20e58130717752dc27fb01ade896b192c0b47e329d8e82dbf4d07c074851d60b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 09:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e24423c4382ad46c407ec06e3a607a2_JaffaCakes118.html
Size

18KB
MD5

0e24423c4382ad46c407ec06e3a607a2
SHA1

fc877a7969787a88acc17951309d2c3471e81fe8
SHA256

20e58130717752dc27fb01ade896b192c0b47e329d8e82dbf4d07c074851d60b
SHA512

329bab10c5aa10d44ce71cf14755d9081612069153b1a01b8f9e54d2e2e5bddd64fb90e5b1d0bbf9b6a49f380174c561a1ef4f08965d5611367d254ebf8cc549
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIM4QzUnjBh0O82qDB8:SIMd0I5nO9Htsv09xDB8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
4544	msedge.exe
4544	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 4836	4544	msedge.exe	86
PID 4544 wrote to memory of 4836	4544	msedge.exe	86
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 3820	4544	msedge.exe	87
PID 4544 wrote to memory of 4632	4544	msedge.exe	88
PID 4544 wrote to memory of 4632	4544	msedge.exe	88
PID 4544 wrote to memory of 2328	4544	msedge.exe	89
PID 4544 wrote to memory of 2328	4544	msedge.exe	89
PID 4544 wrote to memory of 2328	4544	msedge.exe	89
PID 4544 wrote to memory of 2328	4544	msedge.exe	89
PID 4544 wrote to memory of 2328	4544	msedge.exe	89
PID 4544 wrote to memory of 2328	4544	msedge.exe	89
PID 4544 wrote to memory of 2328	4544	msedge.exe	89
PID 4544 wrote to memory of 2328	4544	msedge.exe	89
PID 4544 wrote to memory of 2328	4544	msedge.exe	89
PID 4544 wrote to memory of 2328	4544	msedge.exe	89
PID 4544 wrote to memory of 2328	4544	msedge.exe	89
PID 4544 wrote to memory of 2328	4544	msedge.exe	89
PID 4544 wrote to memory of 2328	4544	msedge.exe	89
PID 4544 wrote to memory of 2328	4544	msedge.exe	89
PID 4544 wrote to memory of 2328	4544	msedge.exe	89
PID 4544 wrote to memory of 2328	4544	msedge.exe	89
PID 4544 wrote to memory of 2328	4544	msedge.exe	89
PID 4544 wrote to memory of 2328	4544	msedge.exe	89
PID 4544 wrote to memory of 2328	4544	msedge.exe	89
PID 4544 wrote to memory of 2328	4544	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0e24423c4382ad46c407ec06e3a607a2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7fff129b46f8,0x7fff129b4708,0x7fff129b4718
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,13170939774212257664,5668257897582028970,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,13170939774212257664,5668257897582028970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,13170939774212257664,5668257897582028970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13170939774212257664,5668257897582028970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13170939774212257664,5668257897582028970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,13170939774212257664,5668257897582028970,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62c02dda2bf22d702a9b3a1c547c5f6a

SHA1
8f42966df96bd2e8c1f6b31b37c9a19beb6394d6

SHA256
cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b

SHA512
a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a068719c0b35d4c5ebb428d84e736f6b

SHA1
82bb94fb5c5b2b2cdf470d536ddb0e675fac8d82

SHA256
03817a63bf2cac689f63d7efc55ad0ad84b7bd9ab5e8440d42aa4cccd3390979

SHA512
e8a6d0e6217f954ff7a376e6ae7adc80284cd20c6ef6939173aa319a4629244376b5c3622f68bcdf871e2fd7a07e5afebbf483532aa85fcdf4ac2659eba754aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fcaed6c426b4f89e84e7e0758b1f58bc

SHA1
e74e6f674315813614a67f544ca3b8242a74a916

SHA256
43651627a32c3ec4ed32758706459a632739045fa540d4e71f6f635699328281

SHA512
5f7cc1bfd343fbeb83d5441065e3762f2bf67c4d4a3f86d459bdc56909f6b6a274d204691ff96070c8a0368eeb15cc5271adcdfec6e8ef5c6017324cc26b6581

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ccf2758ab35ce4203ae6814fb85cd3d6

SHA1
7fde207cb4c3b3af81363a926abb594560beda83

SHA256
4d3948b329b17acb45c140cc0f1b5264e55c90f182d6545c5afca64f43833b19

SHA512
44b47c2ed6a66492bba4f05a7df98b0cb71a5eae458ef322820e37de67fa219bc27091eaf4ab2e639f66e8adda815a256751d81f4952fb82d7fe917e409f4976

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dc498a8e1402cb04cc7dd07b8623cd61

SHA1
018e5ddcc87daf70e2569b4ea70c1212dfa40bf8

SHA256
3d6208e567dcc096b792d5a22cf2a40c898fbc5d4d25d44d96df4cba55d79709

SHA512
7ac811562b9bb4fb26d42816540652f94797673f8b6bcdc669cd96dbd3b3ef9fe2c2cd97418d41b4bcfd216ddc3c1ca84b948c8a76ec936dd058b37adc4c9f2e

Download Submit