0b63c196d13437610311606e2f137950d2f2f88b27e8918647a73ecce0bc195c

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 18:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

05dc1f0cb78c067b38a1b882f7314243_JaffaCakes118.html
Size

33KB
MD5

05dc1f0cb78c067b38a1b882f7314243
SHA1

48b74ee0a2f91510fd6dd8bbd1f15ec4ad27d79a
SHA256

0b63c196d13437610311606e2f137950d2f2f88b27e8918647a73ecce0bc195c
SHA512

50ea2929c43b66cbf37310736081ed74ef5b6457407d4ed37b170ee75283fac083a239f5ebd50d338c2d76a8aa86cad6747ec5185d4cb56220b81f02850aa991
SSDEEP

768:PoOT6FcRL0NrUvj0Ld5HHMwu02VExscCpRofwdg:PoOT6FcRL0NrUvj0Ld5lu0McCpRoIG

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
412	msedge.exe
412	msedge.exe
2768	identity_helper.exe
2768	identity_helper.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 2440	412	msedge.exe	83
PID 412 wrote to memory of 2440	412	msedge.exe	83
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 4752	412	msedge.exe	84
PID 412 wrote to memory of 3716	412	msedge.exe	85
PID 412 wrote to memory of 3716	412	msedge.exe	85
PID 412 wrote to memory of 4972	412	msedge.exe	86
PID 412 wrote to memory of 4972	412	msedge.exe	86
PID 412 wrote to memory of 4972	412	msedge.exe	86
PID 412 wrote to memory of 4972	412	msedge.exe	86
PID 412 wrote to memory of 4972	412	msedge.exe	86
PID 412 wrote to memory of 4972	412	msedge.exe	86
PID 412 wrote to memory of 4972	412	msedge.exe	86
PID 412 wrote to memory of 4972	412	msedge.exe	86
PID 412 wrote to memory of 4972	412	msedge.exe	86
PID 412 wrote to memory of 4972	412	msedge.exe	86
PID 412 wrote to memory of 4972	412	msedge.exe	86
PID 412 wrote to memory of 4972	412	msedge.exe	86
PID 412 wrote to memory of 4972	412	msedge.exe	86
PID 412 wrote to memory of 4972	412	msedge.exe	86
PID 412 wrote to memory of 4972	412	msedge.exe	86
PID 412 wrote to memory of 4972	412	msedge.exe	86
PID 412 wrote to memory of 4972	412	msedge.exe	86
PID 412 wrote to memory of 4972	412	msedge.exe	86
PID 412 wrote to memory of 4972	412	msedge.exe	86
PID 412 wrote to memory of 4972	412	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\05dc1f0cb78c067b38a1b882f7314243_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbf6346f8,0x7ffdbf634708,0x7ffdbf634718
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,12430011415473150072,11646902901719950922,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,12430011415473150072,11646902901719950922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,12430011415473150072,11646902901719950922,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12430011415473150072,11646902901719950922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12430011415473150072,11646902901719950922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,12430011415473150072,11646902901719950922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,12430011415473150072,11646902901719950922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12430011415473150072,11646902901719950922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12430011415473150072,11646902901719950922,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12430011415473150072,11646902901719950922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12430011415473150072,11646902901719950922,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4512 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,12430011415473150072,11646902901719950922,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4360 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9dc60aef38e7832217e7fa02d6f0d9f6

SHA1
4f8539dc7d5739b36fe976a932338f459d066db6

SHA256
8a0ee0b6fafabb256571b691c2faf77c7244945faa749c72124d5eb43a197a32

SHA512
18371541811910992c2b84a8eae7e997e8627640bdb60b9e82751389e50931db9b3e206d31f4d9d2dc3ca25ea3a82c0be413ecb0ef3ac227a14e54f406eaa7e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7ac03b15b68af2d5cb5c8063057cc83e

SHA1
9b2d4db737f57322ff5c4bbddd765b3177f930ab

SHA256
b90d7596301470b389842eecb46bd3a8e614260b0d374d5c35a36afb9c71a700

SHA512
a5e9f40dd9040803046b0218fab6b058d49e5e2a3ada315e161fe9fc80ebb8d6d4442ccc1c98d19e561fc7c61bcf43d662fe2231cacacb447876a2113c2e3732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
84e6184106ba977fa63a119e62f59753

SHA1
015a405fc4080a07fd2335da5c30a4589b20cc38

SHA256
358d56bbe348c6033bcb1c20986d49398cfd3c9bf8842f0347a61c40da31d2de

SHA512
455f2ae2b3e9e74417ee53d2be2ea638d9ebfb8195defb844a59c5b0887639ef9508a4c46611a284597f0d2e5f32326f2e793877eb367487e8523368378cb67a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7517a8ff4f09d8b5c7a131f09365cb20

SHA1
83597639d11b3117f56d858db554fbb8377a4e55

SHA256
d40f4eef12da04638f651d41d85a0d7ec2461b3544157a0ac9e2fb6101f6fa14

SHA512
8f90defd3dbe1b0ea39889f7f131e049ac9da2dbb4d9917b6a5f42900f24495a14dedac8a527a994fcde70f90ffcbca2622b3d715cfc16e66d304728baa47f39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
ce74bac074832c72834f9d104805d524

SHA1
128a760b510688e8f87592e2ef77049c7c487ea8

SHA256
5fcbfaf4240adf2fd8517e7b774f6468926556e8acc941bcf95e795a410188d6

SHA512
465877e9d837e46c838e76abebb44146c8359b7f8d8734af4710166991fc20e163be62bd004dd12d7d4100ab55fb18daef5c451555dcefa8fd141ddf6da5e007

Download Submit