e68bfdc19e9de883637f0bad2efed48a08e9f1def191ba2abaebe6e7da4f0141

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 13:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80dd6479b268ad89cb0451a1f46b5b55_JaffaCakes118.html
Size

349KB
MD5

80dd6479b268ad89cb0451a1f46b5b55
SHA1

2a67a288fbc3bbc9c9b3a241d5db8c0db79e16fa
SHA256

e68bfdc19e9de883637f0bad2efed48a08e9f1def191ba2abaebe6e7da4f0141
SHA512

76063ce23d5f13fbdf43b1fc6981b6ac9cc085c32ea512d4c21ce5daa6758f61642de27af901299461b3c5650af8f7ea2047c320fa379868b711efd35d60e0c5
SSDEEP

6144:SzsMYod+X3oI+YSHlsMYod+X3oI+YAsMYod+X3oI+YQ:m5d+X3O5d+X3Y5d+X3+

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
4480	msedge.exe
4480	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4480	msedge.exe
4480	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 2324	4480	msedge.exe	81
PID 4480 wrote to memory of 2324	4480	msedge.exe	81
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 1476	4480	msedge.exe	82
PID 4480 wrote to memory of 3404	4480	msedge.exe	83
PID 4480 wrote to memory of 3404	4480	msedge.exe	83
PID 4480 wrote to memory of 3232	4480	msedge.exe	84
PID 4480 wrote to memory of 3232	4480	msedge.exe	84
PID 4480 wrote to memory of 3232	4480	msedge.exe	84
PID 4480 wrote to memory of 3232	4480	msedge.exe	84
PID 4480 wrote to memory of 3232	4480	msedge.exe	84
PID 4480 wrote to memory of 3232	4480	msedge.exe	84
PID 4480 wrote to memory of 3232	4480	msedge.exe	84
PID 4480 wrote to memory of 3232	4480	msedge.exe	84
PID 4480 wrote to memory of 3232	4480	msedge.exe	84
PID 4480 wrote to memory of 3232	4480	msedge.exe	84
PID 4480 wrote to memory of 3232	4480	msedge.exe	84
PID 4480 wrote to memory of 3232	4480	msedge.exe	84
PID 4480 wrote to memory of 3232	4480	msedge.exe	84
PID 4480 wrote to memory of 3232	4480	msedge.exe	84
PID 4480 wrote to memory of 3232	4480	msedge.exe	84
PID 4480 wrote to memory of 3232	4480	msedge.exe	84
PID 4480 wrote to memory of 3232	4480	msedge.exe	84
PID 4480 wrote to memory of 3232	4480	msedge.exe	84
PID 4480 wrote to memory of 3232	4480	msedge.exe	84
PID 4480 wrote to memory of 3232	4480	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\80dd6479b268ad89cb0451a1f46b5b55_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb65e346f8,0x7ffb65e34708,0x7ffb65e34718
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,9474529925417296341,16556740266987832200,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,9474529925417296341,16556740266987832200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,9474529925417296341,16556740266987832200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9474529925417296341,16556740266987832200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9474529925417296341,16556740266987832200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,9474529925417296341,16556740266987832200,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
09c65c0f82960f5c5e7197012e1658ed

SHA1
93ac88d3e02ab3e1d1b44403ea33b5ea09ca0dfd

SHA256
94d5ae714c0585cd91241fa86e8f98bec74636640042257cbeae2d31c83e37aa

SHA512
c9cf4adb61329b8c73a852258573d172a600819eefa76beeba6d2c648d88d0e95e9d7a47190c96a052b5793765f8a601898b721307b50f3df071882f0e299a24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a2c6e2fbeba4f49539d7784f6b692d29

SHA1
55a44a98705467dcc254334660b1e1a33cdefd9f

SHA256
8f8939cd1b43315a27860aa26846f08213c97321a59b565d15071d9099c815b8

SHA512
fccfbe19cc073b1284bf206119be6910fb392a9eed54d2d43d3a4d12b546012e6a00d9e220f72b3994aff8ae394d2b8670befd62099dafadd7b7dd89855e1520

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8adf05179348b377f3f43b0fbe908416

SHA1
dba7b95a335da3d4e1f9dd1413ac2b13f9962a21

SHA256
16a20f4e177ccc437d931ad5ff3221895037a76c90f00a09070bcaefe41921fa

SHA512
02c6b56809fffe1ed6de71853f2bbfd5eb1e76d9a2c275b2e122ed4fd5d9da3352bf5a8f485570de4f55ce04d353d0d8a31af8edf9a6ec1a6144d3a425995dd7

Download Submit