f1d8491ab7b6af2208d07e3780459dee5d868fecd945e31527b16db47957872d

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 10:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0303c143be07616fcf064b452c7dbb6a_JaffaCakes118.html
Size

33KB
MD5

0303c143be07616fcf064b452c7dbb6a
SHA1

eeb1f8e0793a35a03a0ce6e9272c8f663c0f7b7a
SHA256

f1d8491ab7b6af2208d07e3780459dee5d868fecd945e31527b16db47957872d
SHA512

d555d7a25f3a1ca3e2858026c64b680291112a2e9175e8581456f32cd4dcf0fcf76f718e477769d716c7e09d7506a53c914e681e96f067a040a35328e41fbc18
SSDEEP

384:bNxlVuvqTvFN0jBQtA0hSgrfawQCyUnu2fBcNV0/eEYQa8EVAcLZFp4fiCeFQVdv:JxlMCTvpul02ka8K1Fp4fipFVvYC9c

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1204	msedge.exe
1204	msedge.exe
1036	msedge.exe
1036	msedge.exe
3876	identity_helper.exe
3876	identity_helper.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 4516	1036	msedge.exe	83
PID 1036 wrote to memory of 4516	1036	msedge.exe	83
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 4300	1036	msedge.exe	84
PID 1036 wrote to memory of 1204	1036	msedge.exe	85
PID 1036 wrote to memory of 1204	1036	msedge.exe	85
PID 1036 wrote to memory of 5052	1036	msedge.exe	86
PID 1036 wrote to memory of 5052	1036	msedge.exe	86
PID 1036 wrote to memory of 5052	1036	msedge.exe	86
PID 1036 wrote to memory of 5052	1036	msedge.exe	86
PID 1036 wrote to memory of 5052	1036	msedge.exe	86
PID 1036 wrote to memory of 5052	1036	msedge.exe	86
PID 1036 wrote to memory of 5052	1036	msedge.exe	86
PID 1036 wrote to memory of 5052	1036	msedge.exe	86
PID 1036 wrote to memory of 5052	1036	msedge.exe	86
PID 1036 wrote to memory of 5052	1036	msedge.exe	86
PID 1036 wrote to memory of 5052	1036	msedge.exe	86
PID 1036 wrote to memory of 5052	1036	msedge.exe	86
PID 1036 wrote to memory of 5052	1036	msedge.exe	86
PID 1036 wrote to memory of 5052	1036	msedge.exe	86
PID 1036 wrote to memory of 5052	1036	msedge.exe	86
PID 1036 wrote to memory of 5052	1036	msedge.exe	86
PID 1036 wrote to memory of 5052	1036	msedge.exe	86
PID 1036 wrote to memory of 5052	1036	msedge.exe	86
PID 1036 wrote to memory of 5052	1036	msedge.exe	86
PID 1036 wrote to memory of 5052	1036	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0303c143be07616fcf064b452c7dbb6a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9178446f8,0x7ff917844708,0x7ff917844718
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,3614003077042852742,9948339902194456302,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,3614003077042852742,9948339902194456302,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2660 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,3614003077042852742,9948339902194456302,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3614003077042852742,9948339902194456302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3614003077042852742,9948339902194456302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,3614003077042852742,9948339902194456302,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,3614003077042852742,9948339902194456302,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3614003077042852742,9948339902194456302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3614003077042852742,9948339902194456302,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3614003077042852742,9948339902194456302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3614003077042852742,9948339902194456302,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,3614003077042852742,9948339902194456302,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5268 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62c02dda2bf22d702a9b3a1c547c5f6a

SHA1
8f42966df96bd2e8c1f6b31b37c9a19beb6394d6

SHA256
cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b

SHA512
a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b7e0c76762f0f7aad9cd46a3cf06933e

SHA1
5a95f3c11771caa18ea408b864d639228105eb69

SHA256
96170dfd04ca627d075cb1c7326752cba1d4f0f4f1d36532a24f66173fa4edac

SHA512
c46d72052abb0de6d1596ddc06cc3e92f54eed115379927ef9502616d103db7d7ee62523c0f509055aa08e7fbab8c122408b23fb29fb45431267cb51adf874c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8f59ba5f5463cbfdff4d68e5cd6db649

SHA1
57769b23d6412c33151724433b77b928316e0450

SHA256
e36c2456c3d985b10294388a003c547bce946ac1b5fa850448ba55bbe08f3fbc

SHA512
ab77540fe31be1d54aebf645147d408d56258eaba68442b4274620d5060166fd18edac95d000de3bcfee868dc0628c9da8d558570acfc4630ddd77fea472a712

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
bd48bcd18d9bf3b4d1e2f8425dc3c833

SHA1
9f5d0f52c0575d521f5583c0fb2dc7a58dbd4749

SHA256
a29899fc101ba869b98d289177e1cb4aecac56b7cbcd01f49d42aaf886dd5a38

SHA512
8dd0e25ffd4f6d7353bff97e3e8ef7f82e9757a146ddca7b393554f4dc4fb69fab5927d61ad6cee2da8db78253f212ab4663ff1beb9055c8b3a46aa5a3dc784a

Download Submit