2b3b842619b27a0c8ced558242e8bf1fd610ff1bb65501ae47e4c19f9288ae0c

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13-06-2024 05:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a40ae2cfb793145194753ee78465ae8d_JaffaCakes118.html
Size

884B
MD5

a40ae2cfb793145194753ee78465ae8d
SHA1

e9f17f019e4c90edaf781a561620e25e0c755402
SHA256

2b3b842619b27a0c8ced558242e8bf1fd610ff1bb65501ae47e4c19f9288ae0c
SHA512

c2670f2beb2fc5bfbc2ab6ab19fd10df8f8e1e48feaee4dc0d264fedf19c6c4ba9a7ac7a462fe8f721229f24ad86b73f70abb5aa6a569637100328184e610c89

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
704	msedge.exe
704	msedge.exe
2972	identity_helper.exe
2972	identity_helper.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 704 wrote to memory of 2336	704	msedge.exe	81
PID 704 wrote to memory of 2336	704	msedge.exe	81
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 1316	704	msedge.exe	83
PID 704 wrote to memory of 2484	704	msedge.exe	84
PID 704 wrote to memory of 2484	704	msedge.exe	84
PID 704 wrote to memory of 1968	704	msedge.exe	85
PID 704 wrote to memory of 1968	704	msedge.exe	85
PID 704 wrote to memory of 1968	704	msedge.exe	85
PID 704 wrote to memory of 1968	704	msedge.exe	85
PID 704 wrote to memory of 1968	704	msedge.exe	85
PID 704 wrote to memory of 1968	704	msedge.exe	85
PID 704 wrote to memory of 1968	704	msedge.exe	85
PID 704 wrote to memory of 1968	704	msedge.exe	85
PID 704 wrote to memory of 1968	704	msedge.exe	85
PID 704 wrote to memory of 1968	704	msedge.exe	85
PID 704 wrote to memory of 1968	704	msedge.exe	85
PID 704 wrote to memory of 1968	704	msedge.exe	85
PID 704 wrote to memory of 1968	704	msedge.exe	85
PID 704 wrote to memory of 1968	704	msedge.exe	85
PID 704 wrote to memory of 1968	704	msedge.exe	85
PID 704 wrote to memory of 1968	704	msedge.exe	85
PID 704 wrote to memory of 1968	704	msedge.exe	85
PID 704 wrote to memory of 1968	704	msedge.exe	85
PID 704 wrote to memory of 1968	704	msedge.exe	85
PID 704 wrote to memory of 1968	704	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a40ae2cfb793145194753ee78465ae8d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa70eb46f8,0x7ffa70eb4708,0x7ffa70eb4718
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,1567038235747030794,15382427746990659993,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,1567038235747030794,15382427746990659993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,1567038235747030794,15382427746990659993,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1567038235747030794,15382427746990659993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1567038235747030794,15382427746990659993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1567038235747030794,15382427746990659993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,1567038235747030794,15382427746990659993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,1567038235747030794,15382427746990659993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1567038235747030794,15382427746990659993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1567038235747030794,15382427746990659993,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1567038235747030794,15382427746990659993,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,1567038235747030794,15382427746990659993,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5609e422-c45c-4ad7-84a9-b77ae43bdec2.tmp

Filesize
11KB

MD5
103e3b227000b629b65a54c18c15b018

SHA1
af4b7d1c1fb9e856ffb91bc0917c0be5a24ecb49

SHA256
075488a59fefb8891b20808f2a53779a9828c68f2f41ca21877b31416a0e7d7e

SHA512
2938c98c4173433bc5b9a0e99f3b3f5721bccff387e181c74e4b87d3fac53b6c50f3f8fa90f3d24c0286d43a8c0d86285a3aa79f5ff82de81a18e35cb3eb8041

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9081c34e133c32d02f593df88f047a

SHA1
a0da007c14fd0591091924edc44bee90456700c6

SHA256
c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e

SHA512
12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3a09f853479af373691d131247040276

SHA1
1b6f098e04da87e9cf2d3284943ec2144f36ac04

SHA256
a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f

SHA512
341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2c060ec79f56032748e845cf48194099

SHA1
4dc55e289567856e702a3914f781a8af96a0c831

SHA256
77ad1c0fc71eb774e7adfcbb445bd0d9702e9021fc646cdb869891d1f899252b

SHA512
9b7ca29efac01e94e98c82d5c5cd60635aa7b98a911182b891e26f3856543ebbce49e97cd755a204d544334e97c4777315fcf96446ad041cd1b2b845480777d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0ba8c0e7642cc4d13c6b14183424b94d

SHA1
522a601e43fad2476d10c3939f5839568d13545d

SHA256
52c7446ed18c78969de37111f4a1e176049f7c2a7d3d9399afc93599acc697c2

SHA512
b4323438fd7bb8ff0041afb0dc6534826f37513b3233d9475d7e41199a92a71d1c7150633e84e0f2e76b7737221d015b512890d1fed4971d7526b7ccbf53e7c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit