02e10d064676cbf55da84672dc733c6758c3a6dc34cef49c967161265625f055

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 16:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39e4b385074e82c9eaeb1e0b976bb9ab_JaffaCakes118.html
Size

115KB
MD5

39e4b385074e82c9eaeb1e0b976bb9ab
SHA1

9161bc3b47c11924e074f6035d6b4210a77c86d1
SHA256

02e10d064676cbf55da84672dc733c6758c3a6dc34cef49c967161265625f055
SHA512

5f3f67282b9a27336a89ac22bdfeb492a0aadc6c768b21e081f376e6e30ddfb949ddacdaf4e22dbf5c5b7977e890d2809656a4443baa6a7208144f722273bebc
SSDEEP

1536:pbMjw2fMk1D3O9Pj2fcqaLHAqcpLXhxxcZQDHDtp:s03QL5x

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
2624	msedge.exe
2624	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2856	2624	msedge.exe	83
PID 2624 wrote to memory of 2856	2624	msedge.exe	83
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 1368	2624	msedge.exe	85
PID 2624 wrote to memory of 4872	2624	msedge.exe	86
PID 2624 wrote to memory of 4872	2624	msedge.exe	86
PID 2624 wrote to memory of 2812	2624	msedge.exe	87
PID 2624 wrote to memory of 2812	2624	msedge.exe	87
PID 2624 wrote to memory of 2812	2624	msedge.exe	87
PID 2624 wrote to memory of 2812	2624	msedge.exe	87
PID 2624 wrote to memory of 2812	2624	msedge.exe	87
PID 2624 wrote to memory of 2812	2624	msedge.exe	87
PID 2624 wrote to memory of 2812	2624	msedge.exe	87
PID 2624 wrote to memory of 2812	2624	msedge.exe	87
PID 2624 wrote to memory of 2812	2624	msedge.exe	87
PID 2624 wrote to memory of 2812	2624	msedge.exe	87
PID 2624 wrote to memory of 2812	2624	msedge.exe	87
PID 2624 wrote to memory of 2812	2624	msedge.exe	87
PID 2624 wrote to memory of 2812	2624	msedge.exe	87
PID 2624 wrote to memory of 2812	2624	msedge.exe	87
PID 2624 wrote to memory of 2812	2624	msedge.exe	87
PID 2624 wrote to memory of 2812	2624	msedge.exe	87
PID 2624 wrote to memory of 2812	2624	msedge.exe	87
PID 2624 wrote to memory of 2812	2624	msedge.exe	87
PID 2624 wrote to memory of 2812	2624	msedge.exe	87
PID 2624 wrote to memory of 2812	2624	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\39e4b385074e82c9eaeb1e0b976bb9ab_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd1f746f8,0x7ffdd1f74708,0x7ffdd1f74718
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11661905241107112481,17798971095253001510,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,11661905241107112481,17798971095253001510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,11661905241107112481,17798971095253001510,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11661905241107112481,17798971095253001510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11661905241107112481,17798971095253001510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11661905241107112481,17798971095253001510,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1260 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
04b60a51907d399f3685e03094b603cb

SHA1
228d18888782f4e66ca207c1a073560e0a4cc6e7

SHA256
87a9d9f1bd99313295b2ce703580b9d37c3a68b9b33026fdda4c2530f562e6a3

SHA512
2a8e3da94eaf0a6c4a2f29da6fec2796ba6a13cad6425bb650349a60eb3204643fc2fd1ab425f0251610cb9cce65e7dba459388b4e00c12ba3434a1798855c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9622e603d436ca747f3a4407a6ca952e

SHA1
297d9aed5337a8a7290ea436b61458c372b1d497

SHA256
ace0e47e358fba0831b508cd23949a503ae0e6a5c857859e720d1b6479ff2261

SHA512
f774c5c44f0fcdfb45847626f6808076dccabfbcb8a37d00329ec792e2901dc59636ef15c95d84d0080272571542d43b473ce11c2209ac251bee13bd611b200a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fa51fee14cca6da1d889e4edab9eb5a5

SHA1
ee730487624732190d7c635ad05600a517eb25fb

SHA256
833b41b1c3803e926df4df6502e80e8ac768bc026a4c98b11cd2c9d68b3f25c4

SHA512
8ea8eb485f2b19b058df8e49abae9777537798029a44a79816bdd7e5e03671a6ab4fb19b57ca4e1bca16808356b82dd68d95e96fe232ee8a6cbab4c2ebb96392

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bacd56e8-39e6-4833-bf97-ef961a9ec5a7.tmp

Filesize
6KB

MD5
2a73c9cc5765c23fdf327db376af2fcd

SHA1
e15db3951db0c33e3e115c26a625bae90984e7ac

SHA256
8eb9b5ee6f168eceda8b082a26697a8d2fdf2c2f4474c6bc81b4e7880bae3f5a

SHA512
751b78924aa44bf4a6ad92a92af4c0093c84beaa24abba50a2b7aa19ff07d035d71216d863f678aa54ae12d4751c1b4335f9d6eda49d0bff8e820727534eaecd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
97771777579d1b6f6cad53855e8a09db

SHA1
f42fb55fa5fb3329141b30700a9979a6ee98485a

SHA256
842c27395f53e10ba62fb26aaa45f1564c455a877c18a8e4eefed8f058af62b5

SHA512
ac099e7fe212f3bc68ec31d51b1a1bb0cfcb833920f8c0776e2b407fb56e1aa5720c3f224750c8be6ccf8d830ca346259362905b21dabd5a3fc5e446086cb979

Download Submit