74992f901a1b82dabe87b995a89df61a7c56674312d47776dafa98d1e2ba22de

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 10:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0304ceeeabbbe5d9b6194524a600522e_JaffaCakes118.html
Size

172KB
MD5

0304ceeeabbbe5d9b6194524a600522e
SHA1

6d1e259eb514aa9a412a2f23d26a61ccc89fbfaf
SHA256

74992f901a1b82dabe87b995a89df61a7c56674312d47776dafa98d1e2ba22de
SHA512

1b8e28734fe42933e90ef9640b70c8b9e6584b1e69774182896f4f77d10f81c29d63d4b5835a75a96cd05c3ea05696edd7416c0020eb4ec97bc633ab51d21a2c
SSDEEP

3072:SYslhugyrpUM1KcJ7dVS2Ut7tGXCLEybhOrds5xTB7B/Gwv4IVPmkaPyfkMY+BEu:SYWUgyrpUM1KcJ7dVS2Ut7tGXCLEybhv

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
976	msedge.exe
976	msedge.exe
1572	msedge.exe
1572	msedge.exe
4596	identity_helper.exe
4596	identity_helper.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 2008	1572	msedge.exe	84
PID 1572 wrote to memory of 2008	1572	msedge.exe	84
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 2912	1572	msedge.exe	85
PID 1572 wrote to memory of 976	1572	msedge.exe	86
PID 1572 wrote to memory of 976	1572	msedge.exe	86
PID 1572 wrote to memory of 5060	1572	msedge.exe	87
PID 1572 wrote to memory of 5060	1572	msedge.exe	87
PID 1572 wrote to memory of 5060	1572	msedge.exe	87
PID 1572 wrote to memory of 5060	1572	msedge.exe	87
PID 1572 wrote to memory of 5060	1572	msedge.exe	87
PID 1572 wrote to memory of 5060	1572	msedge.exe	87
PID 1572 wrote to memory of 5060	1572	msedge.exe	87
PID 1572 wrote to memory of 5060	1572	msedge.exe	87
PID 1572 wrote to memory of 5060	1572	msedge.exe	87
PID 1572 wrote to memory of 5060	1572	msedge.exe	87
PID 1572 wrote to memory of 5060	1572	msedge.exe	87
PID 1572 wrote to memory of 5060	1572	msedge.exe	87
PID 1572 wrote to memory of 5060	1572	msedge.exe	87
PID 1572 wrote to memory of 5060	1572	msedge.exe	87
PID 1572 wrote to memory of 5060	1572	msedge.exe	87
PID 1572 wrote to memory of 5060	1572	msedge.exe	87
PID 1572 wrote to memory of 5060	1572	msedge.exe	87
PID 1572 wrote to memory of 5060	1572	msedge.exe	87
PID 1572 wrote to memory of 5060	1572	msedge.exe	87
PID 1572 wrote to memory of 5060	1572	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0304ceeeabbbe5d9b6194524a600522e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa184e46f8,0x7ffa184e4708,0x7ffa184e4718
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,8079067582129117297,11999171779621324166,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,8079067582129117297,11999171779621324166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,8079067582129117297,11999171779621324166,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8079067582129117297,11999171779621324166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8079067582129117297,11999171779621324166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,8079067582129117297,11999171779621324166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,8079067582129117297,11999171779621324166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8079067582129117297,11999171779621324166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8079067582129117297,11999171779621324166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8079067582129117297,11999171779621324166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8079067582129117297,11999171779621324166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,8079067582129117297,11999171779621324166,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5a92770f649f9ae469e72273a6f9c7e2

SHA1
eac69e64e4ceaf8ea54c8cbfba1183c8bb59f218

SHA256
329b624b01517330335c38240e8ce3726e51bd63487c3be8638095175ecaded3

SHA512
4939d221664245e69a0b56853bd4ed470f2d86b66d308dfe79b4987253c00687bfce83e465245ee9f16923999b8babe366abc7d0c0d3310faf814c431faa7f6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2acb169d14b45bbe4a867c4694f824e8

SHA1
e61c8b3bfe03c0a6d3a514b67168084a1c69a8a0

SHA256
dfa55a67d750ce7dd4c187946536c657b7177def117d7161b82f7684c3ab189e

SHA512
db704b1a5a1840ea62e5fb7646ef23ab285ea11445528d665569912f7c212732e84b825bfee3114cb5b25918d1387211561512945eb7523eeb216c8e8051a6ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
480a58c54fb2f8c4df28e554b1688acd

SHA1
1cdf0f7621264f1a53ad4dd2ab435ffca6c6dd85

SHA256
a64e5c250d9a7fab6e21ac5cacf87b702021a3f9f9e4906a605f67fdb0a11964

SHA512
26a842d15166ba92738954d72cecf045e5fdb6f9660fd7c4cc294c7ea5aeeae43a4c53253f54014489e065147b601d4bd01ce1bf3f7f40dafcb6df19cdfc53d0

Download Submit