31fda3358eb1ea7fd38c380712e9400351c758138a2162b71a55d75d4c008a35

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f520b5eb1b2adf0e575dedf7f54094f_JaffaCakes118.html
Size

12KB
MD5

9f520b5eb1b2adf0e575dedf7f54094f
SHA1

a55fb747109588d41508ec84f09b1859c877ccab
SHA256

31fda3358eb1ea7fd38c380712e9400351c758138a2162b71a55d75d4c008a35
SHA512

5f4a9ad8cd49e0e6bfaae4bc9150a9e2477258c9273794b8f02759b3d195d804e80cdd17f5d1aae52e91efedfa7ad0257019a6a9298702b680e5cc4c239bcb58
SSDEEP

192:SIDXx+cynvyd+6+FQRUEVVyaV2pPXHBmd+hLUuS:SIFTyn6U0VVVaXHgohLUuS

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
4512	msedge.exe
4512	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 3104	4512	msedge.exe	82
PID 4512 wrote to memory of 3104	4512	msedge.exe	82
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 512	4512	msedge.exe	84
PID 4512 wrote to memory of 4164	4512	msedge.exe	85
PID 4512 wrote to memory of 4164	4512	msedge.exe	85
PID 4512 wrote to memory of 2900	4512	msedge.exe	86
PID 4512 wrote to memory of 2900	4512	msedge.exe	86
PID 4512 wrote to memory of 2900	4512	msedge.exe	86
PID 4512 wrote to memory of 2900	4512	msedge.exe	86
PID 4512 wrote to memory of 2900	4512	msedge.exe	86
PID 4512 wrote to memory of 2900	4512	msedge.exe	86
PID 4512 wrote to memory of 2900	4512	msedge.exe	86
PID 4512 wrote to memory of 2900	4512	msedge.exe	86
PID 4512 wrote to memory of 2900	4512	msedge.exe	86
PID 4512 wrote to memory of 2900	4512	msedge.exe	86
PID 4512 wrote to memory of 2900	4512	msedge.exe	86
PID 4512 wrote to memory of 2900	4512	msedge.exe	86
PID 4512 wrote to memory of 2900	4512	msedge.exe	86
PID 4512 wrote to memory of 2900	4512	msedge.exe	86
PID 4512 wrote to memory of 2900	4512	msedge.exe	86
PID 4512 wrote to memory of 2900	4512	msedge.exe	86
PID 4512 wrote to memory of 2900	4512	msedge.exe	86
PID 4512 wrote to memory of 2900	4512	msedge.exe	86
PID 4512 wrote to memory of 2900	4512	msedge.exe	86
PID 4512 wrote to memory of 2900	4512	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9f520b5eb1b2adf0e575dedf7f54094f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb611046f8,0x7ffb61104708,0x7ffb61104718
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,11463995083591630860,245431540835846099,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,11463995083591630860,245431540835846099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2592 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,11463995083591630860,245431540835846099,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,11463995083591630860,245431540835846099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,11463995083591630860,245431540835846099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,11463995083591630860,245431540835846099,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4384 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
50331f7e1caca8084e4fa41b38650c5d

SHA1
558b451bb0bc70adc9f4e3570ac320a59e05c124

SHA256
3d72ba2e89d636c4794a3cef85637b8341bbc99d3303c12bb34d2eb4481c6c32

SHA512
776efc040a6f2505b358830f16671e3a62db7f2580dc5d7926a776c39fab5ac303434a1360df66eca19ee5c35794246c1a205258314c6598a995401e985c01b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
675e0e78685624826cc8546cffeee04a

SHA1
71b032c022cbba490b848819be4a0a5fda770767

SHA256
70185ff54f22d04516fdbe3501ddceb21986f35e92b674ab6c526afe307ceba4

SHA512
1190b3a228387335ff12576e5407f8f9893474dad3eb5d1cada16d225ad22fb350cb4f2564d9c96a8396455d7e7f18e2e0b6b1d12e9266d87b57653f1bee3f7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
03e91a9c84711daa127219820a6f0a5d

SHA1
c2bccc2373e2b9f15d03f95f8d780c3423d253bd

SHA256
cd665b807cc6f692ee5b64fb641c4d11263ac7442383014df420e8b5f2609a82

SHA512
47da0286561b9e69307e3ec6f129cfac442b6a29d2b7d6f59de38cc02829b9c7083a20896f9173ad9df6024e67c540b620048c343f60c970c371b8bad8830a06

Download Submit