8f229b52d9877f1110af33fca91ba6eb918b81819f1cd9e9e899f7245c8ce0c5

Analysis

max time kernel
146s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 13:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2c832dfe17bbf60f2ad2136dd016375a_JaffaCakes118.html
Size

2KB
MD5

2c832dfe17bbf60f2ad2136dd016375a
SHA1

a22f3093248edcbe6dd503df32dcd89559308fae
SHA256

8f229b52d9877f1110af33fca91ba6eb918b81819f1cd9e9e899f7245c8ce0c5
SHA512

5382b30a7f00aa5a6438bc31a6311e1137e7b918f15b62c9ed8cd6303a63aa95cf46fdeb82373f43c1683011dfc3c710f617668211d2467a2116861dd2a124a6

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3348	msedge.exe
3348	msedge.exe
4156	msedge.exe
4156	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4156	msedge.exe
4156	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 3956	4156	msedge.exe	82
PID 4156 wrote to memory of 3956	4156	msedge.exe	82
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3596	4156	msedge.exe	85
PID 4156 wrote to memory of 3348	4156	msedge.exe	86
PID 4156 wrote to memory of 3348	4156	msedge.exe	86
PID 4156 wrote to memory of 3332	4156	msedge.exe	87
PID 4156 wrote to memory of 3332	4156	msedge.exe	87
PID 4156 wrote to memory of 3332	4156	msedge.exe	87
PID 4156 wrote to memory of 3332	4156	msedge.exe	87
PID 4156 wrote to memory of 3332	4156	msedge.exe	87
PID 4156 wrote to memory of 3332	4156	msedge.exe	87
PID 4156 wrote to memory of 3332	4156	msedge.exe	87
PID 4156 wrote to memory of 3332	4156	msedge.exe	87
PID 4156 wrote to memory of 3332	4156	msedge.exe	87
PID 4156 wrote to memory of 3332	4156	msedge.exe	87
PID 4156 wrote to memory of 3332	4156	msedge.exe	87
PID 4156 wrote to memory of 3332	4156	msedge.exe	87
PID 4156 wrote to memory of 3332	4156	msedge.exe	87
PID 4156 wrote to memory of 3332	4156	msedge.exe	87
PID 4156 wrote to memory of 3332	4156	msedge.exe	87
PID 4156 wrote to memory of 3332	4156	msedge.exe	87
PID 4156 wrote to memory of 3332	4156	msedge.exe	87
PID 4156 wrote to memory of 3332	4156	msedge.exe	87
PID 4156 wrote to memory of 3332	4156	msedge.exe	87
PID 4156 wrote to memory of 3332	4156	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2c832dfe17bbf60f2ad2136dd016375a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa2b0146f8,0x7ffa2b014708,0x7ffa2b014718
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,9735707065569041868,4251582644634661002,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,9735707065569041868,4251582644634661002,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,9735707065569041868,4251582644634661002,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9735707065569041868,4251582644634661002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9735707065569041868,4251582644634661002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,9735707065569041868,4251582644634661002,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f0f818d52a59eb6cf9c4dd2a1c844df9

SHA1
26afc4b28c0287274624690bd5bd4786cfe11d16

SHA256
58c0beea55fecbeded2d2c593473149214df818be1e4e4a28c97171dc8179d61

SHA512
7e8a1d3a6c8c9b0f1ac497e509e9edbe9e121df1df0147ce4421b8cf526ad238bd146868e177f9ce02e2d8f99cf7bb9ce7db4a582d487bbc921945211a977509

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0331fa75ac7846bafcf885ea76d47447

SHA1
5a141ffda430e091153fefc4aa36317422ba28ae

SHA256
64b4b2e791644fc04f164ecd13b8b9a3e62669896fb7907bf0a072bbeebaf74a

SHA512
f8b960d38d73cf29ce17ea409ef6830cae99d7deafaf2ff59f8347120d81925ff16e38faaa0f7f4c39936472d05d1d131df2a8a383351f138c38afb21c1a60e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
622f713b8698b1e4a9426a09e95af8de

SHA1
bd6eb5d01b5cf8097f9f72b967e28f7704e7df70

SHA256
50fc242ae4113f184f91f0b157302655a3559e1af46797e0667ac53be4d16f70

SHA512
5f60be365aae05cd52446126f3cee3223f98c582d0b4485902cdb997f703ecbb7ac64f55ebb5d7014d07e6990e9a7dfced29ccf6c2ce1d511035f4a3fe673e6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ad4549aa08eb3870ad0dcc734f78b71b

SHA1
9d53745c76c848949fdc15ae340ba573d5718fa0

SHA256
62502a0208b8717c64263704452524c628ed98665f7056c7270028d2af944be3

SHA512
351f46e7c5db7fecb928afb84b4bfbe567a770d6592ab7940770b4d3dae120393b698b4ed06b8e3ed15da7ddb5b65b0096785eabfcedea810554eb7d7481b141

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
efa7892427cf5dd67163ecb4bb374101

SHA1
c0f01337ac4bc77f4663736f125110aaba01c10f

SHA256
61403b89364d3bb13b1c9b7ab1d9129cc930dae21000f9fb6b90c597d13d3361

SHA512
1ebf521be1a394866fd4ce439a199310fcb78094e10872f87a708a242b31cc2c684a4389a70a87794216fc3b818437594d0fb15b664a05ac0283c97c40e2bd38

Download Submit