e02fb042af18c8a1b865d286a52d823a414cc0222d6e8564c2ce8cd23dc81a39

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 13:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f701c97f7efc2c2251a552242fcbafa_JaffaCakes118.html
Size

139KB
MD5

2f701c97f7efc2c2251a552242fcbafa
SHA1

7e890b15d69798be5a2f47d5b8cfb9dc323e82e6
SHA256

e02fb042af18c8a1b865d286a52d823a414cc0222d6e8564c2ce8cd23dc81a39
SHA512

85f5aaaae929c66cf49390591487de187f94b64488c573433b5fc8c742806866538e7d80007bb621c3dfa3bbbb96bd9710cd73beafc754b8b00613a538853d29
SSDEEP

1536:SKAvIlWg94+UJMwl9yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3p:SKAzzyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
744	msedge.exe
744	msedge.exe
1092	msedge.exe
1092	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1092	msedge.exe
1092	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 2168	1092	msedge.exe	82
PID 1092 wrote to memory of 2168	1092	msedge.exe	82
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 2964	1092	msedge.exe	84
PID 1092 wrote to memory of 744	1092	msedge.exe	85
PID 1092 wrote to memory of 744	1092	msedge.exe	85
PID 1092 wrote to memory of 4964	1092	msedge.exe	86
PID 1092 wrote to memory of 4964	1092	msedge.exe	86
PID 1092 wrote to memory of 4964	1092	msedge.exe	86
PID 1092 wrote to memory of 4964	1092	msedge.exe	86
PID 1092 wrote to memory of 4964	1092	msedge.exe	86
PID 1092 wrote to memory of 4964	1092	msedge.exe	86
PID 1092 wrote to memory of 4964	1092	msedge.exe	86
PID 1092 wrote to memory of 4964	1092	msedge.exe	86
PID 1092 wrote to memory of 4964	1092	msedge.exe	86
PID 1092 wrote to memory of 4964	1092	msedge.exe	86
PID 1092 wrote to memory of 4964	1092	msedge.exe	86
PID 1092 wrote to memory of 4964	1092	msedge.exe	86
PID 1092 wrote to memory of 4964	1092	msedge.exe	86
PID 1092 wrote to memory of 4964	1092	msedge.exe	86
PID 1092 wrote to memory of 4964	1092	msedge.exe	86
PID 1092 wrote to memory of 4964	1092	msedge.exe	86
PID 1092 wrote to memory of 4964	1092	msedge.exe	86
PID 1092 wrote to memory of 4964	1092	msedge.exe	86
PID 1092 wrote to memory of 4964	1092	msedge.exe	86
PID 1092 wrote to memory of 4964	1092	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2f701c97f7efc2c2251a552242fcbafa_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97d9546f8,0x7ff97d954708,0x7ff97d954718
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,101457270277688998,16716388193267040798,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,101457270277688998,16716388193267040798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,101457270277688998,16716388193267040798,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,101457270277688998,16716388193267040798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,101457270277688998,16716388193267040798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,101457270277688998,16716388193267040798,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3008 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
56468c9fe9903b946348ba37725ce7d1

SHA1
eed1dd85a9c5f98f1b742dedb95553e46d79db9d

SHA256
cc5aaa2696ddab092325a06a039ce61d8f01e4bfb6a7235f43e3e6a15881a34a

SHA512
390b4ac54a5a97969be7a55d18131c88e261653ccf5d7c1dae564bb4aacbaeed874c56e8da2f9ec8d69ec631a42d84644dda144289d99849bc619827df87d082

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
80eb9567e486d3dd5984a1375886852c

SHA1
6f77da80e966ef8487952c191e762fdaa8ee7f31

SHA256
b127f5e3d2765fe0ed4682307d3f741a03ecb13dda4490e2e199f3c6a4deae91

SHA512
14299dacc88bff62819fce8a1221430eaf157e7a611a7be118d64f6000fde20cdc3f66c4929a70ecd86611b38acad7433e085eabd220454fa3d2bb1236c5627d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dfc8f5b50b3e0b8341ddf409bb0011cb

SHA1
ccd218a0892a8031e68ee7d8b3089a1da0027a47

SHA256
40281f1cc703596b15cd4239b45553106ae729200ce2fc24fc34f7b1d2271a88

SHA512
99aa45107215e67c00dc2837ae8859d3b725c6234d345da1243214e134e8c013372a1e79b09abbd503c5f33c4fe5cf4c2b8e20d4ca74deae9c52d9a996a8e451

Download Submit