f20bc216994447e7bb5b6ff97b082cd8e13aa616404caff5e62bf6548c841854

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 11:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b35ce0b4e9c11e1c44e23cefda78613c_JaffaCakes118.html
Size

18KB
MD5

b35ce0b4e9c11e1c44e23cefda78613c
SHA1

526b9a421a756f31b2da086bb2e95cba1eb570ce
SHA256

f20bc216994447e7bb5b6ff97b082cd8e13aa616404caff5e62bf6548c841854
SHA512

b038f7998c878eb3024e2794bcac9d557d6d20f128b0aa66347e08d4922d297292d8ac695111ad74c52de86e8a1124566a0c25e0a03dbc7eb1f22061fcd636c6
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIF4pzUnjBhjV82qDB8:SIMd0I5nvHtsvjuxDB8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
208	msedge.exe
208	msedge.exe
4956	msedge.exe
4956	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 2032	4956	msedge.exe	84
PID 4956 wrote to memory of 2032	4956	msedge.exe	84
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 1540	4956	msedge.exe	86
PID 4956 wrote to memory of 208	4956	msedge.exe	87
PID 4956 wrote to memory of 208	4956	msedge.exe	87
PID 4956 wrote to memory of 4880	4956	msedge.exe	88
PID 4956 wrote to memory of 4880	4956	msedge.exe	88
PID 4956 wrote to memory of 4880	4956	msedge.exe	88
PID 4956 wrote to memory of 4880	4956	msedge.exe	88
PID 4956 wrote to memory of 4880	4956	msedge.exe	88
PID 4956 wrote to memory of 4880	4956	msedge.exe	88
PID 4956 wrote to memory of 4880	4956	msedge.exe	88
PID 4956 wrote to memory of 4880	4956	msedge.exe	88
PID 4956 wrote to memory of 4880	4956	msedge.exe	88
PID 4956 wrote to memory of 4880	4956	msedge.exe	88
PID 4956 wrote to memory of 4880	4956	msedge.exe	88
PID 4956 wrote to memory of 4880	4956	msedge.exe	88
PID 4956 wrote to memory of 4880	4956	msedge.exe	88
PID 4956 wrote to memory of 4880	4956	msedge.exe	88
PID 4956 wrote to memory of 4880	4956	msedge.exe	88
PID 4956 wrote to memory of 4880	4956	msedge.exe	88
PID 4956 wrote to memory of 4880	4956	msedge.exe	88
PID 4956 wrote to memory of 4880	4956	msedge.exe	88
PID 4956 wrote to memory of 4880	4956	msedge.exe	88
PID 4956 wrote to memory of 4880	4956	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b35ce0b4e9c11e1c44e23cefda78613c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9db446f8,0x7ffa9db44708,0x7ffa9db44718
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,18086746436949737356,8892352332392928837,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,18086746436949737356,8892352332392928837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,18086746436949737356,8892352332392928837,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18086746436949737356,8892352332392928837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18086746436949737356,8892352332392928837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,18086746436949737356,8892352332392928837,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7a54458caacf8c1fb40b4d1d399b725b

SHA1
067f722089b751a57993e92f1676f337c96fbfc8

SHA256
d6fa9687a05ea9c5745205389cdeb056ac74af32f01d034693b4ea62b5ce228a

SHA512
159d2274ce7e39ecaac21409c694cf4d41ceef7b8fec358836cc1d327201779ea7e6ce3a93bf959cce1f9ec08d209d3fb6555172694c6bae942e560232f065b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7521beafd97a338ca7bc6804ffe6c8e9

SHA1
444af32fa83050a45297307afb2626f772aeb79a

SHA256
87b9cdeddf51feda77cf8fae78b36040d30af853f7e68dd319e20b67b5f00abf

SHA512
b309cf6e2dd76441f7f311fefff894d9966dc662590013f859559343374f1bef15c393593be86d4148753ed64a432b78132d2271aaeeaef34c753eff7e1b8709

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
552ec9fc5972ef76111afb0ee3a285af

SHA1
0b3b8de51209b11a7dfc44d7fcf9ecd463488658

SHA256
a45f9f0926e33a036af0dba37696208f80bae17c6ed8130d24e5a054d1047889

SHA512
30efc8329964f9f3ed0199d6a62d6e38fd484a091c449eb877a9f598cc1c8d5218d18fd399c47df821bcc2a13956eb9a6138eb29e3a525741f3f303785e0eb8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
105a3add36bc7768dc32d54b7dbc44ea

SHA1
50865cf798b3fc5439d869bc90570952a91d67b9

SHA256
5482edb191eb68f7d994bbfa0b58444021ed47eaa5000915fd2354750323ec82

SHA512
001aa760212ede7c5281ccf18b12f89d7865232b285e765cad74a192b7fe7dd685b72a23cd32cd531e1af30608bfd0424f75fa56d1ad533cb6541380623e4aec

Download Submit