b94d9d672881dd429c7d3f520b9d1d9275879a5fca2dde81318a299f9f33f2bc

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2db30307fd067d14842274fbe57f47dc_JaffaCakes118.html
Size

102KB
MD5

2db30307fd067d14842274fbe57f47dc
SHA1

8e9a58aa808b6cef943bb33a69de29f15cca45b0
SHA256

b94d9d672881dd429c7d3f520b9d1d9275879a5fca2dde81318a299f9f33f2bc
SHA512

e2d3e4c8be9276ca4e65be5b02c87be5bddda5d485d929203c73723c3cc54e4f62cc4a95e62096b9edbd0da7858efc8305c52d940db9984b6cc86b2b976ad84a
SSDEEP

1536:pbMjw2fMk1D3O9Pj2fcZRmHA6+bLSeA/pcZ540WQp:sXP4Lopg

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe
808	msedge.exe
808	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
808	msedge.exe
808	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 4372	808	msedge.exe	82
PID 808 wrote to memory of 4372	808	msedge.exe	82
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 3144	808	msedge.exe	83
PID 808 wrote to memory of 2472	808	msedge.exe	84
PID 808 wrote to memory of 2472	808	msedge.exe	84
PID 808 wrote to memory of 2504	808	msedge.exe	85
PID 808 wrote to memory of 2504	808	msedge.exe	85
PID 808 wrote to memory of 2504	808	msedge.exe	85
PID 808 wrote to memory of 2504	808	msedge.exe	85
PID 808 wrote to memory of 2504	808	msedge.exe	85
PID 808 wrote to memory of 2504	808	msedge.exe	85
PID 808 wrote to memory of 2504	808	msedge.exe	85
PID 808 wrote to memory of 2504	808	msedge.exe	85
PID 808 wrote to memory of 2504	808	msedge.exe	85
PID 808 wrote to memory of 2504	808	msedge.exe	85
PID 808 wrote to memory of 2504	808	msedge.exe	85
PID 808 wrote to memory of 2504	808	msedge.exe	85
PID 808 wrote to memory of 2504	808	msedge.exe	85
PID 808 wrote to memory of 2504	808	msedge.exe	85
PID 808 wrote to memory of 2504	808	msedge.exe	85
PID 808 wrote to memory of 2504	808	msedge.exe	85
PID 808 wrote to memory of 2504	808	msedge.exe	85
PID 808 wrote to memory of 2504	808	msedge.exe	85
PID 808 wrote to memory of 2504	808	msedge.exe	85
PID 808 wrote to memory of 2504	808	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2db30307fd067d14842274fbe57f47dc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe4f5446f8,0x7ffe4f544708,0x7ffe4f544718
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,5565373932811649026,16036562241557708513,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,5565373932811649026,16036562241557708513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,5565373932811649026,16036562241557708513,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5565373932811649026,16036562241557708513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5565373932811649026,16036562241557708513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,5565373932811649026,16036562241557708513,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3068 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b6c11a2e74ef272858b9bcac8f5ebf97

SHA1
2a06945314ebaa78f3ede1ff2b79f7357c3cb36b

SHA256
f88faeb70e2a7849587be3e49e6884f5159ac76ef72b7077ac36e5fbf332d777

SHA512
d577a5b3a264829494f5520cc975f4c2044648d51438885f319c2c74a080ea5dd719b6a885ed4d3401fd7a32341f88f26da5e3f29214da9afbbbd5ee950e8ec3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9abb787f6c5a61faf4408f694e89b50e

SHA1
914247144868a2ff909207305255ab9bbca33d7e

SHA256
ecfd876b653319de412bf6be83bd824dda753b4d9090007231a335819d29ea07

SHA512
0f8139c45a7efab6de03fd9ebfe152e183ff155f20b03d4fac4a52cbbf8a3779302fed56facc9c7678a2dcf4f1ee89a26efd5bada485214edd9bf6b5cd238a55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
130239a9ffab3da0b03a021f768a8000

SHA1
64518aa96a51cef972838e25735df5e1916c0ef4

SHA256
8358300cfcaca4b97d65cebd8609b1b0ea5578dee12269b146aa634fdadec174

SHA512
21190e3566852b52523f74dd7be71b7cf2b2f021136954b297f73a378b6597adfb734beeb327ea070d9f9510863bacf7ea6b1f53b82f37289fb459b2c505bf7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3c8b3178a2490419838ea947afb946f2

SHA1
3592ab963dd381a84a913188cc726f9ff9a9d7af

SHA256
4b9fd7b050ccf7d8cdf165b7c8d83f5c570f66e077ff0f30675757cd4bd3b52e

SHA512
6a2709c75c67999a46e59891830813b24fb150e2ae6fab601f4155ed1c8643fc04ffb9456bc2ee7d7887e4efa39804adca4508cba2f856f36a66266c09dd57cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
67780a7b069bf24d19acbb08e72d185e

SHA1
464e2e10cc7a102fe02c98a0e8b2158a27b20074

SHA256
e0ba4bdf86a96ea4c95ff3b5d965ca6c9dcac0a0db072e0db220425eff1cecb3

SHA512
18b8628c0be44c4b71957d461cc9fad38fb3e6c2ec2cc74ce95cceaab0f17eb1eca09b3e752db7dcd330e4717ace5dfa8b5ef70a760a56fe77fc9b41fb4b979c

Download Submit