5efd8fe71705996062ba6fd066953716a149c92978800640eb5958255a54e048

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07-07-2024 22:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a137ecc4a6f98532ebb5a2399dec65f_JaffaCakes118.html
Size

6KB
MD5

2a137ecc4a6f98532ebb5a2399dec65f
SHA1

41f5f7f797ce3dbd5b7918d9c5e6739bbde77896
SHA256

5efd8fe71705996062ba6fd066953716a149c92978800640eb5958255a54e048
SHA512

a64f88307dd023fe226ebe035d30de4419cdf4af742ced18322bc4e1df178592248b3b33cfd94b825737e9cc256adf2159c6cc8cf9a43b3679a6b2d854cc168c
SSDEEP

96:xBOooyG3bAyKN+CEXr8qLTu9MasP2KRFZosrMgVhHwicgkHT/sxi2v0pp6HBvmv3:nOooyG3UyiEhdFpVKS8v5Tal2Fhv

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3856	msedge.exe
3856	msedge.exe
4424	msedge.exe
4424	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4424	msedge.exe
4424	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 2684	4424	msedge.exe	82
PID 4424 wrote to memory of 2684	4424	msedge.exe	82
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 376	4424	msedge.exe	83
PID 4424 wrote to memory of 3856	4424	msedge.exe	84
PID 4424 wrote to memory of 3856	4424	msedge.exe	84
PID 4424 wrote to memory of 3936	4424	msedge.exe	85
PID 4424 wrote to memory of 3936	4424	msedge.exe	85
PID 4424 wrote to memory of 3936	4424	msedge.exe	85
PID 4424 wrote to memory of 3936	4424	msedge.exe	85
PID 4424 wrote to memory of 3936	4424	msedge.exe	85
PID 4424 wrote to memory of 3936	4424	msedge.exe	85
PID 4424 wrote to memory of 3936	4424	msedge.exe	85
PID 4424 wrote to memory of 3936	4424	msedge.exe	85
PID 4424 wrote to memory of 3936	4424	msedge.exe	85
PID 4424 wrote to memory of 3936	4424	msedge.exe	85
PID 4424 wrote to memory of 3936	4424	msedge.exe	85
PID 4424 wrote to memory of 3936	4424	msedge.exe	85
PID 4424 wrote to memory of 3936	4424	msedge.exe	85
PID 4424 wrote to memory of 3936	4424	msedge.exe	85
PID 4424 wrote to memory of 3936	4424	msedge.exe	85
PID 4424 wrote to memory of 3936	4424	msedge.exe	85
PID 4424 wrote to memory of 3936	4424	msedge.exe	85
PID 4424 wrote to memory of 3936	4424	msedge.exe	85
PID 4424 wrote to memory of 3936	4424	msedge.exe	85
PID 4424 wrote to memory of 3936	4424	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2a137ecc4a6f98532ebb5a2399dec65f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa550346f8,0x7ffa55034708,0x7ffa55034718
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,8752403269640111394,12782035545229579386,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,8752403269640111394,12782035545229579386,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,8752403269640111394,12782035545229579386,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8752403269640111394,12782035545229579386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8752403269640111394,12782035545229579386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,8752403269640111394,12782035545229579386,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4760 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f0f818d52a59eb6cf9c4dd2a1c844df9

SHA1
26afc4b28c0287274624690bd5bd4786cfe11d16

SHA256
58c0beea55fecbeded2d2c593473149214df818be1e4e4a28c97171dc8179d61

SHA512
7e8a1d3a6c8c9b0f1ac497e509e9edbe9e121df1df0147ce4421b8cf526ad238bd146868e177f9ce02e2d8f99cf7bb9ce7db4a582d487bbc921945211a977509

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0331fa75ac7846bafcf885ea76d47447

SHA1
5a141ffda430e091153fefc4aa36317422ba28ae

SHA256
64b4b2e791644fc04f164ecd13b8b9a3e62669896fb7907bf0a072bbeebaf74a

SHA512
f8b960d38d73cf29ce17ea409ef6830cae99d7deafaf2ff59f8347120d81925ff16e38faaa0f7f4c39936472d05d1d131df2a8a383351f138c38afb21c1a60e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c1e3d45ce370538da8ebe561f533e005

SHA1
a82eb8c3d78803578b872026cdfee999af306b98

SHA256
e61f2cc5e000632a5f62531115f43616f1609b1a753f406eab7bdcf47060e5b3

SHA512
c87dd7abcbb8572b53c07cd0a91840b9a1ebec7956d14c2db5f4d2187d390b8af21caa328f794c975fb88e10b668bd726958970368ace6d793246028a6fde503

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8ae6ba3c8f840ed6b2ea08a5daec9a91

SHA1
7fb41e3b540112a465d2d6db9bfc33ea043a555d

SHA256
da37f7e4a7ed0cf8aaede59eae5e9e381579f3069f315882350ec2d4e258f778

SHA512
977bf07e08f717c50a33039ec7034e93f8f39186ee22edf210c9871c2ee533204f5b02f711762d037313cf9251d1aea54fcaf0e1ba5dda4949a4239463f13fb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a76ec4e9e6f1b5078e64988594829f41

SHA1
ce124cf1ad26b9bfa5ccd94b36877a158b3c2bc7

SHA256
81020f236914ec950fd744f83035c81a785d7f3c5110deb6f37a0fd8f54a375c

SHA512
897ced096f639def81c82ed38258ea540e7e60e43ed9a519d51b186345aad9322510891db0442bc1bb21d6b976fd302403c7f93b2de8d1014318b703cc9f77b9

Download Submit