1030d441ec656eafe811166866d3940341899ff313c98baaad46ab65ffb062b6

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 01:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3b6f8bb25939ac119a212e9f1525446c_JaffaCakes118.html
Size

103KB
MD5

3b6f8bb25939ac119a212e9f1525446c
SHA1

4627e9957204fbfd0c442cfa676157f37dc44515
SHA256

1030d441ec656eafe811166866d3940341899ff313c98baaad46ab65ffb062b6
SHA512

34ddb6a1d805f8d64a4c53b864090340010bf8853513d2ed6c8fd401e98381ca97e70a083651aa93c4e2e86016ee49a89a6a4defbc32485e9667af29147f31e3
SSDEEP

1536:pbMjw2fMk1D3O9Pj2fcLPTHAjlSLXt1utcZUHbXxp:sIikLOtB

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
3880	msedge.exe
3880	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3880	msedge.exe
3880	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 4556	3880	msedge.exe	83
PID 3880 wrote to memory of 4556	3880	msedge.exe	83
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 1276	3880	msedge.exe	85
PID 3880 wrote to memory of 2004	3880	msedge.exe	86
PID 3880 wrote to memory of 2004	3880	msedge.exe	86
PID 3880 wrote to memory of 2904	3880	msedge.exe	87
PID 3880 wrote to memory of 2904	3880	msedge.exe	87
PID 3880 wrote to memory of 2904	3880	msedge.exe	87
PID 3880 wrote to memory of 2904	3880	msedge.exe	87
PID 3880 wrote to memory of 2904	3880	msedge.exe	87
PID 3880 wrote to memory of 2904	3880	msedge.exe	87
PID 3880 wrote to memory of 2904	3880	msedge.exe	87
PID 3880 wrote to memory of 2904	3880	msedge.exe	87
PID 3880 wrote to memory of 2904	3880	msedge.exe	87
PID 3880 wrote to memory of 2904	3880	msedge.exe	87
PID 3880 wrote to memory of 2904	3880	msedge.exe	87
PID 3880 wrote to memory of 2904	3880	msedge.exe	87
PID 3880 wrote to memory of 2904	3880	msedge.exe	87
PID 3880 wrote to memory of 2904	3880	msedge.exe	87
PID 3880 wrote to memory of 2904	3880	msedge.exe	87
PID 3880 wrote to memory of 2904	3880	msedge.exe	87
PID 3880 wrote to memory of 2904	3880	msedge.exe	87
PID 3880 wrote to memory of 2904	3880	msedge.exe	87
PID 3880 wrote to memory of 2904	3880	msedge.exe	87
PID 3880 wrote to memory of 2904	3880	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3b6f8bb25939ac119a212e9f1525446c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffa510746f8,0x7ffa51074708,0x7ffa51074718
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,9573644750928817748,10108238020616686405,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,9573644750928817748,10108238020616686405,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,9573644750928817748,10108238020616686405,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9573644750928817748,10108238020616686405,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9573644750928817748,10108238020616686405,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,9573644750928817748,10108238020616686405,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
04b60a51907d399f3685e03094b603cb

SHA1
228d18888782f4e66ca207c1a073560e0a4cc6e7

SHA256
87a9d9f1bd99313295b2ce703580b9d37c3a68b9b33026fdda4c2530f562e6a3

SHA512
2a8e3da94eaf0a6c4a2f29da6fec2796ba6a13cad6425bb650349a60eb3204643fc2fd1ab425f0251610cb9cce65e7dba459388b4e00c12ba3434a1798855c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9622e603d436ca747f3a4407a6ca952e

SHA1
297d9aed5337a8a7290ea436b61458c372b1d497

SHA256
ace0e47e358fba0831b508cd23949a503ae0e6a5c857859e720d1b6479ff2261

SHA512
f774c5c44f0fcdfb45847626f6808076dccabfbcb8a37d00329ec792e2901dc59636ef15c95d84d0080272571542d43b473ce11c2209ac251bee13bd611b200a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
06e3dad50efd446a8c497e2becb94d03

SHA1
991adfcf9ce8046d723d86914cd2b3527d3fb5d9

SHA256
8a1316f2916ae93f5cf06d5930b8dacc26b4b199f4dc5bd40acb06aaa6b292bc

SHA512
3a900cadc699e4124ded8a849450341fd94c1315d8518859e2b63990d7a2a6c56d23e8690269597716f3835d74ad2e075ec62e1ca8c5ba102bb9401a6e1e90d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e70f305e3d6ca03ceab9228d2d488ac3

SHA1
787a5852ffb8551eceebf85863eb4866348cefcf

SHA256
74f2cff61a68b033e9780c81058e529be90fa247ead63d93c37748ff061056bd

SHA512
43e15976f53ca16295b8ec91a63493cc241b8c26147eb597ae275daa9aaeee15c606c12e83b44af9d53bf2bccc265179e65c2f2e3d2f995e62e2f73374154c02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b771ae3729b73be80383a031ad3b8613

SHA1
c3c729fc4bfe5d8bc4885704de2f871af79d7f48

SHA256
7ea66ea52267d0c837feefdcb64ced7470b4a9db1d579bb1837624a8b9b320cd

SHA512
1ae94e5063bd0326f6661b4124626fa7547525e3b3b54e4add391510f2d232ae46ecd2c59f9d04c32df1c6d759644c8621e6161463b80526a8c40bc54c4cc68b

Download Submit