62bd10914a67ecb7e6fbedd9172d498f965af1550b9ce317e7518d156c08fa14

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240708-en
resource tags

arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 08:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2fa5475ce19587b016c8272f3ff66bbb_JaffaCakes118.html
Size

122KB
MD5

2fa5475ce19587b016c8272f3ff66bbb
SHA1

051011b0eef45a76e742aabd718061e5969b66aa
SHA256

62bd10914a67ecb7e6fbedd9172d498f965af1550b9ce317e7518d156c08fa14
SHA512

1b779d544b4a6960a6d9447adaddb2f0861e56f093ef4a8850f58cdb5cf42147a132131062d5aebc9c529dce92f7d82a4c523cd3f9dcdade8d2e3280e27a0d8f
SSDEEP

768:qxz3sXqUD0Iv4thkK8zL+vyf2WGEZ5HrLBzRmxGVNXTR79UCovyGjNcV6vuYwFC:qlcVqhkK8zL+TWGEzLRRmGXNWCov5b

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3044	msedge.exe
3044	msedge.exe
2184	msedge.exe
2184	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 4000	2184	msedge.exe	82
PID 2184 wrote to memory of 4000	2184	msedge.exe	82
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 5100	2184	msedge.exe	84
PID 2184 wrote to memory of 3044	2184	msedge.exe	85
PID 2184 wrote to memory of 3044	2184	msedge.exe	85
PID 2184 wrote to memory of 3204	2184	msedge.exe	86
PID 2184 wrote to memory of 3204	2184	msedge.exe	86
PID 2184 wrote to memory of 3204	2184	msedge.exe	86
PID 2184 wrote to memory of 3204	2184	msedge.exe	86
PID 2184 wrote to memory of 3204	2184	msedge.exe	86
PID 2184 wrote to memory of 3204	2184	msedge.exe	86
PID 2184 wrote to memory of 3204	2184	msedge.exe	86
PID 2184 wrote to memory of 3204	2184	msedge.exe	86
PID 2184 wrote to memory of 3204	2184	msedge.exe	86
PID 2184 wrote to memory of 3204	2184	msedge.exe	86
PID 2184 wrote to memory of 3204	2184	msedge.exe	86
PID 2184 wrote to memory of 3204	2184	msedge.exe	86
PID 2184 wrote to memory of 3204	2184	msedge.exe	86
PID 2184 wrote to memory of 3204	2184	msedge.exe	86
PID 2184 wrote to memory of 3204	2184	msedge.exe	86
PID 2184 wrote to memory of 3204	2184	msedge.exe	86
PID 2184 wrote to memory of 3204	2184	msedge.exe	86
PID 2184 wrote to memory of 3204	2184	msedge.exe	86
PID 2184 wrote to memory of 3204	2184	msedge.exe	86
PID 2184 wrote to memory of 3204	2184	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2fa5475ce19587b016c8272f3ff66bbb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9780a46f8,0x7ff9780a4708,0x7ff9780a4718
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,1907670004161088358,15216723209166086357,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,1907670004161088358,15216723209166086357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2564 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,1907670004161088358,15216723209166086357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1907670004161088358,15216723209166086357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1907670004161088358,15216723209166086357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1907670004161088358,15216723209166086357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1907670004161088358,15216723209166086357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1907670004161088358,15216723209166086357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,1907670004161088358,15216723209166086357,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
97f8be9c465b0ed67c2415868506c354

SHA1
cdb221d6debcf55615d3b5f30796e32065046dd9

SHA256
b606a1ee10b65eb9077e7d2f3b34a0d7a1ed6a4802a169fe55449c975332ee02

SHA512
a0fe0ed30624658127316873137f4fc488a5916005e5e3f1f55b7d6442b54010c08d7037b94d0cf3c3316b1bb4acf91bad9e64ee6d15302e3cdd62bb18730542

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6ae84fc1e66cbbb7e9d28b0e12d64550

SHA1
100430bb653c896c11b94ac0bf2297a389ea5ad8

SHA256
856a9c0ac8c29f738a3501b6bd007fd8cbbac211e461b91f4caff52dd41da75c

SHA512
7fe7a8639d96118b843e67a6a6d397271b181dc6b049e6f7de77bee9c9214690b1b7f73164f7e463e117406dc978334ea02397fd639140598f60f89c6aaddbe8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d1cfc515442bf973445a2e0561eae70d

SHA1
ca524c2440ebeae5bb82ffaded376f7f40e61091

SHA256
fe89bb3903d1d584808a599469db96415e2b1a964f0724b5ecc78a22192563c9

SHA512
d8835b352601a48537dbee3913d4ae86f99826b3636d7d63d23b6fe2670bc9a366462ae06e147e044326676b6ed89bd30e1ad03876bdee3b043f86a6eaa55962

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
231c03b3a86aa87db9b0edfaf7e0fcbe

SHA1
5fe02c42341e1c063c830f3fca328b988cc1f281

SHA256
f53f3d221572a8dad5892fe6b486923244e2dec2be0a655af5f58749c8d7ec5e

SHA512
da290f2b2af735d68e8f01579c3166cfc7f218882370a49c1125b55350703ee463480df9ce65645fc77709c26148836580285aace8c7f210f5db457c8daf99bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a17a3e6da62c16577b6d6034784c4038

SHA1
5adfff9cb8a8881636d0c93cd0cbf635e85c742e

SHA256
ac9302506b3c48d3fd52641cc57cd7d8399129b0b49e8335246ebd1aab122d33

SHA512
64405f9aa3e6d90f59051d37407e7ecc8658f1b28864343b32a2be477a86864715e15072ad7222e9746fff380b3d0c1f0aaeaad5ab21b3b89b7d8252ea35bcf7

Download Submit