2cf21783a33a754223b834c1092f4df60958fbee91409a5d96e8958b1aba77e9

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b2ffd50f58933615942bb03de99bbdc_JaffaCakes118.html
Size

139KB
MD5

4b2ffd50f58933615942bb03de99bbdc
SHA1

135bc5bf57bbd60f2d4afb90659cc94ee386b887
SHA256

2cf21783a33a754223b834c1092f4df60958fbee91409a5d96e8958b1aba77e9
SHA512

345c98a0a743cbafcb7097781440290423bc5769d7b5963d7d8c4d479fc0f1cc9ef9acbee631614abd8a5fac6c3a7425e347c4ce1aacb023a0cd4481f895673b
SSDEEP

3072:Si3EHQ+zAOeyfkMY+BES09JXAnyrZalI+YQ:Si3d+MO7sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe
4592	msedge.exe
4592	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 3528	4592	msedge.exe	83
PID 4592 wrote to memory of 3528	4592	msedge.exe	83
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 5020	4592	msedge.exe	84
PID 4592 wrote to memory of 1056	4592	msedge.exe	85
PID 4592 wrote to memory of 1056	4592	msedge.exe	85
PID 4592 wrote to memory of 3460	4592	msedge.exe	86
PID 4592 wrote to memory of 3460	4592	msedge.exe	86
PID 4592 wrote to memory of 3460	4592	msedge.exe	86
PID 4592 wrote to memory of 3460	4592	msedge.exe	86
PID 4592 wrote to memory of 3460	4592	msedge.exe	86
PID 4592 wrote to memory of 3460	4592	msedge.exe	86
PID 4592 wrote to memory of 3460	4592	msedge.exe	86
PID 4592 wrote to memory of 3460	4592	msedge.exe	86
PID 4592 wrote to memory of 3460	4592	msedge.exe	86
PID 4592 wrote to memory of 3460	4592	msedge.exe	86
PID 4592 wrote to memory of 3460	4592	msedge.exe	86
PID 4592 wrote to memory of 3460	4592	msedge.exe	86
PID 4592 wrote to memory of 3460	4592	msedge.exe	86
PID 4592 wrote to memory of 3460	4592	msedge.exe	86
PID 4592 wrote to memory of 3460	4592	msedge.exe	86
PID 4592 wrote to memory of 3460	4592	msedge.exe	86
PID 4592 wrote to memory of 3460	4592	msedge.exe	86
PID 4592 wrote to memory of 3460	4592	msedge.exe	86
PID 4592 wrote to memory of 3460	4592	msedge.exe	86
PID 4592 wrote to memory of 3460	4592	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4b2ffd50f58933615942bb03de99bbdc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe344246f8,0x7ffe34424708,0x7ffe34424718
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,8678364497345198266,6267590107599234130,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,8678364497345198266,6267590107599234130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,8678364497345198266,6267590107599234130,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8678364497345198266,6267590107599234130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8678364497345198266,6267590107599234130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,8678364497345198266,6267590107599234130,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4d59c7cec07319338c737ba770206b62

SHA1
7ce4d5e70bf1a088678c7af4e37281ebfc5c846b

SHA256
20778366c662236a7fef09b0b218afdf4fd32ffc2e319f13dcd9ac9b0710d7c5

SHA512
eee354ea356a098afef0a40be7e697ccad45fd207b400c0e749ffd3d2e921f84db99580fbd7a62d372620f0843e1f766ca7d65e6f385633e9c0e79f5043fe778

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f9e6978028cc3a92756e238c4e3e6520

SHA1
6fe27c2ed457b8b4ca5a5a08219af679bc0e4253

SHA256
f5e0b9f2144459a0134e271dfc7d0880e8d145c563ea3d629954e777706ab258

SHA512
920fb6c6e74cddd599328e42be781496835496c9cbe7ccda13d41245e91eb1216e14880ff51bbf6eb808be5bd8c52f6009dbd7e8e097434adb2ff782329d6018

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d98aef12c67150e21d872cd709b21f81

SHA1
ebe83bb5ebe5c589e6fd74a210dd08f674f4fb09

SHA256
8f78d6586b92bc8181b414b1126e373e0642e9c88380cc7d99475e47138ab751

SHA512
60c8ca487ad2935f0d7977ae9c28fa1d5ea803cb7b0513d8598f7fffe353a1645f0d4372a382f611fa96d8ac418233dce32ad0e4fb5927f7577dcadbb7c60e06

Download Submit