4719b26c0c93588013545cacdff9c1349bdb3d4ab9d2c8470e4822302d0fa67e

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62ae5ee5f1b4b072ba9e16beaab758db_JaffaCakes118.html
Size

43KB
MD5

62ae5ee5f1b4b072ba9e16beaab758db
SHA1

032c8349de8ff0ad7849c027ca06be2daa359971
SHA256

4719b26c0c93588013545cacdff9c1349bdb3d4ab9d2c8470e4822302d0fa67e
SHA512

730add2a4a985380d69cc5fb9408852d83a6b3c802ebd310b249423f863224ebde51307e660bae0239cc06292fb9d8d222f382bd307cd3abd936d44783fe257d
SSDEEP

768:1I+vbG2+0MGi+vZGIikHhGRGXiOgOeGBGlGslstepFOs/wOenF:K+vt+0U+v5ikH/iOgOAFnYOK

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2496	msedge.exe
2496	msedge.exe
4256	msedge.exe
4256	msedge.exe
4384	identity_helper.exe
4384	identity_helper.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 5084	4256	msedge.exe	83
PID 4256 wrote to memory of 5084	4256	msedge.exe	83
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2744	4256	msedge.exe	84
PID 4256 wrote to memory of 2496	4256	msedge.exe	85
PID 4256 wrote to memory of 2496	4256	msedge.exe	85
PID 4256 wrote to memory of 2636	4256	msedge.exe	86
PID 4256 wrote to memory of 2636	4256	msedge.exe	86
PID 4256 wrote to memory of 2636	4256	msedge.exe	86
PID 4256 wrote to memory of 2636	4256	msedge.exe	86
PID 4256 wrote to memory of 2636	4256	msedge.exe	86
PID 4256 wrote to memory of 2636	4256	msedge.exe	86
PID 4256 wrote to memory of 2636	4256	msedge.exe	86
PID 4256 wrote to memory of 2636	4256	msedge.exe	86
PID 4256 wrote to memory of 2636	4256	msedge.exe	86
PID 4256 wrote to memory of 2636	4256	msedge.exe	86
PID 4256 wrote to memory of 2636	4256	msedge.exe	86
PID 4256 wrote to memory of 2636	4256	msedge.exe	86
PID 4256 wrote to memory of 2636	4256	msedge.exe	86
PID 4256 wrote to memory of 2636	4256	msedge.exe	86
PID 4256 wrote to memory of 2636	4256	msedge.exe	86
PID 4256 wrote to memory of 2636	4256	msedge.exe	86
PID 4256 wrote to memory of 2636	4256	msedge.exe	86
PID 4256 wrote to memory of 2636	4256	msedge.exe	86
PID 4256 wrote to memory of 2636	4256	msedge.exe	86
PID 4256 wrote to memory of 2636	4256	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\62ae5ee5f1b4b072ba9e16beaab758db_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9d0846f8,0x7ffd9d084708,0x7ffd9d084718
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,2421596419854299238,12021511604991084805,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,2421596419854299238,12021511604991084805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,2421596419854299238,12021511604991084805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2421596419854299238,12021511604991084805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2421596419854299238,12021511604991084805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,2421596419854299238,12021511604991084805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,2421596419854299238,12021511604991084805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2421596419854299238,12021511604991084805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2421596419854299238,12021511604991084805,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2421596419854299238,12021511604991084805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2421596419854299238,12021511604991084805,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,2421596419854299238,12021511604991084805,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
210676dde5c0bd984dc057e2333e1075

SHA1
2d2f8c14ee48a2580f852db7ac605f81b5b1399a

SHA256
2a89d71b4ddd34734b16d91ebd8ea68b760f321baccdd4963f91b8d3507a3fb5

SHA512
aeb81804cac5b17a5d1e55327f62df7645e9bbbfa8cad1401e7382628341a939b7aedc749b2412c06174a9e3fcdd5248d6df9b5d3f56c53232d17e59277ab017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4e6521c03f1bc16d91d99c059cc5424

SHA1
043665051c486192a6eefe6d0632cf34ae8e89ad

SHA256
7759c346539367b2f80e78abca170f09731caa169e3462f11eda84c3f1ca63d1

SHA512
0bb4f628da6d715910161439685052409be54435e192cb4105191472bb14a33724592df24686d1655e9ba9572bd3dff8f46e211c0310e16bfe2ac949c49fbc5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5b04845c05340e1395986cb1d944b6f3

SHA1
71b9632616a45dad19be5800a2129ad6f2db2bfb

SHA256
b3d9808bf3b1cd9e982c984d55d3ead8517d5944e6a2a2d9ba581397e261aafa

SHA512
74acfc3a605d2c557338a4e562987d46ecbec84bd8447e2f77de9fb05da30dfb86bc311b107b26d78f9c2aabf315f78d0f4a074509840573a9e1ca027613ff3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c82da32ec4199530b0a0b334b6e66d0f

SHA1
b159b6108877b7d53069d031c3c108861b20c9f8

SHA256
c0dc51787f316bb7a77e7eb94ca80b6d4dca21ad575799b83e97d572c88051b9

SHA512
cd30b370f79a75eeaa88e28de596fee69655299335ed9579cca63c41255bfef8a80e742defefae9b4e6c3019e055aab7fd30da1c030287169d81d79257332699

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
92ef9bbd95afb1adfeb76fdb0df931e6

SHA1
6e4be647d61e7134f97ad04fd9de015c940a59ae

SHA256
cfdac5f145eea64caf94212a72f89a3b063f70f2e95fc3f755ee319f3351e9da

SHA512
171344c206087ad64df81ae3f94cfb1ca23c1a30033d78fff9658293315c111bc1891cee6c640aeb2e5487fb4beee1536b8459a87e05abb36c98b32ee9d51461

Download Submit