2ee94f7422be03036fae0ddf0d813f7fea44e7e334999e8c9698d781ac2c71a3

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 20:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8f3f1873c85643d168f2e8d4c6052839_JaffaCakes118.html
Size

19KB
MD5

8f3f1873c85643d168f2e8d4c6052839
SHA1

a6a4e881d68b79a3468fd217c121e4796f079411
SHA256

2ee94f7422be03036fae0ddf0d813f7fea44e7e334999e8c9698d781ac2c71a3
SHA512

b47e27c066ef6990afa08b89b258a7079c0e35f05a6e0b46a24333eba6d1a724bfc9a255ec69a8fb2d4b6902adb61f9a2e7af2130e1160da7ee9964883561a49
SSDEEP

384:SIMd0I5nvHWxlBxtzDjrR6tA8svYkAlxDB8:SEzxlBxtzDjrR6tA8JvlA

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2068	msedge.exe
2068	msedge.exe
2324	msedge.exe
2324	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2324	msedge.exe
2324	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2496	2324	msedge.exe	83
PID 2324 wrote to memory of 2496	2324	msedge.exe	83
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 516	2324	msedge.exe	84
PID 2324 wrote to memory of 2068	2324	msedge.exe	85
PID 2324 wrote to memory of 2068	2324	msedge.exe	85
PID 2324 wrote to memory of 3368	2324	msedge.exe	86
PID 2324 wrote to memory of 3368	2324	msedge.exe	86
PID 2324 wrote to memory of 3368	2324	msedge.exe	86
PID 2324 wrote to memory of 3368	2324	msedge.exe	86
PID 2324 wrote to memory of 3368	2324	msedge.exe	86
PID 2324 wrote to memory of 3368	2324	msedge.exe	86
PID 2324 wrote to memory of 3368	2324	msedge.exe	86
PID 2324 wrote to memory of 3368	2324	msedge.exe	86
PID 2324 wrote to memory of 3368	2324	msedge.exe	86
PID 2324 wrote to memory of 3368	2324	msedge.exe	86
PID 2324 wrote to memory of 3368	2324	msedge.exe	86
PID 2324 wrote to memory of 3368	2324	msedge.exe	86
PID 2324 wrote to memory of 3368	2324	msedge.exe	86
PID 2324 wrote to memory of 3368	2324	msedge.exe	86
PID 2324 wrote to memory of 3368	2324	msedge.exe	86
PID 2324 wrote to memory of 3368	2324	msedge.exe	86
PID 2324 wrote to memory of 3368	2324	msedge.exe	86
PID 2324 wrote to memory of 3368	2324	msedge.exe	86
PID 2324 wrote to memory of 3368	2324	msedge.exe	86
PID 2324 wrote to memory of 3368	2324	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8f3f1873c85643d168f2e8d4c6052839_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0ddf46f8,0x7ffc0ddf4708,0x7ffc0ddf4718
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15773091286024500876,8019005660429552275,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,15773091286024500876,8019005660429552275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,15773091286024500876,8019005660429552275,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15773091286024500876,8019005660429552275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15773091286024500876,8019005660429552275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15773091286024500876,8019005660429552275,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1292 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f50a47887bb09cfa4ad815f029ba3a24

SHA1
ce6bbc2aae2ba9ce807a1133dfe5c297191f7928

SHA256
16641b5f406d6c29689f9d37808de283be7800ad87c46c7d5366934fb43b8b88

SHA512
51bf453d54555c4f22134e7eca34a5ca514ab94f82e1a4a46075d27f523e8ce727f4d313d39d1f2da088b9a68cd2c9fc23538d71600d1158cb87a6df27b0d3e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d86546c540bfc9f044efbe55b4ff160f

SHA1
751378517fcc9a883da5f190a75b70e5b9c36d19

SHA256
743ef133a639fe641851595f4dbfd6e251215e999969d15a0c2f35372f476b96

SHA512
2d4d8e0bb55a9bb6e9596b697939fdfac81d60acc71502b2ae291fe555ac7e024e376c994be08500735a1a239012d2bb8b2cf401551a80a014492ca7956f933d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
85d094a5819d2f44907325b451855982

SHA1
8694d81f1ba934de4aeb820a6a29757772e3851b

SHA256
920d7aa5aac008b2d6337bf57eb45e5694e6585614ddb2745118f0798cfd9b7c

SHA512
6f601404cd0d8dbc6e298f6e7f6d85ec36613486e5846428a5f28ab40a2894c335b4547e8d375df127c55f3dd328833b9e794745a19b0fde7fe2c2ca9074b27b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
03d491c6c8d06ad60dd05d9519a9d6b3

SHA1
940aae9ec420fb39b99f764f76fd7f8b33e68372

SHA256
4d538617180d979e828a99b616ff192ad49bef6feba992a6f9c98306fe026a75

SHA512
cacd1025bda08daebee58c4f8074f155875b6ed97ff7684a85866b0a814c029e20e4459b26cee98e00df77db1e8fae534d85385e292070a2cdfb385c3e269d85

Download Submit