0aa01ead6725bfcc0301bdbdb443d96742e7c3e5502769e4308b3b49709ae67c

Analysis

max time kernel
145s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 05:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f176f49719f6d2d6680a560fcb4e5d1_JaffaCakes118.html
Size

244KB
MD5

2f176f49719f6d2d6680a560fcb4e5d1
SHA1

30b629ba02f11e46c80d5fda6fcc8e6a019299f7
SHA256

0aa01ead6725bfcc0301bdbdb443d96742e7c3e5502769e4308b3b49709ae67c
SHA512

0e55982e3c06d3ff62c4d835523d8fab9fdc56a5494d466d7df92c9bdc18df355fae2a09388369ab743a155962aa5d91c1b7921a8ccb894d28ac9038ce00466e
SSDEEP

1536:pbMjw2fMk1D3O9Pj2fcGOeHAN8dLMoeKoFXRcZTy2gOp:sHAgLuFXR+

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
768	msedge.exe
768	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
768	msedge.exe
768	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe
768	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 4032	768	msedge.exe	82
PID 768 wrote to memory of 4032	768	msedge.exe	82
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 2648	768	msedge.exe	84
PID 768 wrote to memory of 4948	768	msedge.exe	85
PID 768 wrote to memory of 4948	768	msedge.exe	85
PID 768 wrote to memory of 1168	768	msedge.exe	86
PID 768 wrote to memory of 1168	768	msedge.exe	86
PID 768 wrote to memory of 1168	768	msedge.exe	86
PID 768 wrote to memory of 1168	768	msedge.exe	86
PID 768 wrote to memory of 1168	768	msedge.exe	86
PID 768 wrote to memory of 1168	768	msedge.exe	86
PID 768 wrote to memory of 1168	768	msedge.exe	86
PID 768 wrote to memory of 1168	768	msedge.exe	86
PID 768 wrote to memory of 1168	768	msedge.exe	86
PID 768 wrote to memory of 1168	768	msedge.exe	86
PID 768 wrote to memory of 1168	768	msedge.exe	86
PID 768 wrote to memory of 1168	768	msedge.exe	86
PID 768 wrote to memory of 1168	768	msedge.exe	86
PID 768 wrote to memory of 1168	768	msedge.exe	86
PID 768 wrote to memory of 1168	768	msedge.exe	86
PID 768 wrote to memory of 1168	768	msedge.exe	86
PID 768 wrote to memory of 1168	768	msedge.exe	86
PID 768 wrote to memory of 1168	768	msedge.exe	86
PID 768 wrote to memory of 1168	768	msedge.exe	86
PID 768 wrote to memory of 1168	768	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2f176f49719f6d2d6680a560fcb4e5d1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8735f46f8,0x7ff8735f4708,0x7ff8735f4718
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,16119322082094374842,2047224667264558003,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,16119322082094374842,2047224667264558003,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,16119322082094374842,2047224667264558003,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,16119322082094374842,2047224667264558003,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,16119322082094374842,2047224667264558003,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,16119322082094374842,2047224667264558003,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f0f818d52a59eb6cf9c4dd2a1c844df9

SHA1
26afc4b28c0287274624690bd5bd4786cfe11d16

SHA256
58c0beea55fecbeded2d2c593473149214df818be1e4e4a28c97171dc8179d61

SHA512
7e8a1d3a6c8c9b0f1ac497e509e9edbe9e121df1df0147ce4421b8cf526ad238bd146868e177f9ce02e2d8f99cf7bb9ce7db4a582d487bbc921945211a977509

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0331fa75ac7846bafcf885ea76d47447

SHA1
5a141ffda430e091153fefc4aa36317422ba28ae

SHA256
64b4b2e791644fc04f164ecd13b8b9a3e62669896fb7907bf0a072bbeebaf74a

SHA512
f8b960d38d73cf29ce17ea409ef6830cae99d7deafaf2ff59f8347120d81925ff16e38faaa0f7f4c39936472d05d1d131df2a8a383351f138c38afb21c1a60e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dd520c85a0a430820720db6deba3d1ec

SHA1
dd9dbaed12ceebe3b1a43d4b13b9d03fc5947a57

SHA256
899882aaae62f2c482a1ecff8cdb0ca23bcc52cf99c3e3a9f5cdd5bc9c322760

SHA512
0e64a3286e03539dfd12c3ecf833585cfb7edbcab1794a3580c1bdd74ee5aeebc436cb49cb5c990a05d91a704a48e383d340831f15ae23cd2fae35c24b573703

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
30e739e487c55b50d7e066d83f9e3c65

SHA1
b9aa02199dde2e965f365e44a4cc604a0651500e

SHA256
01b59e877c40802a7516cf0f7599bf96aedfb20dbc772479cb26352bc8dd2754

SHA512
f90c891350081e54bd4d3d03d25fcbae4c37feede0612406639fb84203669c95d2a3ad96e0b29095719f15ac6c469e77249d6582c0a87db60cd6391284139818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
93101b7df6757170c977dc41fd3da59b

SHA1
a15ec4d927e52833073d5087af96fb2ab7678582

SHA256
22a361d7c6392846c672ed7a15dde53404f65c6753555497afc2dc1427c0b86a

SHA512
1c7abdfb206acf67719dcba44c2e82e631f6e6395345fff40cdb306e65e9fe880827e221c62931e9ed1b89d5b655e81e5bb668755e1ed7841c376f5b77aba8dd

Download Submit