24e75ac33de089e113960532ce9b70c0661170a5e465da0d67c1552a86b469d4

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 11:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8091e528ac6bf70c0aebc1f5363c5920_JaffaCakes118.html
Size

349KB
MD5

8091e528ac6bf70c0aebc1f5363c5920
SHA1

412887c3489706f18661f151c31d81986664bd3a
SHA256

24e75ac33de089e113960532ce9b70c0661170a5e465da0d67c1552a86b469d4
SHA512

6386479ae76bf9ab1038778dca327d5f8df58c9d371abed1242d4c921dcafd98ef9f2e75e29c834dc3bc4bc48e6fa26d76e6e6a5bc34da10bc3f38634a01b57b
SSDEEP

6144:SEhsMYod+X3oI+YnRsMYod+X3oI+YAsMYod+X3oI+YQ:15d+X3n5d+X3Y5d+X3+

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4148	msedge.exe
4148	msedge.exe
1116	msedge.exe
1116	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1116	msedge.exe
1116	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 2708	1116	msedge.exe	81
PID 1116 wrote to memory of 2708	1116	msedge.exe	81
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 3560	1116	msedge.exe	82
PID 1116 wrote to memory of 4148	1116	msedge.exe	83
PID 1116 wrote to memory of 4148	1116	msedge.exe	83
PID 1116 wrote to memory of 2084	1116	msedge.exe	84
PID 1116 wrote to memory of 2084	1116	msedge.exe	84
PID 1116 wrote to memory of 2084	1116	msedge.exe	84
PID 1116 wrote to memory of 2084	1116	msedge.exe	84
PID 1116 wrote to memory of 2084	1116	msedge.exe	84
PID 1116 wrote to memory of 2084	1116	msedge.exe	84
PID 1116 wrote to memory of 2084	1116	msedge.exe	84
PID 1116 wrote to memory of 2084	1116	msedge.exe	84
PID 1116 wrote to memory of 2084	1116	msedge.exe	84
PID 1116 wrote to memory of 2084	1116	msedge.exe	84
PID 1116 wrote to memory of 2084	1116	msedge.exe	84
PID 1116 wrote to memory of 2084	1116	msedge.exe	84
PID 1116 wrote to memory of 2084	1116	msedge.exe	84
PID 1116 wrote to memory of 2084	1116	msedge.exe	84
PID 1116 wrote to memory of 2084	1116	msedge.exe	84
PID 1116 wrote to memory of 2084	1116	msedge.exe	84
PID 1116 wrote to memory of 2084	1116	msedge.exe	84
PID 1116 wrote to memory of 2084	1116	msedge.exe	84
PID 1116 wrote to memory of 2084	1116	msedge.exe	84
PID 1116 wrote to memory of 2084	1116	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8091e528ac6bf70c0aebc1f5363c5920_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffceff246f8,0x7ffceff24708,0x7ffceff24718
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,5116541639112192934,8035026829256542452,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,5116541639112192934,8035026829256542452,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,5116541639112192934,8035026829256542452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5116541639112192934,8035026829256542452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5116541639112192934,8035026829256542452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,5116541639112192934,8035026829256542452,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4884 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5250ab7a7bc127db0619126c45c094b7

SHA1
7eaad53702751f7f6e9e3de1272803b8ec2c4869

SHA256
9ee1e14f93d858a750e6ef24c8eb9e89c6ae07f1eb22137a97060ff13fc436f3

SHA512
2c5d54f3dcb68b4354dfd449a53cd406d502df30e0727b480253d397a58b72014964196c18d7a74838354c059a44cdce8c25e4771fe9addb50d75d728f1fe1b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d8c3f73ff09bed1299d53eb9fdcc1c31

SHA1
134985e19b0f72196a9158ff5802a88e57d7b0b5

SHA256
5a03c9d1679295fcc7785ba457bacb73d2c1619eaa3674a200a44e13fa7a3e51

SHA512
392be6f5f927970a9a66cbe0a9f763e85d06e085dc5bf347656d2e762b0ef83ffc0dce368bbf2568cf9d9e01efca36c4906c620bab1b0d89aa7870583caea0c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
93274d4a4d3a94f354faa40cce86ac94

SHA1
4467310387c173feca46fd6486ceb1b7b5fe3f81

SHA256
2dc943f02a8bb5f4b67d04d567d6e471019c96dec48b496944c25cab342f8dc7

SHA512
773f76f20a11749ab437655ad0435689a759cb87184e71324b7a9b3a32c2b9dffbe8815508f873aa7aeb0c638dff48802cfa38de30dce086459291c1a67b43de

Download Submit