3176cf47f7d48a3d7c79e67c2d2e9f94fec80ea3f083d02ecdc03ab5e8ad9002

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30-04-2024 15:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a0c94c610fe785d5664b2694e6dc4e8_JaffaCakes118.html
Size

214KB
MD5

0a0c94c610fe785d5664b2694e6dc4e8
SHA1

090012fff1319a843612a574d800490168e761e8
SHA256

3176cf47f7d48a3d7c79e67c2d2e9f94fec80ea3f083d02ecdc03ab5e8ad9002
SHA512

99b9b56d969f9c469dc5787558ac1ed61356bc28059819864a9141ea86a11db309315adf983fb6472db4e7bfed98ec277cc8016fdb66293288cd3f791118695d
SSDEEP

3072:OrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJZ:2z9VxLY7iAVLTBQJlZ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2968	msedge.exe
2968	msedge.exe
3240	msedge.exe
3240	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 5108	3240	msedge.exe	84
PID 3240 wrote to memory of 5108	3240	msedge.exe	84
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 3896	3240	msedge.exe	85
PID 3240 wrote to memory of 2968	3240	msedge.exe	86
PID 3240 wrote to memory of 2968	3240	msedge.exe	86
PID 3240 wrote to memory of 5040	3240	msedge.exe	87
PID 3240 wrote to memory of 5040	3240	msedge.exe	87
PID 3240 wrote to memory of 5040	3240	msedge.exe	87
PID 3240 wrote to memory of 5040	3240	msedge.exe	87
PID 3240 wrote to memory of 5040	3240	msedge.exe	87
PID 3240 wrote to memory of 5040	3240	msedge.exe	87
PID 3240 wrote to memory of 5040	3240	msedge.exe	87
PID 3240 wrote to memory of 5040	3240	msedge.exe	87
PID 3240 wrote to memory of 5040	3240	msedge.exe	87
PID 3240 wrote to memory of 5040	3240	msedge.exe	87
PID 3240 wrote to memory of 5040	3240	msedge.exe	87
PID 3240 wrote to memory of 5040	3240	msedge.exe	87
PID 3240 wrote to memory of 5040	3240	msedge.exe	87
PID 3240 wrote to memory of 5040	3240	msedge.exe	87
PID 3240 wrote to memory of 5040	3240	msedge.exe	87
PID 3240 wrote to memory of 5040	3240	msedge.exe	87
PID 3240 wrote to memory of 5040	3240	msedge.exe	87
PID 3240 wrote to memory of 5040	3240	msedge.exe	87
PID 3240 wrote to memory of 5040	3240	msedge.exe	87
PID 3240 wrote to memory of 5040	3240	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0a0c94c610fe785d5664b2694e6dc4e8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8b0446f8,0x7fff8b044708,0x7fff8b044718
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,357317082688689010,7536100316842984665,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,357317082688689010,7536100316842984665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,357317082688689010,7536100316842984665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,357317082688689010,7536100316842984665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,357317082688689010,7536100316842984665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,357317082688689010,7536100316842984665,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4c5a12ed973c81c553356572e5e38fc4

SHA1
0aba9b14116f067606f201fcf318430f609a64bf

SHA256
1a4f58fd508a3d6fe8f884b80a3d01f5ab615404e403e9e36aaa721fdd12a4fc

SHA512
22022b2d83daffce07e3ffc973fb0e49bb5f5c3b31ff83e0f32bf46df35c7b950f44dfe417ccb831de8c7030b760594f0c700e578065e8d9a87fc8104f56ee72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a6a60922484f7caf63fe986f0c3a2021

SHA1
953f62198333e8e505ae62f2386f09c944b82a27

SHA256
89572f588bb7e9afa93bf9955d72ec05f3035a0723f3e95e3b7c6dd58221cf78

SHA512
e9f51ee21a56e85aa03489b873ee8ab25e087c75c7e18dbd578fd5033f3cc12208e655a578e1896274e7154bb1f450331a3494101674f35a0b15cd247382dffb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
025f391190e6b2970882dd0173cb7ec9

SHA1
7f8e70812cdbc1f79534092db227c47f3677bff3

SHA256
d64aa1160a5807c22c25af0669a6b2d803259cac0cdfbaf755947c57b8aabc85

SHA512
5ea969cf2871797c8b9d3a60b2f190ae989dd5e6dc8956fd33f51e36754946f0f83d235f869f6a1d859e4f4146a9800ec1482e643bee4b123fdda83a716f89c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
6ed8ab0da9d849d78153003a5798e14f

SHA1
2da0c1884f4a12391270c39191f02fd7c5b66855

SHA256
c6d0a7fc4231867fa119788b766fc0cc3b3621e9cbda2c9c218d7c89a7d2b045

SHA512
584ff21bdfcad77b7a43c8aa276058f58acb939fe4fdc861e03a69712ea10ce087f8a045cfbd448807405b992d0a4190321e52072403381fc1d0cecdf93d488e

Download Submit