62d4d87c8aa2a16cb89e91fa473a5745de4ab12e3108e3bf9ad9f9177ef99bf4

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 07:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b65506fec7cba16c4b14f4c27f5c0b4_JaffaCakes118.html
Size

120KB
MD5

2b65506fec7cba16c4b14f4c27f5c0b4
SHA1

1e665563e2846f2484b8de563f49a9c5dc86aa5d
SHA256

62d4d87c8aa2a16cb89e91fa473a5745de4ab12e3108e3bf9ad9f9177ef99bf4
SHA512

140f1158c6bde4eb146b79a51dd3c10862fbf15ec6eb1d7da9bf47caa9254f71ae740a4a021f4d8c55f6ea8ae806c4e19fb0eb238cf6fb13ce354eb5fb816389
SSDEEP

768:HxUsynWrTXzv3M4bDHuT7TvEeFFPzFxjfWrrlG+QVM5D25PuAg4RsgA1uSg12b:HXk4TDfDOTP3nDWrxeMZ2huA5+gAUJ+

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4344	msedge.exe
4344	msedge.exe
3480	msedge.exe
3480	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 2768	3480	msedge.exe	82
PID 3480 wrote to memory of 2768	3480	msedge.exe	82
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4176	3480	msedge.exe	83
PID 3480 wrote to memory of 4344	3480	msedge.exe	84
PID 3480 wrote to memory of 4344	3480	msedge.exe	84
PID 3480 wrote to memory of 2944	3480	msedge.exe	85
PID 3480 wrote to memory of 2944	3480	msedge.exe	85
PID 3480 wrote to memory of 2944	3480	msedge.exe	85
PID 3480 wrote to memory of 2944	3480	msedge.exe	85
PID 3480 wrote to memory of 2944	3480	msedge.exe	85
PID 3480 wrote to memory of 2944	3480	msedge.exe	85
PID 3480 wrote to memory of 2944	3480	msedge.exe	85
PID 3480 wrote to memory of 2944	3480	msedge.exe	85
PID 3480 wrote to memory of 2944	3480	msedge.exe	85
PID 3480 wrote to memory of 2944	3480	msedge.exe	85
PID 3480 wrote to memory of 2944	3480	msedge.exe	85
PID 3480 wrote to memory of 2944	3480	msedge.exe	85
PID 3480 wrote to memory of 2944	3480	msedge.exe	85
PID 3480 wrote to memory of 2944	3480	msedge.exe	85
PID 3480 wrote to memory of 2944	3480	msedge.exe	85
PID 3480 wrote to memory of 2944	3480	msedge.exe	85
PID 3480 wrote to memory of 2944	3480	msedge.exe	85
PID 3480 wrote to memory of 2944	3480	msedge.exe	85
PID 3480 wrote to memory of 2944	3480	msedge.exe	85
PID 3480 wrote to memory of 2944	3480	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2b65506fec7cba16c4b14f4c27f5c0b4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ab9046f8,0x7ff8ab904708,0x7ff8ab904718
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,12879784015188960331,2302076788823183791,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,12879784015188960331,2302076788823183791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,12879784015188960331,2302076788823183791,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12879784015188960331,2302076788823183791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12879784015188960331,2302076788823183791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12879784015188960331,2302076788823183791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12879784015188960331,2302076788823183791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12879784015188960331,2302076788823183791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,12879784015188960331,2302076788823183791,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a27d8876d0de41d0d8ddfdc4f6fd4b15

SHA1
11f126f8b8bb7b63217f3525c20080f9e969eff3

SHA256
d32983bba248ff7a82cc936342414b06686608013d84ec5c75614e06a9685cfe

SHA512
8298c2435729f5f34bba5b82f31777c07f830076dd7087f07aab4337e679251dc2cfe276aa89a0131755fe946f05e6061ef9080e0fbe120e6c88cf9f3265689c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f060e9a30a0dde4f5e3e80ae94cc7e8e

SHA1
3c0cc8c3a62c00d7210bb2c8f3748aec89009d17

SHA256
c0e69c9f7453ef905de11f65d69b66cf8a5a2d8e42b7f296fa8dfde5c25abc79

SHA512
af97b8775922a2689d391d75defff3afe92842b8ab0bba5ddaa66351f633da83f160522aa39f6c243cb5e8ea543000f06939318bc52cb535103afc6c33e16bc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5d0f702a2e7fdce4978fd4d56b076ff8

SHA1
c471b5b817f43f9a6490a810bf95001659decadc

SHA256
8361ab1b6a0d963d2279febba08c778c828d5781f5bf7911ace02bb5151c4b39

SHA512
35651391a911fe2f9eab6fdd4b92d4db2e939bb2201a3537baf6c4fbdc86ab1ca728d64660a63617af09bb7a961f9fdb853a5fb94d08884035d1cb65a134e55d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
be6f756d4dadcea50fd6c631f1d2c086

SHA1
5b5a3cc64319b375a974b51a6509eabe29ca45d6

SHA256
4faac073826bd48cb03ee54a53e5b958ffc3e187f6507b05446f22cd7f625889

SHA512
0a204745f528e31e7c3aca8ffd3f2c9108eda44aa2416540c1531b5c08f4370537ffea2158040dafb2e69ec45dce3101974b8163a2b41796c507e12a18c6b296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6cbc42f99ad55c5d132ebd69ba6442f1

SHA1
dc19ea40ce3a79984855f23d0b3d8bcb5a8a5ff6

SHA256
b2f20c1fe86afcaab28cf05105d0ae6d4c67cd4e1c3ae5a091031db1242b686b

SHA512
0de20583094f0b6ef8a6ab18c28eba9a260bf5e60b3e7819e826f9964fa3d0cb5ed78ce8f14ead879a34ca2ea72442d8ef3a243ddc8d9de1e5e658f6e727597c

Download Submit