e6d04e98bc4136869dd362231879f12bdc34609e4d00fe4744e95f37de8b8ada

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16-04-2024 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f27a6fcd7dd577e01a89e139117a821a_JaffaCakes118.html
Size

18KB
MD5

f27a6fcd7dd577e01a89e139117a821a
SHA1

c782c733dc680d855c550890275b054870f21683
SHA256

e6d04e98bc4136869dd362231879f12bdc34609e4d00fe4744e95f37de8b8ada
SHA512

821dc4834f5d01327bd3e78b2b5d7dfae85a5476685ce1b7beef0609ee09dec781bf250e2e6014f18c6c129dd10da8ae579a11ed91562d12528fd825f6791c98
SSDEEP

384:smlIcAtl4f3THqHEMU6DN6Z8m/gR/6guLZ:bt8cgN6xLZ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
892	msedge.exe
892	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
892	msedge.exe
892	msedge.exe
892	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 936	892	msedge.exe	85
PID 892 wrote to memory of 936	892	msedge.exe	85
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4920	892	msedge.exe	86
PID 892 wrote to memory of 4048	892	msedge.exe	87
PID 892 wrote to memory of 4048	892	msedge.exe	87
PID 892 wrote to memory of 1412	892	msedge.exe	88
PID 892 wrote to memory of 1412	892	msedge.exe	88
PID 892 wrote to memory of 1412	892	msedge.exe	88
PID 892 wrote to memory of 1412	892	msedge.exe	88
PID 892 wrote to memory of 1412	892	msedge.exe	88
PID 892 wrote to memory of 1412	892	msedge.exe	88
PID 892 wrote to memory of 1412	892	msedge.exe	88
PID 892 wrote to memory of 1412	892	msedge.exe	88
PID 892 wrote to memory of 1412	892	msedge.exe	88
PID 892 wrote to memory of 1412	892	msedge.exe	88
PID 892 wrote to memory of 1412	892	msedge.exe	88
PID 892 wrote to memory of 1412	892	msedge.exe	88
PID 892 wrote to memory of 1412	892	msedge.exe	88
PID 892 wrote to memory of 1412	892	msedge.exe	88
PID 892 wrote to memory of 1412	892	msedge.exe	88
PID 892 wrote to memory of 1412	892	msedge.exe	88
PID 892 wrote to memory of 1412	892	msedge.exe	88
PID 892 wrote to memory of 1412	892	msedge.exe	88
PID 892 wrote to memory of 1412	892	msedge.exe	88
PID 892 wrote to memory of 1412	892	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f27a6fcd7dd577e01a89e139117a821a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb836b46f8,0x7ffb836b4708,0x7ffb836b4718
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,15325562350619685013,379343198436174919,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,15325562350619685013,379343198436174919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,15325562350619685013,379343198436174919,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,15325562350619685013,379343198436174919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,15325562350619685013,379343198436174919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,15325562350619685013,379343198436174919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,15325562350619685013,379343198436174919,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
120a75f233314ba1fe34e9d6c09f30b9

SHA1
a9f92f2d3f111eaadd9bcf8fceb3c9553753539c

SHA256
e04101215c3534dbc77c0b5df2e1d1ff74c277d2946f391f939c9a7948a22dd0

SHA512
3c4eb93e425b50e8bcc1712f4cc2be11888a0273c3a619fc6bf72ccab876a427158f661bfc80d0c1e47ef4116febf76a3aaa31a60ec662eae0e51c7f1d3d89b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bc2edd0741d97ae237e9f00bf3244144

SHA1
7c1e5d324f5c7137a3c4ec85146659f026c11782

SHA256
dbce3287c7ae69ccbd1d780c39f3ffa3c98bd4609a939fff8ee9c99f14265041

SHA512
00f505a0b4ea0df626175bf9d39a205f18f9754b62e4dba6fbb5b4a716b3539e7809723e1596bcfe1ba3041e22342e3a9cbaad88e84ce9c8c6531331bbc25093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
7ceb70a3f691740b3201bcaa0a2769bc

SHA1
889272cbc8960afce7378d0f7d2e3666ea7f73c2

SHA256
5b106ee841785cbde19e2d5b2360b04ed5c69a23dc840c9d99191e14033d6859

SHA512
6db3a93f3df8e8a2ec31cef30c9e941c9c239173a9367dc5b02482c346e63bf5d495ae730e2998ef247ebd1bb11f2e0b89180b21c328adb6daac9a8ae78ff3db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
585c02d0ca06be6cc3ec9af5bece1b79

SHA1
9c4ec0d23f4539bb26892d247240101cc6495040

SHA256
016452665522e44fc03d7a49c2510aa017d86766d81370b0a49d3589be4b44a4

SHA512
c88291861f282c6fbf6e86ad1e942b5b9f9e602aed835d06c1fad5070667bf27bbc4d4e16d78cea1e51ce6b917a94d389509d644a0bbb38ac3a3858819b089d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
93f211b3074958554abf9385cb8806d9

SHA1
40543b2df6bdad3769cca1bb15417f2c9b8dab5f

SHA256
6cfacaafa5b3842b5ca00da54481159a3787b0e618f61fec53fde6d065f0a27a

SHA512
63473de4b248c523a98b377cfa51d293c7b07500f927a4ed8324a7993d6c5ca9ca623f99dde2f066b6d18b9e2ad4f7f2fb78e59028ca4b5c497a147b21cbc593

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f38c97dacbe7b710853f2e96a1a7a259

SHA1
e62e8468dabecb492216bf4fe7f23733e9545d12

SHA256
0bea5ad31f2127813cdd6f7f57ec9e9a14da77aeca97602d1fadec9a60da60d0

SHA512
4137bf8eb2873c8ef322d6713b3d9f4c10048fcf9d0cc4c1bf8fe643ea505267a942e3f917167160e51bc74c0bd1b58fefab40d690ae9705f720f23754fc7a4d

Download Submit