0fa0d2fbc11eb6cbb0188c00f5cc2428ae277503801fc39ad8ab332c284101c9

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 11:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09a9cce74a2f9fa60a2f8e848d244286_JaffaCakes118.html
Size

139KB
MD5

09a9cce74a2f9fa60a2f8e848d244286
SHA1

cee49720ac00e3bced62b13208dec788c2510000
SHA256

0fa0d2fbc11eb6cbb0188c00f5cc2428ae277503801fc39ad8ab332c284101c9
SHA512

fc1fc79671e8c025200416ca6d84c543cdd1b2604db562ba3c65798d5993c62a787741b44895399fa53a83ea81acd18a22be30449ca8f72b3a9a6a72b53df242
SSDEEP

1536:SHNjI3/9lqOyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:SHK3dyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4660	msedge.exe
4660	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4660	msedge.exe
4660	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 4216	4660	msedge.exe	83
PID 4660 wrote to memory of 4216	4660	msedge.exe	83
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4668	4660	msedge.exe	84
PID 4660 wrote to memory of 4384	4660	msedge.exe	85
PID 4660 wrote to memory of 4384	4660	msedge.exe	85
PID 4660 wrote to memory of 2564	4660	msedge.exe	86
PID 4660 wrote to memory of 2564	4660	msedge.exe	86
PID 4660 wrote to memory of 2564	4660	msedge.exe	86
PID 4660 wrote to memory of 2564	4660	msedge.exe	86
PID 4660 wrote to memory of 2564	4660	msedge.exe	86
PID 4660 wrote to memory of 2564	4660	msedge.exe	86
PID 4660 wrote to memory of 2564	4660	msedge.exe	86
PID 4660 wrote to memory of 2564	4660	msedge.exe	86
PID 4660 wrote to memory of 2564	4660	msedge.exe	86
PID 4660 wrote to memory of 2564	4660	msedge.exe	86
PID 4660 wrote to memory of 2564	4660	msedge.exe	86
PID 4660 wrote to memory of 2564	4660	msedge.exe	86
PID 4660 wrote to memory of 2564	4660	msedge.exe	86
PID 4660 wrote to memory of 2564	4660	msedge.exe	86
PID 4660 wrote to memory of 2564	4660	msedge.exe	86
PID 4660 wrote to memory of 2564	4660	msedge.exe	86
PID 4660 wrote to memory of 2564	4660	msedge.exe	86
PID 4660 wrote to memory of 2564	4660	msedge.exe	86
PID 4660 wrote to memory of 2564	4660	msedge.exe	86
PID 4660 wrote to memory of 2564	4660	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\09a9cce74a2f9fa60a2f8e848d244286_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9ef2346f8,0x7ff9ef234708,0x7ff9ef234718
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,15668614224299052793,10327817417882834193,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,15668614224299052793,10327817417882834193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,15668614224299052793,10327817417882834193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15668614224299052793,10327817417882834193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15668614224299052793,10327817417882834193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,15668614224299052793,10327817417882834193,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9dc60aef38e7832217e7fa02d6f0d9f6

SHA1
4f8539dc7d5739b36fe976a932338f459d066db6

SHA256
8a0ee0b6fafabb256571b691c2faf77c7244945faa749c72124d5eb43a197a32

SHA512
18371541811910992c2b84a8eae7e997e8627640bdb60b9e82751389e50931db9b3e206d31f4d9d2dc3ca25ea3a82c0be413ecb0ef3ac227a14e54f406eaa7e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7ac03b15b68af2d5cb5c8063057cc83e

SHA1
9b2d4db737f57322ff5c4bbddd765b3177f930ab

SHA256
b90d7596301470b389842eecb46bd3a8e614260b0d374d5c35a36afb9c71a700

SHA512
a5e9f40dd9040803046b0218fab6b058d49e5e2a3ada315e161fe9fc80ebb8d6d4442ccc1c98d19e561fc7c61bcf43d662fe2231cacacb447876a2113c2e3732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
be90351dae637da59b0b4d7cf8f7acf2

SHA1
ea1445f579ca2df413260fddbb35b3674b10c7d8

SHA256
55fa7ec2c04ca914d05157751a87c96c18dfb22ce7e6d9a96d9c33b75d2b0a4a

SHA512
5ec7d9193aa3b125ad3e5259a986cf98a5a85160fc391be33a688d915d04d9fc440302149cb37db876602d7ba7b77058d9ac5bc62dce285aacefe24ccd3f6ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4a937d8dccc13c9687c64563433dd464

SHA1
4c22b5d3d3b792783b04e5a75a6b244b99290ab6

SHA256
3fd63c42d04d88524a24d6689a54a728d4791e27888f52ce2671aacd55fd7362

SHA512
3eba4928847c2398eb7341fbde68886b4c4c2f6a852aa6de15ca9446f530287ec64927d02dfef45bb6fdaf807aeb08fb3079d086a12a2a154d5da343c5ed0b9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d3a4df51-fefa-47a6-a317-59dd00d14a5e.tmp

Filesize
11KB

MD5
3da4b5889faacbc54a466f4afb8c1e77

SHA1
917d8430ad7b08e2a4318f827f5909ec4d5008c8

SHA256
0b178898e48fceb0f5c1cfbd1fc5aca7546fef81f2b6496385ba05da357cd1be

SHA512
92afd951bd01b350f04c3ee22de3650e3f9aea9e43d47c541280908931550a94ada4a46030cac79f6ec61020f964594a0a4a1cfc387ef5e8fc57a974f26a4ec6

Download Submit