3bf889567d17523288594f4898e7a587036b37dbcee93cdb3ef16425f915d892

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 20:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4b4db5630c1974ce633fb0bfcd768c95_JaffaCakes118.html
Size

120KB
MD5

4b4db5630c1974ce633fb0bfcd768c95
SHA1

3bd1a1786056ecb6b5cb7b060fe8107475dd5382
SHA256

3bf889567d17523288594f4898e7a587036b37dbcee93cdb3ef16425f915d892
SHA512

3f1c6caf41bb795f2300b88fb4b674496553880ecd4b681dc8355616e0cc88e5f6292b855834df593132f48b979a07b47bd9deea1cce8c648e003a5476c7b042
SSDEEP

768:lxx9S8iyNvWyhUa4v+RKyQLgkomyJ1JHyJQmeLah2DkvNJGZQ7borQXHJk3KZ+IB:lHAwXUa41kbXByJUaIDAIUk3KZDlIBM

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3068	msedge.exe
3068	msedge.exe
2992	msedge.exe
2992	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 4188	2992	msedge.exe	83
PID 2992 wrote to memory of 4188	2992	msedge.exe	83
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3940	2992	msedge.exe	84
PID 2992 wrote to memory of 3068	2992	msedge.exe	85
PID 2992 wrote to memory of 3068	2992	msedge.exe	85
PID 2992 wrote to memory of 784	2992	msedge.exe	86
PID 2992 wrote to memory of 784	2992	msedge.exe	86
PID 2992 wrote to memory of 784	2992	msedge.exe	86
PID 2992 wrote to memory of 784	2992	msedge.exe	86
PID 2992 wrote to memory of 784	2992	msedge.exe	86
PID 2992 wrote to memory of 784	2992	msedge.exe	86
PID 2992 wrote to memory of 784	2992	msedge.exe	86
PID 2992 wrote to memory of 784	2992	msedge.exe	86
PID 2992 wrote to memory of 784	2992	msedge.exe	86
PID 2992 wrote to memory of 784	2992	msedge.exe	86
PID 2992 wrote to memory of 784	2992	msedge.exe	86
PID 2992 wrote to memory of 784	2992	msedge.exe	86
PID 2992 wrote to memory of 784	2992	msedge.exe	86
PID 2992 wrote to memory of 784	2992	msedge.exe	86
PID 2992 wrote to memory of 784	2992	msedge.exe	86
PID 2992 wrote to memory of 784	2992	msedge.exe	86
PID 2992 wrote to memory of 784	2992	msedge.exe	86
PID 2992 wrote to memory of 784	2992	msedge.exe	86
PID 2992 wrote to memory of 784	2992	msedge.exe	86
PID 2992 wrote to memory of 784	2992	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4b4db5630c1974ce633fb0bfcd768c95_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffb29f46f8,0x7fffb29f4708,0x7fffb29f4718
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,2139869795152582911,4493712945132691431,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 /prefetch:2
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,2139869795152582911,4493712945132691431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,2139869795152582911,4493712945132691431,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2139869795152582911,4493712945132691431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2139869795152582911,4493712945132691431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2139869795152582911,4493712945132691431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2139869795152582911,4493712945132691431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2139869795152582911,4493712945132691431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,2139869795152582911,4493712945132691431,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4856 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d406f3135e11b0a0829109c1090a41dc

SHA1
810f00e803c17274f9af074fc6c47849ad6e873e

SHA256
91f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4

SHA512
2b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7f37f119665df6beaa925337bbff0e84

SHA1
c2601d11f8aa77e12ab3508479cbf20c27cbd865

SHA256
1073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027

SHA512
8e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
65bd948b130e4d729747e8eccf66c876

SHA1
ef4e56d294f13cf4e7bd033e717750fcdde435e2

SHA256
7c68c54fb01b42b5710ef482f3c0c5cd6b2391e45154366df06afa7ead372e44

SHA512
b41abdd45ce2a734ffe7da4a89de3fc0fa4bebddacab7478f4c13a7e43976d9ceadfdbf82b9d6fa736cb19cb5593df66c4ec78822e994b638aeede959bc91373

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6bf53bc40d45f7578052528b56fc57cb

SHA1
31e4a904b919bb9207c3df2332f38c267a9c05e4

SHA256
d949fdd3bf7bb60233181879be1d1b961456182b37c516adb8a535b5d94b43c6

SHA512
238f6b93caf604f23bd85fcca2f903e1d94926306606c6f545ad3c92047d97bc254154aa88f61ce114b0a6443ef33c4fdc685238a4696a400a9337caba3d8467

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4b47a0652e72fcc0ace4f5b9d37ab4f8

SHA1
420f3086a10ead2b175c5311dd24889e5aee1be7

SHA256
93373dda4b40b074128779b9073b8046f55e02f4161b6ff705cf5b3ce9d9d119

SHA512
845c23a07b054b07b37f083fad7ac27b745e4b62bee3b58c886cecb691477544abd30813231737da44768f59a21239b6c48065d687a19bfed7ca3accabf01b7a

Download Submit