45f6cb615152edfe7bc68090592078c75a6ee4754e44c6e2befb26cbb180868d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 02:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1594034f31cabb828b507b86fd05edcd_JaffaCakes118.html
Size

139KB
MD5

1594034f31cabb828b507b86fd05edcd
SHA1

20cd2e68fb90605789be52feee8e4fb4124c0cda
SHA256

45f6cb615152edfe7bc68090592078c75a6ee4754e44c6e2befb26cbb180868d
SHA512

c035e332cd258389fa68c9d945e2267682d382a06b7a1eea0ae180aeb0c36b9a7ea84cc004a4456efa04ceb8333d73659922d7d943fe3cdb1f6f4a7836da1f3c
SSDEEP

1536:SUivExtIFnRUlRCsyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3om:SUiICsyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3272	msedge.exe
3272	msedge.exe
180	msedge.exe
180	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
180	msedge.exe
180	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe
180	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 180 wrote to memory of 1472	180	msedge.exe	85
PID 180 wrote to memory of 1472	180	msedge.exe	85
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 1960	180	msedge.exe	86
PID 180 wrote to memory of 3272	180	msedge.exe	87
PID 180 wrote to memory of 3272	180	msedge.exe	87
PID 180 wrote to memory of 4664	180	msedge.exe	88
PID 180 wrote to memory of 4664	180	msedge.exe	88
PID 180 wrote to memory of 4664	180	msedge.exe	88
PID 180 wrote to memory of 4664	180	msedge.exe	88
PID 180 wrote to memory of 4664	180	msedge.exe	88
PID 180 wrote to memory of 4664	180	msedge.exe	88
PID 180 wrote to memory of 4664	180	msedge.exe	88
PID 180 wrote to memory of 4664	180	msedge.exe	88
PID 180 wrote to memory of 4664	180	msedge.exe	88
PID 180 wrote to memory of 4664	180	msedge.exe	88
PID 180 wrote to memory of 4664	180	msedge.exe	88
PID 180 wrote to memory of 4664	180	msedge.exe	88
PID 180 wrote to memory of 4664	180	msedge.exe	88
PID 180 wrote to memory of 4664	180	msedge.exe	88
PID 180 wrote to memory of 4664	180	msedge.exe	88
PID 180 wrote to memory of 4664	180	msedge.exe	88
PID 180 wrote to memory of 4664	180	msedge.exe	88
PID 180 wrote to memory of 4664	180	msedge.exe	88
PID 180 wrote to memory of 4664	180	msedge.exe	88
PID 180 wrote to memory of 4664	180	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1594034f31cabb828b507b86fd05edcd_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff4d0346f8,0x7fff4d034708,0x7fff4d034718
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,14696778338721304230,10511767124985467146,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,14696778338721304230,10511767124985467146,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,14696778338721304230,10511767124985467146,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14696778338721304230,10511767124985467146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14696778338721304230,10511767124985467146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,14696778338721304230,10511767124985467146,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1340 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dbbfa0a2846aa1eb431ecb0d98401a42

SHA1
53c7b67f17a4bf71a80637ff89bd77b85b839915

SHA256
6b5d676621721899c0d2fa188eb257729c640719b85f1c9e56568717eceae1d0

SHA512
cbcce14b4702af948b56fa1ed588b3e4aeb33c56b942e43b070efc4796da3b20eee6a0e81b3bb891f161b3068f11a647d418e35f52fca6722a6090983a327236

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0583f4db0ece70325126364da3773cff

SHA1
b0e853fecd0a6072d4108ffccec51534964bc7d8

SHA256
34e08a2fb07f2fff61ba63872190b2abfb88529c66b11c6473e997e37624151f

SHA512
b468e9684af3d17e688db139c80362677cd1e5f03ec8cfdc41ed3713bd8e69d0136b9a73efbad045e6b4be545aa7b7ab812a79458b65a0a2f264190573794cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f9c04063b8c5d7c4089ecced978d3144

SHA1
f27067eba3cfeec7de490891244ebacf97d104d4

SHA256
ddd2c42e95e5150f15bb5356e226f88f153cbcd10dd2b8bc48cf424faa613565

SHA512
a4c02920ffaa9b2c91f494f9fe780ea807b14fbd07a5635bd8e9d8d25aa16ba2b6750a013dc401512e3e1fdb0a026bc53ed869093c7d9d0f8115423c684e65c9

Download Submit