09f8babd11f75158a820986230d17585937da1f2cf03f9875ccf5f90c620dbfe

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 18:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b3de96eb5bcc4654b48d27ef83d7556_JaffaCakes118.html
Size

214KB
MD5

2b3de96eb5bcc4654b48d27ef83d7556
SHA1

293628fb80c67c167440bdac719a0dfdca21893b
SHA256

09f8babd11f75158a820986230d17585937da1f2cf03f9875ccf5f90c620dbfe
SHA512

427d3a4280cfcd4b3786f643db4750cf7e249249ddf1757425113a06c24c3823ef9c8c826bf9120d5c22bc8aeffa4156dba97fd4c79ac4dd1a9bdc4779d3c2c5
SSDEEP

3072:/rhB9CyHxX7Be7iAvtLPbAwuBNKifXTJn:Tz9VxLY7iAVLTBQJln

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2028	msedge.exe
2028	msedge.exe
4048	msedge.exe
4048	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 1004	4048	msedge.exe	85
PID 4048 wrote to memory of 1004	4048	msedge.exe	85
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 4320	4048	msedge.exe	86
PID 4048 wrote to memory of 2028	4048	msedge.exe	87
PID 4048 wrote to memory of 2028	4048	msedge.exe	87
PID 4048 wrote to memory of 2728	4048	msedge.exe	88
PID 4048 wrote to memory of 2728	4048	msedge.exe	88
PID 4048 wrote to memory of 2728	4048	msedge.exe	88
PID 4048 wrote to memory of 2728	4048	msedge.exe	88
PID 4048 wrote to memory of 2728	4048	msedge.exe	88
PID 4048 wrote to memory of 2728	4048	msedge.exe	88
PID 4048 wrote to memory of 2728	4048	msedge.exe	88
PID 4048 wrote to memory of 2728	4048	msedge.exe	88
PID 4048 wrote to memory of 2728	4048	msedge.exe	88
PID 4048 wrote to memory of 2728	4048	msedge.exe	88
PID 4048 wrote to memory of 2728	4048	msedge.exe	88
PID 4048 wrote to memory of 2728	4048	msedge.exe	88
PID 4048 wrote to memory of 2728	4048	msedge.exe	88
PID 4048 wrote to memory of 2728	4048	msedge.exe	88
PID 4048 wrote to memory of 2728	4048	msedge.exe	88
PID 4048 wrote to memory of 2728	4048	msedge.exe	88
PID 4048 wrote to memory of 2728	4048	msedge.exe	88
PID 4048 wrote to memory of 2728	4048	msedge.exe	88
PID 4048 wrote to memory of 2728	4048	msedge.exe	88
PID 4048 wrote to memory of 2728	4048	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2b3de96eb5bcc4654b48d27ef83d7556_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc835446f8,0x7ffc83544708,0x7ffc83544718
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,3499819581054625643,9594545036620695764,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,3499819581054625643,9594545036620695764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,3499819581054625643,9594545036620695764,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3499819581054625643,9594545036620695764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3499819581054625643,9594545036620695764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,3499819581054625643,9594545036620695764,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5b42aa1615aed9fa772e996241d2c3ee

SHA1
8a5451c498a783f8bd4d5aec2fdaae48f930a65a

SHA256
4f2e076bbbdee393b17adea9433e8ae723055df01b5eade9adfe97688b0d8df0

SHA512
e895c7cdc34b01c92dbf198ce529f360c9b7426f771c026070b5e10507446b3a972b1e56d4181695558228e14da84f6c0ec39210c9b4019e790a5ef7197c7352

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
01548c174bb39a2fd01abb812734f97c

SHA1
dd417b12fb614c35fdca4c238b209815393001a3

SHA256
37cffbc67c3487995de3fb40512593748c58fa8101215e26542f2d7a8d5d1ec1

SHA512
1494d7b0268e1a6beb21fa7c47d87cd1ed5296c922c068d3af040caae53ac4b929b2bac856e55299fa91a9e13b2db3935b19adff50fc5dbe60aeb784f1c2030b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e53082039f6836cc0d75bb44518775e5

SHA1
b83c982d755c593517a308161513cb0c282cf8c1

SHA256
3af5fe51564a1f1e2e78af2930d097773d73ef237c75b13a3525b1ab07533208

SHA512
83caaf64ef54c47e47c03083d8f661573c0ddadff91fa02f567eedec0b0641caa48bf3b504e791e2025523f0ce86c554be7b02c147850462e526b95d320e1c95

Download Submit