b24e3c62a381bb90af79b3b18159dab628277bb28415aac9eec431110d8c89b8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 02:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f2ee9c9ed97864d914e30299af0a0ad_JaffaCakes118.html
Size

214KB
MD5

7f2ee9c9ed97864d914e30299af0a0ad
SHA1

86f77ebe2d906fefd796130ef7b881c250a03c86
SHA256

b24e3c62a381bb90af79b3b18159dab628277bb28415aac9eec431110d8c89b8
SHA512

6effdcf37b5873c56c7b38c9e7e9f446c6732f019faf47105a31301e65ac27481965f752dc5bcd7b32789f26eef32a51035f67c345be0f46f0c5803d0ee241e3
SSDEEP

3072:YrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJT:Az9VxLY7iAVLTBQJlT

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1440	msedge.exe
1440	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 388	1440	msedge.exe	83
PID 1440 wrote to memory of 388	1440	msedge.exe	83
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 4216	1440	msedge.exe	84
PID 1440 wrote to memory of 1524	1440	msedge.exe	85
PID 1440 wrote to memory of 1524	1440	msedge.exe	85
PID 1440 wrote to memory of 3316	1440	msedge.exe	86
PID 1440 wrote to memory of 3316	1440	msedge.exe	86
PID 1440 wrote to memory of 3316	1440	msedge.exe	86
PID 1440 wrote to memory of 3316	1440	msedge.exe	86
PID 1440 wrote to memory of 3316	1440	msedge.exe	86
PID 1440 wrote to memory of 3316	1440	msedge.exe	86
PID 1440 wrote to memory of 3316	1440	msedge.exe	86
PID 1440 wrote to memory of 3316	1440	msedge.exe	86
PID 1440 wrote to memory of 3316	1440	msedge.exe	86
PID 1440 wrote to memory of 3316	1440	msedge.exe	86
PID 1440 wrote to memory of 3316	1440	msedge.exe	86
PID 1440 wrote to memory of 3316	1440	msedge.exe	86
PID 1440 wrote to memory of 3316	1440	msedge.exe	86
PID 1440 wrote to memory of 3316	1440	msedge.exe	86
PID 1440 wrote to memory of 3316	1440	msedge.exe	86
PID 1440 wrote to memory of 3316	1440	msedge.exe	86
PID 1440 wrote to memory of 3316	1440	msedge.exe	86
PID 1440 wrote to memory of 3316	1440	msedge.exe	86
PID 1440 wrote to memory of 3316	1440	msedge.exe	86
PID 1440 wrote to memory of 3316	1440	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7f2ee9c9ed97864d914e30299af0a0ad_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0xd8,0x104,0xfc,0x108,0x7ffdc65f46f8,0x7ffdc65f4708,0x7ffdc65f4718
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,17740392635569253411,5315115271924441254,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,17740392635569253411,5315115271924441254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,17740392635569253411,5315115271924441254,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17740392635569253411,5315115271924441254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17740392635569253411,5315115271924441254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,17740392635569253411,5315115271924441254,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4928 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
09bc66c367142695d9de4d5c776ea203

SHA1
7f9dd9dcdb33e425ad7abcbef8aac21a0086b908

SHA256
8084e7a2a61e02d45780460741fc039555c8af601312b572c3e8dc8a54fa9d43

SHA512
f34415342b8c29b46b8e22a324c575ea9d48e4023060e097ff6038f094fa0308e2824e9a8f5e7f59cf6a912540ed5311fbed8d6c7b4653c51f5eabba66ab6427

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8bb12407d489d7f5317f9aae74fc3375

SHA1
bb2f549b4ccad4269bf7e07c61e6c9e69dfbc49e

SHA256
f82d7bebefecdbb5870e93a0059711752cd5c41f1eecd0f9b8d80b3791a80b18

SHA512
aef0af996638a0d21650eac5d06b970f68e3ad5e62e7e118d1f781f0917cedcc4a2086ec15439b4b11564aef43f2c00ce99574d834f764890198212cd15d2ee9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4d80e947826861f63153712d17868a09

SHA1
d3d9b0120fd7d4ada99814b8170d182b6e0f6e78

SHA256
41d8ea1c7a9ada695fef92c02d6b278c324974809b6bd37e97e4140722397f2e

SHA512
cd22cb1447fba9b76333fdc410ebfc97e51d98ada167f047238379116b126c7f841b8a1bd8f20a4b4be8d0896fe69864ce7fc351cf82409838ce1466829129b0

Download Submit