513170bb880a2edfc3840adffcf83b5bc2d3e99f06527b1cc3381fd61b757b54

Analysis

max time kernel
145s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 12:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c450ef0b9de3d06ced8dcf5787dfed8_JaffaCakes118.html
Size

14KB
MD5

2c450ef0b9de3d06ced8dcf5787dfed8
SHA1

c287d0347f4c16d48991247903e00f6854c874f7
SHA256

513170bb880a2edfc3840adffcf83b5bc2d3e99f06527b1cc3381fd61b757b54
SHA512

bd807cd024442f8424ece761d0ebcc3e83190ee6d997e2f33242db1c275e7674cc0fb9d3c92f259eecd56909e5a1f6ee697e478eb897db4c2d587c523d9316ed
SSDEEP

192:rDkTffv5gUfFS8VmFFmnrAD5rnrf1SGU6qCC9i1KYYY5:rDyfX5gU9raKr61rf1SGU6qCWCKYYY5

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1472	msedge.exe
1472	msedge.exe
4508	msedge.exe
4508	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 3576	4508	msedge.exe	82
PID 4508 wrote to memory of 3576	4508	msedge.exe	82
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 4176	4508	msedge.exe	83
PID 4508 wrote to memory of 1472	4508	msedge.exe	84
PID 4508 wrote to memory of 1472	4508	msedge.exe	84
PID 4508 wrote to memory of 2216	4508	msedge.exe	85
PID 4508 wrote to memory of 2216	4508	msedge.exe	85
PID 4508 wrote to memory of 2216	4508	msedge.exe	85
PID 4508 wrote to memory of 2216	4508	msedge.exe	85
PID 4508 wrote to memory of 2216	4508	msedge.exe	85
PID 4508 wrote to memory of 2216	4508	msedge.exe	85
PID 4508 wrote to memory of 2216	4508	msedge.exe	85
PID 4508 wrote to memory of 2216	4508	msedge.exe	85
PID 4508 wrote to memory of 2216	4508	msedge.exe	85
PID 4508 wrote to memory of 2216	4508	msedge.exe	85
PID 4508 wrote to memory of 2216	4508	msedge.exe	85
PID 4508 wrote to memory of 2216	4508	msedge.exe	85
PID 4508 wrote to memory of 2216	4508	msedge.exe	85
PID 4508 wrote to memory of 2216	4508	msedge.exe	85
PID 4508 wrote to memory of 2216	4508	msedge.exe	85
PID 4508 wrote to memory of 2216	4508	msedge.exe	85
PID 4508 wrote to memory of 2216	4508	msedge.exe	85
PID 4508 wrote to memory of 2216	4508	msedge.exe	85
PID 4508 wrote to memory of 2216	4508	msedge.exe	85
PID 4508 wrote to memory of 2216	4508	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2c450ef0b9de3d06ced8dcf5787dfed8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98a5f46f8,0x7ff98a5f4708,0x7ff98a5f4718
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,11255318282402098912,7893472434055811848,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,11255318282402098912,7893472434055811848,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,11255318282402098912,7893472434055811848,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11255318282402098912,7893472434055811848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11255318282402098912,7893472434055811848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,11255318282402098912,7893472434055811848,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f0f818d52a59eb6cf9c4dd2a1c844df9

SHA1
26afc4b28c0287274624690bd5bd4786cfe11d16

SHA256
58c0beea55fecbeded2d2c593473149214df818be1e4e4a28c97171dc8179d61

SHA512
7e8a1d3a6c8c9b0f1ac497e509e9edbe9e121df1df0147ce4421b8cf526ad238bd146868e177f9ce02e2d8f99cf7bb9ce7db4a582d487bbc921945211a977509

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0331fa75ac7846bafcf885ea76d47447

SHA1
5a141ffda430e091153fefc4aa36317422ba28ae

SHA256
64b4b2e791644fc04f164ecd13b8b9a3e62669896fb7907bf0a072bbeebaf74a

SHA512
f8b960d38d73cf29ce17ea409ef6830cae99d7deafaf2ff59f8347120d81925ff16e38faaa0f7f4c39936472d05d1d131df2a8a383351f138c38afb21c1a60e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
46454d67eb267289678b46f4db8e8c68

SHA1
3a4074f31e437f31e5ac411e5620aa4317b5125c

SHA256
20cd22646541f53d80508a9ca744c745103b0a4ced0d598807879a6caced299b

SHA512
185f295dc7abf12b358ba150061cfbdf6f35979ca9fb9708fcfbf3fc7c9d5b9671236e3e3ba7691532259855e081f05a2527a3ac5b7c1a3ba4e2315fdf42e83d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ffe73ea50ad126bdb598062a49b7e296

SHA1
26368d3afc55ddc8773ebda010f66fb6572ab8ce

SHA256
30d2a21accd2092434ef3b2f2525c46cfe8d6055360f3c6badd3f3d9d0982670

SHA512
f89b3525dbe8bea5183e2cb42a8c589bba1e2e98c452f92c36dffb68f0d2fdd087d4611063875b06d772cb4e72b805dd698bdfded12b72681f335364273b1539

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
99dbdeed8c79edb6168735bc74eb02be

SHA1
3a527d4197b8b5a8506fea861a2a14569ac2390b

SHA256
28d3dd43dc63d8f32b0f776839c07072d3760a7cab6202ecbb76a8951c790120

SHA512
cf01bf5e5c06f34cc2ab6dcd50e6c94d48a506002282b5b9b729e8ee53659845af88828c2d6946d68362ecdfdf055151820e8580188e5d8e44386c861e1bf3b9

Download Submit