e05d362ed33a0b4790da32fb12148a70cd224583eabe2d5df09565ae5c1e5a94

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2dbc32de62d1e60464454e6dc2ba91ec_JaffaCakes118.html
Size

20KB
MD5

2dbc32de62d1e60464454e6dc2ba91ec
SHA1

51bc907d794377f534287f359027ad81b3c3be93
SHA256

e05d362ed33a0b4790da32fb12148a70cd224583eabe2d5df09565ae5c1e5a94
SHA512

49795d47d627e6019eb482bda97781c1bd8e80597e37c1a83ed2a33cf5f03982defcea884de9ded14fbbe9bf5012002b7d21a9c03663df5ba3b523462499d075
SSDEEP

384:STpPIAZ6EeVYR8e0eeVveGeQsbevgeVOef1GwJx/fwm4RStDthAJ:SxZ6EeiR8e0eeBeGeQKevgeMefH/fl41

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
464	msedge.exe
464	msedge.exe
4092	msedge.exe
4092	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4092	msedge.exe
4092	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 3032	4092	msedge.exe	81
PID 4092 wrote to memory of 3032	4092	msedge.exe	81
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 4848	4092	msedge.exe	82
PID 4092 wrote to memory of 464	4092	msedge.exe	83
PID 4092 wrote to memory of 464	4092	msedge.exe	83
PID 4092 wrote to memory of 1700	4092	msedge.exe	84
PID 4092 wrote to memory of 1700	4092	msedge.exe	84
PID 4092 wrote to memory of 1700	4092	msedge.exe	84
PID 4092 wrote to memory of 1700	4092	msedge.exe	84
PID 4092 wrote to memory of 1700	4092	msedge.exe	84
PID 4092 wrote to memory of 1700	4092	msedge.exe	84
PID 4092 wrote to memory of 1700	4092	msedge.exe	84
PID 4092 wrote to memory of 1700	4092	msedge.exe	84
PID 4092 wrote to memory of 1700	4092	msedge.exe	84
PID 4092 wrote to memory of 1700	4092	msedge.exe	84
PID 4092 wrote to memory of 1700	4092	msedge.exe	84
PID 4092 wrote to memory of 1700	4092	msedge.exe	84
PID 4092 wrote to memory of 1700	4092	msedge.exe	84
PID 4092 wrote to memory of 1700	4092	msedge.exe	84
PID 4092 wrote to memory of 1700	4092	msedge.exe	84
PID 4092 wrote to memory of 1700	4092	msedge.exe	84
PID 4092 wrote to memory of 1700	4092	msedge.exe	84
PID 4092 wrote to memory of 1700	4092	msedge.exe	84
PID 4092 wrote to memory of 1700	4092	msedge.exe	84
PID 4092 wrote to memory of 1700	4092	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2dbc32de62d1e60464454e6dc2ba91ec_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0ee646f8,0x7ffa0ee64708,0x7ffa0ee64718
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,8392227662887903382,16127437705381714331,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,8392227662887903382,16127437705381714331,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,8392227662887903382,16127437705381714331,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8392227662887903382,16127437705381714331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8392227662887903382,16127437705381714331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,8392227662887903382,16127437705381714331,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4900 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb4c3c069ea622684221c10ef8acb23f

SHA1
2050d93d6db2e64d062d4d4881205267037fbea0

SHA256
a33d72cc42de210fe6065c81f1c969abbaeb8a2224b01691e60fa17c09d8f58d

SHA512
0e73ca9774fd4b574d46d01b854056edf057c8d14e72bbb4bae3854120ab187205b7f13255497caf7ad844f2c440f6c3d5294efc5f10a91a36dcf8c76eedf678

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b9569092c17c912068fc6015465c1b5d

SHA1
1eb7e6545318a4c9be4a0b4f33ff066c36c8510a

SHA256
3cf956f13a89a525fda8e9ef1d10a164f1292f12552a21b9c6493773326384ec

SHA512
d475dd4738d6a454395387ee78f8d232ebc2bd74f9f44cb552100f34e4a1f7e45fb17b911086e1a64a4b43a531a8592c3c720946c6661bd3cf30e018df6e3d54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4df3981fbd328a79bdaf4da269291a01

SHA1
f8f7e02de554f756d27be85be8f3f82b3db5e697

SHA256
e8d53ce350aa7fd5e3c545d6ccaa25d5e32b8c6805c2fcd509aa54dc1a2c4ff7

SHA512
4efecb0d9f59e8b1077ffaebd2fc3eaf9f6b58db6956ea930c86a2fee192175d14ce380a81bcfbad82b8cc75462ad82bd1999e2df65e9460a568233acc30948b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5ce9a2166668e8fb2ece7bae5b6e370f

SHA1
8c216396b2e38dc03b19ada7f580c2614996d966

SHA256
fe06aa1dfa6423f3b2ad0de772917616c0f7e88ba58c7d84b31611288efedccf

SHA512
3d9d01cce21ef46391ad08b0c281f8dda10cd34a7752aa828a00b3c4f274b9bf4dba3584ac9b244eb5d310502c07b54203c2d1d648fbc882f3e79ab3897e15f7

Download Submit