b2d2610830d2d1319f2d6ef72f4e4380ee9bd03c2daca62cbc2da9db4c8d5494

Analysis

max time kernel
135s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 22:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6124b4e4b9441e5d0501af3ca1ce277d_JaffaCakes118.html
Size

35KB
MD5

6124b4e4b9441e5d0501af3ca1ce277d
SHA1

c9d5f65d0ab46cccc2f2063d390a6e617ff82e8f
SHA256

b2d2610830d2d1319f2d6ef72f4e4380ee9bd03c2daca62cbc2da9db4c8d5494
SHA512

bb48479a0d69ba19f44040f4f7b80865e2c18b1651898faefeeb98e138592a56cb2c4d3f23dee1f4802aeebf2f998970636a122261e5d50036385698c0eeabe8
SSDEEP

768:SdsfaYT//ysnzNm9F18Hc9snzNm9F18HVAv12CSTUcpeY39zJZris0pvicWID4fD:Sd2aYT//ysnzNm9F18Hc9snzNm9F18Hl

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3768	msedge.exe
3768	msedge.exe
1256	msedge.exe
1256	msedge.exe
1852	identity_helper.exe
1852	identity_helper.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 1064	1256	msedge.exe	82
PID 1256 wrote to memory of 1064	1256	msedge.exe	82
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 1980	1256	msedge.exe	85
PID 1256 wrote to memory of 3768	1256	msedge.exe	86
PID 1256 wrote to memory of 3768	1256	msedge.exe	86
PID 1256 wrote to memory of 1004	1256	msedge.exe	87
PID 1256 wrote to memory of 1004	1256	msedge.exe	87
PID 1256 wrote to memory of 1004	1256	msedge.exe	87
PID 1256 wrote to memory of 1004	1256	msedge.exe	87
PID 1256 wrote to memory of 1004	1256	msedge.exe	87
PID 1256 wrote to memory of 1004	1256	msedge.exe	87
PID 1256 wrote to memory of 1004	1256	msedge.exe	87
PID 1256 wrote to memory of 1004	1256	msedge.exe	87
PID 1256 wrote to memory of 1004	1256	msedge.exe	87
PID 1256 wrote to memory of 1004	1256	msedge.exe	87
PID 1256 wrote to memory of 1004	1256	msedge.exe	87
PID 1256 wrote to memory of 1004	1256	msedge.exe	87
PID 1256 wrote to memory of 1004	1256	msedge.exe	87
PID 1256 wrote to memory of 1004	1256	msedge.exe	87
PID 1256 wrote to memory of 1004	1256	msedge.exe	87
PID 1256 wrote to memory of 1004	1256	msedge.exe	87
PID 1256 wrote to memory of 1004	1256	msedge.exe	87
PID 1256 wrote to memory of 1004	1256	msedge.exe	87
PID 1256 wrote to memory of 1004	1256	msedge.exe	87
PID 1256 wrote to memory of 1004	1256	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6124b4e4b9441e5d0501af3ca1ce277d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffccfeb46f8,0x7ffccfeb4708,0x7ffccfeb4718
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,16716969470645813540,252679449972710390,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,16716969470645813540,252679449972710390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,16716969470645813540,252679449972710390,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,16716969470645813540,252679449972710390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,16716969470645813540,252679449972710390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,16716969470645813540,252679449972710390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,16716969470645813540,252679449972710390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,16716969470645813540,252679449972710390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,16716969470645813540,252679449972710390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,16716969470645813540,252679449972710390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,16716969470645813540,252679449972710390,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,16716969470645813540,252679449972710390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,16716969470645813540,252679449972710390,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,16716969470645813540,252679449972710390,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4120 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
469B

MD5
0a2ccce5c493de429f3c9f9d2ef0f3e5

SHA1
d23132a966faa46ad4516f1395ad22f8dea724e1

SHA256
923e16447b39d1ff1fa0284f4b7aeb9474efd135aba8dfb3a15accad6a5dfed6

SHA512
2a663cdbfa15771b18474d951dadb96bb1259ba42524a0b266f9a8c22aec74c50b0942cc0236ccc4afa077d53bd00c668be1b6a395a7202aca80004989757a1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8a143d31edb89c580967fe8b9fd48695

SHA1
3990058654bd98042957424ea1a76298fc7fc428

SHA256
86b7d601cdfaf0153c13171c6a7624a9beab8d406d0748c007fe836176693761

SHA512
29dd1ee6ffafa552225cb8e80b61c5427d9049978f519e2f13842140b402b2abbb599f6826c3f5481af60438ff136c7ef3483406e1e8ce53d27e254bfae9dd92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8c957652a4f9bb86d4895512a422d886

SHA1
ac3d4589a3123188d0d66ea15aac9a2a615221aa

SHA256
9e2ccbf4fdce5b8cb5fda4d531808d0cb25d90501471a90d66013f38306a458a

SHA512
26e20cc576a15f4637edb0807b8f260c96c32581582dbb0becdebcc93d988c634c3086b2d29f06ce69d7f2c33f1729f7684ebcc287d991d25ac0c59c67611fca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
42de285edd6fe10c29c8a62d0df93af2

SHA1
8e4d49cd12482be9f2be2cbaa863998898e8b74d

SHA256
9269d3cf71e72c8c4c2b128f98a5bb731fb4183c7095928a3b0c3e1774eb81da

SHA512
78dd29b6b4b2f765dfe50afdd662b20941728ea42d2e3fdae58edecbdf718b3d89c1b9c9f82742eacb5ad6570a7ef040622d6ae9766523119d464ebcc87160a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8d1e23530ac027ea15a3545e4fd021e9

SHA1
bed16741e6c1bdd7aa48232de2c752d97b5de8c4

SHA256
b2f84610a232580b3a339e1266bd631a65405122d0b12cc565fd4ca9a5b49510

SHA512
57183095f6f30c5e08d566c377a267aa0550e52d7ad7389019f61a8e092667c9d598fec298b7fb2f4175fc071d2cf9600ba2f19f83f0a9b512f154336aaf3b84

Download Submit