8793c0d975e67ba357b2243345baba61c983ed0f7f6f7d3dcdd66a472cfa47f2

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 01:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32d57748a33c9b91805849dac7052873_JaffaCakes118.html
Size

58KB
MD5

32d57748a33c9b91805849dac7052873
SHA1

9e6030af114d289a87d48e10a6baeda7ad9c6ba7
SHA256

8793c0d975e67ba357b2243345baba61c983ed0f7f6f7d3dcdd66a472cfa47f2
SHA512

ef0774a4836748618e9dd25cde7a49377686335e5a75de2cfd0e29295e5c4da2992a87310d48b7e048a23f96572547503599f0f467df249e99f895d6275f54ed
SSDEEP

1536:sXtW/PbhxoVDa5gLj5a3gVk/AE/VEdVsoVgtv9VPZVMV0tMVLgpRkV13+Vk+jNjD:MQQa56j5aJAvKpp

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
4112	msedge.exe
4112	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 2776	4112	msedge.exe	81
PID 4112 wrote to memory of 2776	4112	msedge.exe	81
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2692	4112	msedge.exe	83
PID 4112 wrote to memory of 2868	4112	msedge.exe	84
PID 4112 wrote to memory of 2868	4112	msedge.exe	84
PID 4112 wrote to memory of 3616	4112	msedge.exe	85
PID 4112 wrote to memory of 3616	4112	msedge.exe	85
PID 4112 wrote to memory of 3616	4112	msedge.exe	85
PID 4112 wrote to memory of 3616	4112	msedge.exe	85
PID 4112 wrote to memory of 3616	4112	msedge.exe	85
PID 4112 wrote to memory of 3616	4112	msedge.exe	85
PID 4112 wrote to memory of 3616	4112	msedge.exe	85
PID 4112 wrote to memory of 3616	4112	msedge.exe	85
PID 4112 wrote to memory of 3616	4112	msedge.exe	85
PID 4112 wrote to memory of 3616	4112	msedge.exe	85
PID 4112 wrote to memory of 3616	4112	msedge.exe	85
PID 4112 wrote to memory of 3616	4112	msedge.exe	85
PID 4112 wrote to memory of 3616	4112	msedge.exe	85
PID 4112 wrote to memory of 3616	4112	msedge.exe	85
PID 4112 wrote to memory of 3616	4112	msedge.exe	85
PID 4112 wrote to memory of 3616	4112	msedge.exe	85
PID 4112 wrote to memory of 3616	4112	msedge.exe	85
PID 4112 wrote to memory of 3616	4112	msedge.exe	85
PID 4112 wrote to memory of 3616	4112	msedge.exe	85
PID 4112 wrote to memory of 3616	4112	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\32d57748a33c9b91805849dac7052873_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9923746f8,0x7ff992374708,0x7ff992374718
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,9063171583709528422,1754787550486427052,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,9063171583709528422,1754787550486427052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1964,9063171583709528422,1754787550486427052,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9063171583709528422,1754787550486427052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,9063171583709528422,1754787550486427052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,9063171583709528422,1754787550486427052,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
584971c8ba88c824fd51a05dddb45a98

SHA1
b7c9489b4427652a9cdd754d1c1b6ac4034be421

SHA256
e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307

SHA512
5dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b28ef7d9f6d74f055cc49876767c886c

SHA1
d6b3267f36c340979f8fc3e012fdd02c468740bf

SHA256
fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37

SHA512
491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5896c12008f6942521f4b5fde1865b6d

SHA1
06f28d6a1368dabcde566ef361986ac867143bcb

SHA256
480b16cd09db094890809715c3ccc8d296d98615308b69e2d59d5a64df31c1ae

SHA512
9e2f3d2d1daa0e004bd313d79a4194293d91f8cf674fd39edb79d6735f64d6e2196c27eb6ac749e6921a94b04f6a8e75685d42ae99fc3a13353b23b61e2f7977

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c9ab9869f6bacb6b5236d26028880255

SHA1
36e478752395ee61756f7650423bde81366f8e16

SHA256
c9bb00eef0da9fbf9a597b02c0136de0d29752e8b0c6e2232d8b01771802a20a

SHA512
d805b46bc0297b47c965a43275ec37b7403287ca2e1ea4f02247506d2ebb49fcd23ac4c5a9cd3abb139a817fd3e6e15fbd499070f591c6615269d41673abedc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df752de5f023e21a775642361f13c3ff

SHA1
3e928b27ca516af679d64ab7306ed7ef1c79f71f

SHA256
98da40fa22aba46be6d594d2af6ea7d69da38ec251c1da75bfeaa676b5838a30

SHA512
e476eb1c53f055a220ae6dba016cc2927ef7b4d7b7b2eb7d6660beec1a548bde3bd149a7e21489fdafc8b5359cb1011b723115078e799c80486772e69b4b2dd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
03cff6d81460244417be7c315598a9df

SHA1
9f5ecdf73af989e49c3ab2962d2a0cdd3bb4790d

SHA256
602981d571b81741a67312744bb7a91a72979d63cbd30aee61f7e312d076224b

SHA512
6e3cf5044a1a33d1536b9997d7b29f2ec644b2c2eada8fdd266c298ccb01ad1db0b1686785d2e2f576d83ba7fcd37bbe6eae3a8c8532de7233e6ae868cccaee4

Download Submit