484340ab2137f3872bc46baf85158fcc57b943421825a8d7bc5816edc3bfc198

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 13:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

634dc4d9cb271adeee5d815f333edb42_JaffaCakes118.html
Size

12KB
MD5

634dc4d9cb271adeee5d815f333edb42
SHA1

d79ddb969ebda2e999f34dd4e1228ce737d3b8db
SHA256

484340ab2137f3872bc46baf85158fcc57b943421825a8d7bc5816edc3bfc198
SHA512

d2ddb928991bd461a85135f75046b35cf0596e4c3baeb72e3943f1ddbdd1df6a5625d701568f15ac5e19c5718cd4f2a95dd8f16525f9744824ed6afeb4959685
SSDEEP

192:S2cfyP+Y9bdtEe5DuSZjBvIlNUamSPjTtThTJlzxd:S2c6P+Y3Ce9u8FvIl9lT

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe
1700	msedge.exe
1700	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1700	msedge.exe
1700	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 3680	1700	msedge.exe	84
PID 1700 wrote to memory of 3680	1700	msedge.exe	84
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 2764	1700	msedge.exe	85
PID 1700 wrote to memory of 3132	1700	msedge.exe	86
PID 1700 wrote to memory of 3132	1700	msedge.exe	86
PID 1700 wrote to memory of 4952	1700	msedge.exe	87
PID 1700 wrote to memory of 4952	1700	msedge.exe	87
PID 1700 wrote to memory of 4952	1700	msedge.exe	87
PID 1700 wrote to memory of 4952	1700	msedge.exe	87
PID 1700 wrote to memory of 4952	1700	msedge.exe	87
PID 1700 wrote to memory of 4952	1700	msedge.exe	87
PID 1700 wrote to memory of 4952	1700	msedge.exe	87
PID 1700 wrote to memory of 4952	1700	msedge.exe	87
PID 1700 wrote to memory of 4952	1700	msedge.exe	87
PID 1700 wrote to memory of 4952	1700	msedge.exe	87
PID 1700 wrote to memory of 4952	1700	msedge.exe	87
PID 1700 wrote to memory of 4952	1700	msedge.exe	87
PID 1700 wrote to memory of 4952	1700	msedge.exe	87
PID 1700 wrote to memory of 4952	1700	msedge.exe	87
PID 1700 wrote to memory of 4952	1700	msedge.exe	87
PID 1700 wrote to memory of 4952	1700	msedge.exe	87
PID 1700 wrote to memory of 4952	1700	msedge.exe	87
PID 1700 wrote to memory of 4952	1700	msedge.exe	87
PID 1700 wrote to memory of 4952	1700	msedge.exe	87
PID 1700 wrote to memory of 4952	1700	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\634dc4d9cb271adeee5d815f333edb42_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbbd3e46f8,0x7ffbbd3e4708,0x7ffbbd3e4718
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,464902501826689213,649031078085346269,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,464902501826689213,649031078085346269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,464902501826689213,649031078085346269,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,464902501826689213,649031078085346269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,464902501826689213,649031078085346269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,464902501826689213,649031078085346269,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4348 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4878b0518e4e682b770e61f939ac54ac

SHA1
60d723a2f447a4096b747f678e27c8a00b2c5a76

SHA256
4774b11e2dfcf1b3306efb97711e65bb0d162a71d7460520f53851395bd08708

SHA512
cc09755f7cd36947050fa88639d296336123c6f0886711d6fc33db0e03d2e75936aeed7e046a53e1186e4fa88d0ba192b151501a9a12a347612fbf27c78e137b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1bcad7e3621288b27bc42d5c890107ac

SHA1
12197493a21eacb1d6d1c8905e7c8a07cd368906

SHA256
8003a4307b52e397b69574199b56c0e95af5de56d0bb73044ea04a91b0d5c04d

SHA512
88b662a0dbe32692932fb15a797fc6e61432de73f7c99f47f5472c671181b605171761f7621076ca8aeff0bee36496bcf8f40df1a6ee8acbb75b5c63315a7364

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1d8ed07c26c3c397bf177ee909f1402d

SHA1
31ca4b09daa50b3ea7fd05600b084953b01e8c3b

SHA256
202d6e2d0f1e6a7934dd94831a71406671e24788194ecc94fbbd9744c2712484

SHA512
8dd0957c5cb889b6a43b229f2a22bca3fc9101923e4e0598b1f93e914d5edb435c93884fc95ad9b272925fce1f266823f3ec22ca52e7549403797f8294ac72c3

Download Submit