cc9572e37455c18e6750cae170f00129be46997af155c4f68e7cbe882010ab09

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2024, 23:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a322631599a57fadabe73e0ba1d6473_JaffaCakes118.html
Size

1KB
MD5

2a322631599a57fadabe73e0ba1d6473
SHA1

d457de8ea6dcd6ceae37485d71a72c1aad576c5c
SHA256

cc9572e37455c18e6750cae170f00129be46997af155c4f68e7cbe882010ab09
SHA512

e03f8e9b07ae57b3f88b77acbaa533ec21621c2303de500d1ff9fff7943d35bd51cc1e8154354a9c318b80f4a4742b3df33e52c9178baff291c2a9fc8d088b95

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
3140	msedge.exe
3140	msedge.exe
2080	identity_helper.exe
2080	identity_helper.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 4496	3140	msedge.exe	82
PID 3140 wrote to memory of 4496	3140	msedge.exe	82
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 3228	3140	msedge.exe	84
PID 3140 wrote to memory of 4340	3140	msedge.exe	85
PID 3140 wrote to memory of 4340	3140	msedge.exe	85
PID 3140 wrote to memory of 1396	3140	msedge.exe	86
PID 3140 wrote to memory of 1396	3140	msedge.exe	86
PID 3140 wrote to memory of 1396	3140	msedge.exe	86
PID 3140 wrote to memory of 1396	3140	msedge.exe	86
PID 3140 wrote to memory of 1396	3140	msedge.exe	86
PID 3140 wrote to memory of 1396	3140	msedge.exe	86
PID 3140 wrote to memory of 1396	3140	msedge.exe	86
PID 3140 wrote to memory of 1396	3140	msedge.exe	86
PID 3140 wrote to memory of 1396	3140	msedge.exe	86
PID 3140 wrote to memory of 1396	3140	msedge.exe	86
PID 3140 wrote to memory of 1396	3140	msedge.exe	86
PID 3140 wrote to memory of 1396	3140	msedge.exe	86
PID 3140 wrote to memory of 1396	3140	msedge.exe	86
PID 3140 wrote to memory of 1396	3140	msedge.exe	86
PID 3140 wrote to memory of 1396	3140	msedge.exe	86
PID 3140 wrote to memory of 1396	3140	msedge.exe	86
PID 3140 wrote to memory of 1396	3140	msedge.exe	86
PID 3140 wrote to memory of 1396	3140	msedge.exe	86
PID 3140 wrote to memory of 1396	3140	msedge.exe	86
PID 3140 wrote to memory of 1396	3140	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2a322631599a57fadabe73e0ba1d6473_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce25146f8,0x7ffce2514708,0x7ffce2514718
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,3112664672374677273,4653359892729263129,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,3112664672374677273,4653359892729263129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,3112664672374677273,4653359892729263129,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3112664672374677273,4653359892729263129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3112664672374677273,4653359892729263129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,3112664672374677273,4653359892729263129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,3112664672374677273,4653359892729263129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3112664672374677273,4653359892729263129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3112664672374677273,4653359892729263129,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3112664672374677273,4653359892729263129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3112664672374677273,4653359892729263129,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,3112664672374677273,4653359892729263129,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
de1d175f3af722d1feb1c205f4e92d1e

SHA1
019cf8527a9b94bd0b35418bf7be8348be5a1c39

SHA256
1b99cae942ebf99c31795fa279d51b1a2379ca0af7b27bd3c58ea6c78a033924

SHA512
f0dcd08afd3c6a761cc1afa2846ec23fb5438d6127ebd535a754498debabd0b1ebd04858d1b98be92faf14b512f982b1f3dcbb702860e96877eb835f763f9734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
06b496d28461d5c01fc81bc2be6a9978

SHA1
36e7a9d9c7a924d5bb448d68038c7fe5e6cbf5aa

SHA256
e4a2d1395627095b0fa55e977e527ccb5b71dff3cd2d138df498f50f9f5ab507

SHA512
6488a807c978d38d65010583c1e5582548ab8102ebd68ee827e603c9bdfcdbb9f98a488d31414a829409f6edca8bd2eb4aadd4ff31b144de41249fa63a26bc91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
efcc88488dc451e7c1562c90df3094f0

SHA1
21bbb80eec5184b9868562b9ae07818cd653c519

SHA256
a78e9d9ac6aa6c856642933ce4d67023353c2e69dade5721a2969d2bcbf7e528

SHA512
a43c4efa0da556d3f2c61813027235d735c6121703d93929ec13501361706bee29900fa310c10cd124a4ad03716c0bf6e5ada74d640e2383a65bc0cd1a55c060

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6cc4dc49cc3fa4ab58616e21cd37e4f0

SHA1
405c4c9cfd1e675ee44ae5541551f2a1c539dc93

SHA256
22dc547677e1fa10a1c14aedc4377d4458d1f54e4505c5664a133b36b8456cd2

SHA512
17c1c50e29c46653130e7777260248de4b2d27d86487ceb2ab9a12d86cd2a86655c56ccab12d15aebcafe81f982baf1203a2a1e5541e5631f5e2db1a4a2c6111

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2b04ada5c166731c62ed3bda10eedd10

SHA1
faa6a2578fae0b2979937523fcf4b9b22b2af87b

SHA256
0c6c4d048a73e77a861032b555359f796cf3725482d4ff52dd951ab7b5d8310e

SHA512
62fb3417798ab7269b1fde13d09055ce31f7af894ab94fd57b9ae4cc8b54f08357281e06d23776d0e50f77166696f2a1f24800f7066b8329635b189bd25e3841

Download Submit