623f374db2525822f6695b41b2898efef2b06c9a30e2c469be684d2152834a7c

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 06:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3c5b19d2ffb731d93f1b0262f99c4336_JaffaCakes118.html
Size

125KB
MD5

3c5b19d2ffb731d93f1b0262f99c4336
SHA1

7d20a5ed54cf79534730efbd7ac8952c9f520c45
SHA256

623f374db2525822f6695b41b2898efef2b06c9a30e2c469be684d2152834a7c
SHA512

f8ffa6c8f153846f05188c03ca74fc56183b97dabb0c303781da2905efc82856245d43e24c6043d8306cccfdae98546975cd1da19863f35e3f2420ec375f42de
SSDEEP

768:nx5l8HIUGvYb9EvyjHRpb7nhnNLa2RKUlcMka6ZW6DBbxA5R16jQyWxOO+:nbUEG9EYDXnvLVRKzMmW6oR16jQJwO+

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4804	msedge.exe
4804	msedge.exe
3256	msedge.exe
3256	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 4800	3256	msedge.exe	83
PID 3256 wrote to memory of 4800	3256	msedge.exe	83
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 2092	3256	msedge.exe	84
PID 3256 wrote to memory of 4804	3256	msedge.exe	85
PID 3256 wrote to memory of 4804	3256	msedge.exe	85
PID 3256 wrote to memory of 3940	3256	msedge.exe	86
PID 3256 wrote to memory of 3940	3256	msedge.exe	86
PID 3256 wrote to memory of 3940	3256	msedge.exe	86
PID 3256 wrote to memory of 3940	3256	msedge.exe	86
PID 3256 wrote to memory of 3940	3256	msedge.exe	86
PID 3256 wrote to memory of 3940	3256	msedge.exe	86
PID 3256 wrote to memory of 3940	3256	msedge.exe	86
PID 3256 wrote to memory of 3940	3256	msedge.exe	86
PID 3256 wrote to memory of 3940	3256	msedge.exe	86
PID 3256 wrote to memory of 3940	3256	msedge.exe	86
PID 3256 wrote to memory of 3940	3256	msedge.exe	86
PID 3256 wrote to memory of 3940	3256	msedge.exe	86
PID 3256 wrote to memory of 3940	3256	msedge.exe	86
PID 3256 wrote to memory of 3940	3256	msedge.exe	86
PID 3256 wrote to memory of 3940	3256	msedge.exe	86
PID 3256 wrote to memory of 3940	3256	msedge.exe	86
PID 3256 wrote to memory of 3940	3256	msedge.exe	86
PID 3256 wrote to memory of 3940	3256	msedge.exe	86
PID 3256 wrote to memory of 3940	3256	msedge.exe	86
PID 3256 wrote to memory of 3940	3256	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3c5b19d2ffb731d93f1b0262f99c4336_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffadcb546f8,0x7ffadcb54708,0x7ffadcb54718
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,15769999332386066740,5082178675472230173,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,15769999332386066740,5082178675472230173,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,15769999332386066740,5082178675472230173,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15769999332386066740,5082178675472230173,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15769999332386066740,5082178675472230173,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15769999332386066740,5082178675472230173,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15769999332386066740,5082178675472230173,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15769999332386066740,5082178675472230173,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,15769999332386066740,5082178675472230173,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4852 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaaad45aced1889a90a8aa4c39f92659

SHA1
5c0130d9e8d1a64c97924090d9a5258b8a31b83c

SHA256
5e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b

SHA512
0db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3ee50fb26a9d3f096c47ff8696c24321

SHA1
a8c83e798d2a8b31fec0820560525e80dfa4fe66

SHA256
d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f

SHA512
479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
def2ce71929965e4d2f84680b740c2be

SHA1
3b5eeea442c942a82fa71cdee238b41922023b0b

SHA256
b6475b84585b69fc05f3d3aacd0b95b4c05840a33f1b74d6773a3e9ad029dbe6

SHA512
67078e79df8d7e6dfdc73d6547dca433de55421f4fd28621083174d40bb0ced2cc4883a25bf401aeb581547df26b76b30512570e79121bb61f03ed1be8b729f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b367473481779af67135c662480546b9

SHA1
3d4f021be94a214b3ccb24614d834bfa92b918f6

SHA256
6b8b9fda4255c5ce20f568a443df586e87000c0dfe56d619085cea3cc01798ec

SHA512
8889e73c4d497fc4e1234a79a78a3f1283c295fe3e741431997b26ca22422f56870af9964a231fd959f67aec689146bff5ec1c5c2e0978c4cef27f9dea350596

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
01b9ab0b74c01aa12a741bf90d25136f

SHA1
d4a8a223b9e3acd3183ccb66ffb3f3dfd9ca2b63

SHA256
4ddb35fac02c050af431121d9cf1ee9c857b36e223b04a6310cc7ca6cfd77cca

SHA512
a680733048243076033605e25cb9293b7145f5d182f3b9d07c2a8c933746f887f18f7f2a3f7ca60d43bfd2db6a798005af209df71532b691189a08574f088fa5

Download Submit