06a7a8b870409055d66b20659dd744678d57e6e280bdf5f26d5b5002bf46acda

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 12:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c52172a3d1f0fb1e773d0400aaaf259_JaffaCakes118.html
Size

50KB
MD5

2c52172a3d1f0fb1e773d0400aaaf259
SHA1

441b96d28ebd318100cb53f00112117918fd2b17
SHA256

06a7a8b870409055d66b20659dd744678d57e6e280bdf5f26d5b5002bf46acda
SHA512

956afe66c942c768dd0b58af486cd53631703f22482ff6c86a7127cebb3baa8c65e26c4e1cb2efb3493049b1a5fe1c83326b01257f11dfa3d7d1ccc1d9fa1b0f
SSDEEP

384:G8bdl2NS1jJmwwNPONSyx8JGJkJz6JOsJTJ4eJCJZJ8JUHJRJxJlJYJzWJeJsJRA:G8NwNTRI4MEpOCU1xqNU0/u

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2900	msedge.exe
2900	msedge.exe
4816	msedge.exe
4816	msedge.exe
2072	identity_helper.exe
2072	identity_helper.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 2996	4816	msedge.exe	82
PID 4816 wrote to memory of 2996	4816	msedge.exe	82
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2164	4816	msedge.exe	83
PID 4816 wrote to memory of 2900	4816	msedge.exe	84
PID 4816 wrote to memory of 2900	4816	msedge.exe	84
PID 4816 wrote to memory of 4732	4816	msedge.exe	85
PID 4816 wrote to memory of 4732	4816	msedge.exe	85
PID 4816 wrote to memory of 4732	4816	msedge.exe	85
PID 4816 wrote to memory of 4732	4816	msedge.exe	85
PID 4816 wrote to memory of 4732	4816	msedge.exe	85
PID 4816 wrote to memory of 4732	4816	msedge.exe	85
PID 4816 wrote to memory of 4732	4816	msedge.exe	85
PID 4816 wrote to memory of 4732	4816	msedge.exe	85
PID 4816 wrote to memory of 4732	4816	msedge.exe	85
PID 4816 wrote to memory of 4732	4816	msedge.exe	85
PID 4816 wrote to memory of 4732	4816	msedge.exe	85
PID 4816 wrote to memory of 4732	4816	msedge.exe	85
PID 4816 wrote to memory of 4732	4816	msedge.exe	85
PID 4816 wrote to memory of 4732	4816	msedge.exe	85
PID 4816 wrote to memory of 4732	4816	msedge.exe	85
PID 4816 wrote to memory of 4732	4816	msedge.exe	85
PID 4816 wrote to memory of 4732	4816	msedge.exe	85
PID 4816 wrote to memory of 4732	4816	msedge.exe	85
PID 4816 wrote to memory of 4732	4816	msedge.exe	85
PID 4816 wrote to memory of 4732	4816	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2c52172a3d1f0fb1e773d0400aaaf259_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1e1946f8,0x7ffa1e194708,0x7ffa1e194718
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,4856875793077635953,8209774466621165816,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,4856875793077635953,8209774466621165816,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,4856875793077635953,8209774466621165816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4856875793077635953,8209774466621165816,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4856875793077635953,8209774466621165816,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,4856875793077635953,8209774466621165816,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,4856875793077635953,8209774466621165816,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4856875793077635953,8209774466621165816,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4856875793077635953,8209774466621165816,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4856875793077635953,8209774466621165816,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4856875793077635953,8209774466621165816,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,4856875793077635953,8209774466621165816,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1836 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
de1d175f3af722d1feb1c205f4e92d1e

SHA1
019cf8527a9b94bd0b35418bf7be8348be5a1c39

SHA256
1b99cae942ebf99c31795fa279d51b1a2379ca0af7b27bd3c58ea6c78a033924

SHA512
f0dcd08afd3c6a761cc1afa2846ec23fb5438d6127ebd535a754498debabd0b1ebd04858d1b98be92faf14b512f982b1f3dcbb702860e96877eb835f763f9734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
06b496d28461d5c01fc81bc2be6a9978

SHA1
36e7a9d9c7a924d5bb448d68038c7fe5e6cbf5aa

SHA256
e4a2d1395627095b0fa55e977e527ccb5b71dff3cd2d138df498f50f9f5ab507

SHA512
6488a807c978d38d65010583c1e5582548ab8102ebd68ee827e603c9bdfcdbb9f98a488d31414a829409f6edca8bd2eb4aadd4ff31b144de41249fa63a26bc91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
96e3e6e6ea5a96dff397f1adf11656b7

SHA1
89eeb0689c5298ca37ee6a2b4efb5c8d2f21f7fa

SHA256
b0fde7ea3b5154e38ad596304d4fdbc08370d49e44f10854363fbcfae47a97fe

SHA512
e0016eade5eb7c31a8182dd9c21cc59eda918f876d59ad6c959bbeb88475e368a86493affed9b9ecec07fe92d3ba459a4245d13ece446b48dda4259b729bf4cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d47e5c2d-6c92-4c83-b6c7-f6d2a7e45fc4.tmp

Filesize
6KB

MD5
a0081c4815219b1051f37117ce350e3c

SHA1
defd741c5b9213aa0154782efd1c17db37b2a631

SHA256
9dda0b80563e2a9d6cba89bb1c84ead4b669fc3a884bcae8f64698bebf6718b9

SHA512
8e4cdc9c359687a27eb9f457d6ce5f0857035a334f2155ff59684aa7b6cb83e36b7d16a7e111d5e59f3f9fa875b863b97da9197d1578fd0657419ddfc59edae8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
de0efcc99bb279d3abef479d2336ac78

SHA1
d71ba03fc8af7a03ca0b8aae2be1dc8834a0d730

SHA256
860252a7a964e4891b23ac997251d6c11b490e8aa11bd275bd8bdef79e8ee2af

SHA512
cbccfa527ffae420f623a6b46d9814e56c575ac55a28d25b00d340ee3fa15322717f5afab20f4cf4170f10ec694f0a0b4ba0b07d5da4d0936ed98bc31e400988

Download Submit