4828dcce6be31c5de762b51a84b20ada71f87c8797dbac8b28d62741d6cb7e29

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 06:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6682ebb7d72944fbcac6e2b202fefb7a_JaffaCakes118.html
Size

372KB
MD5

6682ebb7d72944fbcac6e2b202fefb7a
SHA1

c7fbf1b3a3ab51cf7ac40c12689c41586ba38719
SHA256

4828dcce6be31c5de762b51a84b20ada71f87c8797dbac8b28d62741d6cb7e29
SHA512

3135a4d7ddfc7a67fbf1af4710dbaa3fec96c3e0236417049e2aaf62c041a40eb286969af4d9f7ff3c308413053f34dd0333151c9d360d44e9cf9252380600d8
SSDEEP

6144:idprA/9/JtgHtlc4ISOy5nDF2T/r0/3Nka4tq3m+Tea/LaJuZtz6:gprA/9/JtgHtXIZy5nDF2T/r0/3Nka4r

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
1500	msedge.exe
1500	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 3964	1500	msedge.exe	84
PID 1500 wrote to memory of 3964	1500	msedge.exe	84
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4632	1500	msedge.exe	85
PID 1500 wrote to memory of 4340	1500	msedge.exe	86
PID 1500 wrote to memory of 4340	1500	msedge.exe	86
PID 1500 wrote to memory of 2536	1500	msedge.exe	87
PID 1500 wrote to memory of 2536	1500	msedge.exe	87
PID 1500 wrote to memory of 2536	1500	msedge.exe	87
PID 1500 wrote to memory of 2536	1500	msedge.exe	87
PID 1500 wrote to memory of 2536	1500	msedge.exe	87
PID 1500 wrote to memory of 2536	1500	msedge.exe	87
PID 1500 wrote to memory of 2536	1500	msedge.exe	87
PID 1500 wrote to memory of 2536	1500	msedge.exe	87
PID 1500 wrote to memory of 2536	1500	msedge.exe	87
PID 1500 wrote to memory of 2536	1500	msedge.exe	87
PID 1500 wrote to memory of 2536	1500	msedge.exe	87
PID 1500 wrote to memory of 2536	1500	msedge.exe	87
PID 1500 wrote to memory of 2536	1500	msedge.exe	87
PID 1500 wrote to memory of 2536	1500	msedge.exe	87
PID 1500 wrote to memory of 2536	1500	msedge.exe	87
PID 1500 wrote to memory of 2536	1500	msedge.exe	87
PID 1500 wrote to memory of 2536	1500	msedge.exe	87
PID 1500 wrote to memory of 2536	1500	msedge.exe	87
PID 1500 wrote to memory of 2536	1500	msedge.exe	87
PID 1500 wrote to memory of 2536	1500	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6682ebb7d72944fbcac6e2b202fefb7a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb96346f8,0x7ffcb9634708,0x7ffcb9634718
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,13471438536300169275,4356997314542199590,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,13471438536300169275,4356997314542199590,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,13471438536300169275,4356997314542199590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,13471438536300169275,4356997314542199590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,13471438536300169275,4356997314542199590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,13471438536300169275,4356997314542199590,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c00b0d6e0f836dfa596c6df9d3b2f8f2

SHA1
69ad27d9b4502630728f98917f67307e9dd12a30

SHA256
578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1

SHA512
0e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54f1b76300ce15e44e5cc1a3947f5ca9

SHA1
c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7

SHA256
43dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24

SHA512
ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
820B

MD5
76728c0a6b6fa08bc515e56b3d765315

SHA1
fc7d46f2a327bb2df641e6e90712c96c72b8667f

SHA256
a4683843ca0adefc159814adeee76cc2edff2819c5d2fb489de4e5661875f489

SHA512
0dbf74560d22cd35cad25c51a8f606348f9fd763734692e0757cdb665af364ff95ca2688ed7a7459dafdf2f7bfbd355d768cfd1fdafc668a6456d3ae59926c21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c7483c19a01e1c680efca877cab301db

SHA1
f7b94acc7ed756681cd646f27f8e4f73b15887f6

SHA256
24617765eb8546f1fdedf36588f80cac307c646c34211e822f6ca52368599829

SHA512
01e3a70c3a17e12e2c9b2c0491f576ff1cfc0c8b85734750ef27d49ce1f16e7558bd44a796fc6e140f9d818663827e9963fb212f6ed92f010b538acd86218f56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0e165ae53fdcc00f8530793180d2ecf1

SHA1
51ba01dcbc2a503d01a417c42b80e47061acd898

SHA256
2e2a4e58a32cf4af1d149c9e26f22b511b2f5ce7da4709a858826bab0e46062d

SHA512
76b019d29841d931201f5551bff847b393d55dc4b7bac9f02c0e9e7df2aa55a915f65ec385ca0c76f3afa0c5ce2f8f9ecd36ee4713f30ac0858e59aa73da3d16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5f104e43e9bf04312dc99db8f68ac2e1

SHA1
877118e9442aa9920cc97e7813c2287decbea890

SHA256
7b31bd2e1293ce37dda3505a2c3d855fae83d0408df41d5824b32babe3c60826

SHA512
3e221779734e4433e94ba645e3e85ee1b436d7bdba3179544838076b44984f6cae6c578e9e79029ba2f89712394fa06e8b2f0a65dcc60f6260535caa401ff1c3

Download Submit