6a5a301fd4ec633c3133577c716f1415318a7bbf268314db91b5bb32f11636f7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b23a1bf765abc03fbc585a3d8ff564f_JaffaCakes118.html
Size

50KB
MD5

4b23a1bf765abc03fbc585a3d8ff564f
SHA1

ec87831a99a6c3b7d82141bf182471fa84a542af
SHA256

6a5a301fd4ec633c3133577c716f1415318a7bbf268314db91b5bb32f11636f7
SHA512

a4345efb39a18a7e3914f511ceb825dab6542e7b4331a78fb16bdb9f35cf5aef8ca45d1293f6240eb23170e688ee409ea5dd20a03a1715222abb22cc3f31c56d
SSDEEP

768:SIcSb/C89RK6cLlrlNp7gtbSJ3dn2EtT6CUtoXL6NeR6CHJW/iy:SIcs/C8nOhXpUt6nbt0omBCH8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1512	msedge.exe
1512	msedge.exe
3340	msedge.exe
3340	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3340	msedge.exe
3340	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 4872	3340	msedge.exe	83
PID 3340 wrote to memory of 4872	3340	msedge.exe	83
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 3200	3340	msedge.exe	84
PID 3340 wrote to memory of 1512	3340	msedge.exe	85
PID 3340 wrote to memory of 1512	3340	msedge.exe	85
PID 3340 wrote to memory of 4780	3340	msedge.exe	86
PID 3340 wrote to memory of 4780	3340	msedge.exe	86
PID 3340 wrote to memory of 4780	3340	msedge.exe	86
PID 3340 wrote to memory of 4780	3340	msedge.exe	86
PID 3340 wrote to memory of 4780	3340	msedge.exe	86
PID 3340 wrote to memory of 4780	3340	msedge.exe	86
PID 3340 wrote to memory of 4780	3340	msedge.exe	86
PID 3340 wrote to memory of 4780	3340	msedge.exe	86
PID 3340 wrote to memory of 4780	3340	msedge.exe	86
PID 3340 wrote to memory of 4780	3340	msedge.exe	86
PID 3340 wrote to memory of 4780	3340	msedge.exe	86
PID 3340 wrote to memory of 4780	3340	msedge.exe	86
PID 3340 wrote to memory of 4780	3340	msedge.exe	86
PID 3340 wrote to memory of 4780	3340	msedge.exe	86
PID 3340 wrote to memory of 4780	3340	msedge.exe	86
PID 3340 wrote to memory of 4780	3340	msedge.exe	86
PID 3340 wrote to memory of 4780	3340	msedge.exe	86
PID 3340 wrote to memory of 4780	3340	msedge.exe	86
PID 3340 wrote to memory of 4780	3340	msedge.exe	86
PID 3340 wrote to memory of 4780	3340	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4b23a1bf765abc03fbc585a3d8ff564f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef8c746f8,0x7ffef8c74708,0x7ffef8c74718
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,2231260058007360163,7478925889629017903,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,2231260058007360163,7478925889629017903,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,2231260058007360163,7478925889629017903,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2231260058007360163,7478925889629017903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2231260058007360163,7478925889629017903,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,2231260058007360163,7478925889629017903,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2496 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6c86c838cf1dc704d2be375f04e1e6c6

SHA1
ad2911a13a3addc86cc46d4329b2b1621cbe7e35

SHA256
dff0886331bb45ec7711af92ab10be76291fde729dff23ca3270c86fb6e606bb

SHA512
a120248263919c687f09615fed56c7cac825c8c93c104488632cebc1abfa338c39ebdc191e5f0c45ff30f054f08d4c02d12b013de6322490197606ce0c0b4f37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27f3335bf37563e4537db3624ee378da

SHA1
57543abc3d97c2a2b251b446820894f4b0111aeb

SHA256
494425284ba12ee2fb07890e268be7890b258e1b1e5ecfa4a4dbc3411ab93b1a

SHA512
2bef861f9d2d916272f6014110fdee84afced515710c9d69b3c310f6bf41728d1b2d41fee3c86441ff96c08c7d474f9326e992b9164b9a3f13627f7d24d0c485

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a9b8b8490db5cdd9f2eadbb13dbe1bfe

SHA1
a5d01b351df322f95c542508ac32f06a1530f53f

SHA256
a3a7117c1a18dca0944e19b004dbfd1eb106aebece7175eb2755d70a87338d82

SHA512
1804bd715505ec4eb73e1c0c158536715a22870d78493530cb58329a96871cfd3c09abea6b12c9f32a5cbfdf669f6398d37cb977504410413e7d0ec0255d2611

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0aa1a17fe667702661530ab7ada33984

SHA1
093acda04af0ae83fb2b4a9bc4502d0cc1f8272d

SHA256
e2cc96e61ec06ca34dc7bba2026232c3a2d9153a736aed5b43722c07f5bf6911

SHA512
38214f0d2760dab2ffa38d6a14792e13d4c973fdb6fb2c3e16a65a7e22754fb3e1e594e040f1cf1dcf708067fe008da051f5cfa7557861da5f126c8da83ccabb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
140d95a06e44739c384d7bf5ca0ee681

SHA1
97ddc27469d64182580ee09ec5fa3025bb9216f3

SHA256
00d1950813e16954b9b25c773211046412ff8bbb79c9b242aae5bf362643b2e8

SHA512
7bcdab96310d7883152211123d8774b5d714d47439ed46a915247b970c59c5e924223a84c74b7269e17ab3c8b1f1bc02cca7fb898099dc9b74692bdce33823a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b3e81599e731e799a72d1531a3bb70aa

SHA1
35a10d343114a8d1754b920888f1efbe33eb37b3

SHA256
34069341a2ed12541e01250969d95a27ae506489fddc98d0d16cfd28123c2669

SHA512
e24211773d86e9e861d7c60036b462672c17e47a7a8e9b06f99ca05ae3a5dda98aa0b30c628112d1fa7834ab51ed1c46bd5772bc1f726ffad003365cd6e0dcc6

Download Submit