9412f7048fcf633d5f776cf6b69436376a1a13cb68bdc6cdcef7285178a30718

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 08:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2baf9e883d7969d45734e17416777314_JaffaCakes118.html
Size

33KB
MD5

2baf9e883d7969d45734e17416777314
SHA1

90d957071451b23f6f60f9a13f02e70c4f5f6baf
SHA256

9412f7048fcf633d5f776cf6b69436376a1a13cb68bdc6cdcef7285178a30718
SHA512

d110ce33015e939e404ebe5cee1478c64157a8be278d68ec9b4d0f8de63cead012a258d0b6de7170ef2690cdb8dc8c959df80e3fb526cf6c78b4c4d15cb1bd48
SSDEEP

768:dfOT9uG1HtT+uRCOTQffMRaCGU9NBQeecWbw:dfOT9/1HZ+uRsfUYwTrXaw

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
624	msedge.exe
624	msedge.exe
1148	msedge.exe
1148	msedge.exe
2408	identity_helper.exe
2408	identity_helper.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 3052	1148	msedge.exe	81
PID 1148 wrote to memory of 3052	1148	msedge.exe	81
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 4680	1148	msedge.exe	82
PID 1148 wrote to memory of 624	1148	msedge.exe	83
PID 1148 wrote to memory of 624	1148	msedge.exe	83
PID 1148 wrote to memory of 3496	1148	msedge.exe	84
PID 1148 wrote to memory of 3496	1148	msedge.exe	84
PID 1148 wrote to memory of 3496	1148	msedge.exe	84
PID 1148 wrote to memory of 3496	1148	msedge.exe	84
PID 1148 wrote to memory of 3496	1148	msedge.exe	84
PID 1148 wrote to memory of 3496	1148	msedge.exe	84
PID 1148 wrote to memory of 3496	1148	msedge.exe	84
PID 1148 wrote to memory of 3496	1148	msedge.exe	84
PID 1148 wrote to memory of 3496	1148	msedge.exe	84
PID 1148 wrote to memory of 3496	1148	msedge.exe	84
PID 1148 wrote to memory of 3496	1148	msedge.exe	84
PID 1148 wrote to memory of 3496	1148	msedge.exe	84
PID 1148 wrote to memory of 3496	1148	msedge.exe	84
PID 1148 wrote to memory of 3496	1148	msedge.exe	84
PID 1148 wrote to memory of 3496	1148	msedge.exe	84
PID 1148 wrote to memory of 3496	1148	msedge.exe	84
PID 1148 wrote to memory of 3496	1148	msedge.exe	84
PID 1148 wrote to memory of 3496	1148	msedge.exe	84
PID 1148 wrote to memory of 3496	1148	msedge.exe	84
PID 1148 wrote to memory of 3496	1148	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2baf9e883d7969d45734e17416777314_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc37ff46f8,0x7ffc37ff4708,0x7ffc37ff4718
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,13304548560353633952,9014565871329656938,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,13304548560353633952,9014565871329656938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,13304548560353633952,9014565871329656938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13304548560353633952,9014565871329656938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13304548560353633952,9014565871329656938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,13304548560353633952,9014565871329656938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,13304548560353633952,9014565871329656938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13304548560353633952,9014565871329656938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13304548560353633952,9014565871329656938,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13304548560353633952,9014565871329656938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13304548560353633952,9014565871329656938,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,13304548560353633952,9014565871329656938,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4868 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
de1d175f3af722d1feb1c205f4e92d1e

SHA1
019cf8527a9b94bd0b35418bf7be8348be5a1c39

SHA256
1b99cae942ebf99c31795fa279d51b1a2379ca0af7b27bd3c58ea6c78a033924

SHA512
f0dcd08afd3c6a761cc1afa2846ec23fb5438d6127ebd535a754498debabd0b1ebd04858d1b98be92faf14b512f982b1f3dcbb702860e96877eb835f763f9734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
06b496d28461d5c01fc81bc2be6a9978

SHA1
36e7a9d9c7a924d5bb448d68038c7fe5e6cbf5aa

SHA256
e4a2d1395627095b0fa55e977e527ccb5b71dff3cd2d138df498f50f9f5ab507

SHA512
6488a807c978d38d65010583c1e5582548ab8102ebd68ee827e603c9bdfcdbb9f98a488d31414a829409f6edca8bd2eb4aadd4ff31b144de41249fa63a26bc91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f5620d0c96fd9250c2d31ad2df7a6b38

SHA1
a6d33cb15ef89e5af69d751a0182869945c034e5

SHA256
c96918b0610a4f3d279e345c787e88a29b3873dfd372f639cebd186ff44d0641

SHA512
5d20a6af33354785081eeb0a72b33e15c47586015c65b6e0e53369505818a309c176454a82108488840c18cb69abf5ba3ebe853dc1a51ce807623a0e3477856a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5fa2bad8fa318f61db9bb4755ade6e54

SHA1
792c0a7fa3cd93e39ded06ef67834ea3ecdf8b1f

SHA256
bae3264ab340287801388cf90501a6d745e47ef1d2c64c620fcd2f7d568d53ba

SHA512
73270a2a5708332bcfdc4ed55e2ad2b4499a4ddae2d74b73a5f97431c1c3db1c80025e27785c1c4bcbb1f0790e2dcbdce560efa158bac99e00d28a34a9926f29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3746268caf919eb636e9530c2f2d7e8a

SHA1
ec06b508fc676f003e476ba29b85bfeb1aed49bd

SHA256
e97bcf341c9cd6d71a59606bfbd18f5920e0701b103d635441fd7e2e55573f73

SHA512
20d5692585c3bb9007e14a17a9669dab748e477ef37b04efe45520e802b999807ef4e6cc0cacb08b497db7bca4f3223f08674b278b76ac1e38f5c24a83591bd1

Download Submit