3b16b37343cd3be6c349c00be781bdcb167208d629003b75bd76ef71766f667e

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 04:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24b08a2b6a23efa72b5b65d2cccb576f_JaffaCakes118.html
Size

118KB
MD5

24b08a2b6a23efa72b5b65d2cccb576f
SHA1

6484b8775dd44b54f53b448c738127df33572ce8
SHA256

3b16b37343cd3be6c349c00be781bdcb167208d629003b75bd76ef71766f667e
SHA512

d2e5eb52cd3988bd502015cf1fef2db924e7d334bb26d51850c9c98c1781fa31541c1eec756a4bc2cc8c03e61614c1338abb4223f8699f67ac43f86a7dd741ac
SSDEEP

768:ox7pFcT8a4bveyDSVvSn1I6wLHqKQl9v6+sjPpA22F2SusZ5NAsCY3BXntSUemG3:oRLcfoTDSVA8Mll6+8x58ZuWzAstjn4

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
2448	msedge.exe
2448	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 1036	2448	msedge.exe	81
PID 2448 wrote to memory of 1036	2448	msedge.exe	81
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 2896	2448	msedge.exe	82
PID 2448 wrote to memory of 1180	2448	msedge.exe	83
PID 2448 wrote to memory of 1180	2448	msedge.exe	83
PID 2448 wrote to memory of 228	2448	msedge.exe	84
PID 2448 wrote to memory of 228	2448	msedge.exe	84
PID 2448 wrote to memory of 228	2448	msedge.exe	84
PID 2448 wrote to memory of 228	2448	msedge.exe	84
PID 2448 wrote to memory of 228	2448	msedge.exe	84
PID 2448 wrote to memory of 228	2448	msedge.exe	84
PID 2448 wrote to memory of 228	2448	msedge.exe	84
PID 2448 wrote to memory of 228	2448	msedge.exe	84
PID 2448 wrote to memory of 228	2448	msedge.exe	84
PID 2448 wrote to memory of 228	2448	msedge.exe	84
PID 2448 wrote to memory of 228	2448	msedge.exe	84
PID 2448 wrote to memory of 228	2448	msedge.exe	84
PID 2448 wrote to memory of 228	2448	msedge.exe	84
PID 2448 wrote to memory of 228	2448	msedge.exe	84
PID 2448 wrote to memory of 228	2448	msedge.exe	84
PID 2448 wrote to memory of 228	2448	msedge.exe	84
PID 2448 wrote to memory of 228	2448	msedge.exe	84
PID 2448 wrote to memory of 228	2448	msedge.exe	84
PID 2448 wrote to memory of 228	2448	msedge.exe	84
PID 2448 wrote to memory of 228	2448	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\24b08a2b6a23efa72b5b65d2cccb576f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc2ac46f8,0x7ffdc2ac4708,0x7ffdc2ac4718
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,2226042949002533150,9170220100145781851,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,2226042949002533150,9170220100145781851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,2226042949002533150,9170220100145781851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2226042949002533150,9170220100145781851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2226042949002533150,9170220100145781851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2226042949002533150,9170220100145781851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2226042949002533150,9170220100145781851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2226042949002533150,9170220100145781851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,2226042949002533150,9170220100145781851,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a369e695bb890fbd0ad3a6cbb47299e5

SHA1
9b79c432c9e525ea65470c70bd128880d2793ec0

SHA256
93bb91ef0ca743c2a921392eb8a2af405bd25218a66e77d953f23086eabc9530

SHA512
2e0991cef1c2fff0c2944246b2ee3daa15d7d46bf0b314f49b988795782b20d0d389d1adc82b2c3242c9f5b502b5bca4f61d5aedea7eeaef2e75e18f33d2824b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ceec7d0501cb1425ca63d365ac547265

SHA1
97b6807cc5f62235bde185eb8e6e83a7250da38c

SHA256
a7867e97b4af613e8cb2351cc6f34c153667c59ce43546dbd1283eaee8bf5f55

SHA512
2dd8c640c71e47d9ec39f8edd5abc4242ae5b13f76e99b5fc78a8d85fb59335603c88fb9eb98d3ac0a055650b42a38b82a1c3b65c41e6948bdeee362d65d202e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
b08420a636d66fc5dee2072c4e8380ab

SHA1
173e36870fead04c32e8e8bb6d16df13a4a51378

SHA256
0525634a1e65a7b80bee3aa37a77d7b2c5fee05dc8e936e7628b9605e4902536

SHA512
e8346c1ee6397075bd42c7e65303b82349714cb89c8707690dc56a9d185d0f57b34c0f05761189cc8ceea9dc939c80e1ae2a9dbdc4206247751019d40a25129e

Download Submit