5f7126449f9d3ff412b49398c16ba3138ad6f7a4158ffd2763a916bf720a8789

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 11:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39d935bb40cbe2590a38b0d23a803644_JaffaCakes118.html
Size

386KB
MD5

39d935bb40cbe2590a38b0d23a803644
SHA1

4dbceaef0ab63b49529d54f791d19ae55735040b
SHA256

5f7126449f9d3ff412b49398c16ba3138ad6f7a4158ffd2763a916bf720a8789
SHA512

1a747b9c88ef2d41b86802c949deb84a47a9ac7c4ff35c97ebf291fa95814b0bad23595b3d47b378c3ffe780d91f6d75705b3b695524a1f95a1d13bb4cd1ecdb
SSDEEP

6144:Sx+sMYod+X3oI+YIsMYod+X3oI+YLsMYod+X3oI+YQ:j5d+X3M5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2620	msedge.exe
2620	msedge.exe
2084	msedge.exe
2084	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2084	msedge.exe
2084	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 536	2084	msedge.exe	82
PID 2084 wrote to memory of 536	2084	msedge.exe	82
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 5080	2084	msedge.exe	85
PID 2084 wrote to memory of 2620	2084	msedge.exe	86
PID 2084 wrote to memory of 2620	2084	msedge.exe	86
PID 2084 wrote to memory of 5060	2084	msedge.exe	87
PID 2084 wrote to memory of 5060	2084	msedge.exe	87
PID 2084 wrote to memory of 5060	2084	msedge.exe	87
PID 2084 wrote to memory of 5060	2084	msedge.exe	87
PID 2084 wrote to memory of 5060	2084	msedge.exe	87
PID 2084 wrote to memory of 5060	2084	msedge.exe	87
PID 2084 wrote to memory of 5060	2084	msedge.exe	87
PID 2084 wrote to memory of 5060	2084	msedge.exe	87
PID 2084 wrote to memory of 5060	2084	msedge.exe	87
PID 2084 wrote to memory of 5060	2084	msedge.exe	87
PID 2084 wrote to memory of 5060	2084	msedge.exe	87
PID 2084 wrote to memory of 5060	2084	msedge.exe	87
PID 2084 wrote to memory of 5060	2084	msedge.exe	87
PID 2084 wrote to memory of 5060	2084	msedge.exe	87
PID 2084 wrote to memory of 5060	2084	msedge.exe	87
PID 2084 wrote to memory of 5060	2084	msedge.exe	87
PID 2084 wrote to memory of 5060	2084	msedge.exe	87
PID 2084 wrote to memory of 5060	2084	msedge.exe	87
PID 2084 wrote to memory of 5060	2084	msedge.exe	87
PID 2084 wrote to memory of 5060	2084	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\39d935bb40cbe2590a38b0d23a803644_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe41846f8,0x7fffe4184708,0x7fffe4184718
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,16398688906515652984,7203727215717924917,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,16398688906515652984,7203727215717924917,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,16398688906515652984,7203727215717924917,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,16398688906515652984,7203727215717924917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,16398688906515652984,7203727215717924917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,16398688906515652984,7203727215717924917,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6fd0bbf5-c4c0-4ab5-b177-7d072f2c70d7.tmp

Filesize
5KB

MD5
67cbe4d76403cba89c698c63bcecabc4

SHA1
ecb50a80189568a9b86d21b36eef3bcf48d0e5aa

SHA256
200d8b29d57b01f282ac06f17cdb5f24757859d3ddd512e0fa3e88fcb1a9829c

SHA512
ee7eefdf77b28d784d18ca4ff4130c0700b619abf33b07a3e5721181b884c8f748844bf3913ca054ba7bb01c8ffb4cb8f128c42b3a9a7842e4adb0f9fc7f2f01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ba89f2886b5108cd85541bd608832d86

SHA1
89b7d00b8dd004e8bc24da6b6c533bc4f30c7dad

SHA256
9d57d61d416dde7f41bb3c6536df1a99f9cf6de6eba1b4ecc2bd2eac67990580

SHA512
4075fff427ab4bc54c14bf43c84544271fd90a0e367af4f01af799c9adf9650620b4af03ee68993ebd7f7ab1f8fc5f5b42250109df11617d0b5fd48a9e07f916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
25226c682ef3758e124c15ef3574350b

SHA1
431384ef45c66737ba2a5e01b041716f9526b807

SHA256
f71b61fcb9b63b468143267c9ddea2539bd4e29ce1321541ca8599fb63191ef3

SHA512
ce01afde4812ec75d312494055e214565474c85761d105d2dd6f139f2ca9d5c4a7cb0fa75c36d70f50985cf2adbb87b0155fcbec139ccb46d47df0f8e7546314

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
03d7b7b92354a9f081740c86b3ebba20

SHA1
41ef69b263706478acb8d937f0211894a22d5f6d

SHA256
b0ebe2fc49cec484e846238712a738034b076268a4537d6072ab5f0c34670131

SHA512
44eef148464be22c302537326e507a250463dc16963f2429034b1b0668808c20e34ef0e6135dc1f395c520ee3fb2bb54d00c1e799807e889d35217e5c5c35d2c

Download Submit