051c2297dc2198daa

SHA512
fb5c374ac14ca100825309730c9d3812eb81bb2411a3c7b36823059d778c8fa88980ed86231f7d130141b0ef62dc8c3a57e1a5bf066ad22261f2af0e870b1b1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e94bf5a5-a7b9-4536-bb9f-f75133378a63.tmp

Filesize
6KB

MD5
3b20c0fc20e2dee276787eff468e416a

SHA1
489e4d086693c3b770e0a0455f0d1d71ed212aa4

SHA256
dd07ff276d2ae520a61f1472536845631479659b49bd7e0ff6352c2323181028

SHA512
d162af9c84d40b60e2b78b46c9d01e127354269259b9928bfb64725839c38a1d9404da6958d7e3f0f250dce7997e0d039e481deb0d1437d6b9bbf45045d53ee4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f0de2a32c0bc56815ddfc344cbca29da

SHA1
2c1122838de43be793e9b1835574be87ba839381

SHA256
27a6ffff38f148ce7da42e5180a72562290b2f87747209900dc0bc12afb3b684

SHA512
adc94d14f647e1d49af38e46b28b9e40b319d754fe9f5da36eedc21e5c36f3aa86736e2a57dc005d1343128401cd1dc5b9d98fe1faf8ef4ba76ad630b0f6105a

Download Submit