84a8037c1a49f9cb4dc5a008205ac75a5ebad6394994c91d4561a339e67ef151

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 06:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1677d6cb03de6bfb831095c28ae0548a_JaffaCakes118.html
Size

13KB
MD5

1677d6cb03de6bfb831095c28ae0548a
SHA1

2612ce5666f9fd072b74fef9ab83c32ae6427811
SHA256

84a8037c1a49f9cb4dc5a008205ac75a5ebad6394994c91d4561a339e67ef151
SHA512

27df75802278c882ce7e18a6e2c543feb29f4d1c60a882ad00a17564b70c3db401c59c2f4d998782c9d87263529ca0484a56fab0095fbe19b8c4ed6748ea6fac
SSDEEP

192:+rTTezTeBdt9eiemomDxyI9LDTWqFztTsYf65BMCkeK60HOu5OMFIMFb0CXIYeDi:CdHd1ycztTsY0BM7J6uOu5OMOaIgl08

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
4652	msedge.exe
4652	msedge.exe
3056	identity_helper.exe
3056	identity_helper.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 4440	4652	msedge.exe	85
PID 4652 wrote to memory of 4440	4652	msedge.exe	85
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 2448	4652	msedge.exe	86
PID 4652 wrote to memory of 3600	4652	msedge.exe	87
PID 4652 wrote to memory of 3600	4652	msedge.exe	87
PID 4652 wrote to memory of 2092	4652	msedge.exe	88
PID 4652 wrote to memory of 2092	4652	msedge.exe	88
PID 4652 wrote to memory of 2092	4652	msedge.exe	88
PID 4652 wrote to memory of 2092	4652	msedge.exe	88
PID 4652 wrote to memory of 2092	4652	msedge.exe	88
PID 4652 wrote to memory of 2092	4652	msedge.exe	88
PID 4652 wrote to memory of 2092	4652	msedge.exe	88
PID 4652 wrote to memory of 2092	4652	msedge.exe	88
PID 4652 wrote to memory of 2092	4652	msedge.exe	88
PID 4652 wrote to memory of 2092	4652	msedge.exe	88
PID 4652 wrote to memory of 2092	4652	msedge.exe	88
PID 4652 wrote to memory of 2092	4652	msedge.exe	88
PID 4652 wrote to memory of 2092	4652	msedge.exe	88
PID 4652 wrote to memory of 2092	4652	msedge.exe	88
PID 4652 wrote to memory of 2092	4652	msedge.exe	88
PID 4652 wrote to memory of 2092	4652	msedge.exe	88
PID 4652 wrote to memory of 2092	4652	msedge.exe	88
PID 4652 wrote to memory of 2092	4652	msedge.exe	88
PID 4652 wrote to memory of 2092	4652	msedge.exe	88
PID 4652 wrote to memory of 2092	4652	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1677d6cb03de6bfb831095c28ae0548a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa44546f8,0x7ffaa4454708,0x7ffaa4454718
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,4954788248910558569,15578425894810613165,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,4954788248910558569,15578425894810613165,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,4954788248910558569,15578425894810613165,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4954788248910558569,15578425894810613165,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4954788248910558569,15578425894810613165,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,4954788248910558569,15578425894810613165,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,4954788248910558569,15578425894810613165,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4954788248910558569,15578425894810613165,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4954788248910558569,15578425894810613165,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3008 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4954788248910558569,15578425894810613165,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4954788248910558569,15578425894810613165,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,4954788248910558569,15578425894810613165,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3740 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
184B

MD5
bf47a61009321e081f3babde283f99fe

SHA1
a7673f4818328cd610d01b0bb126537acc958abb

SHA256
7f61221037811fadec0a921926afa442b9297cc28d8b1977cf731e635b6b5ac3

SHA512
fd2f121921460af2760ded863c404675616b771d43869d966e8804cda531bbe2fdbaaed57ca8bcd7ba8756608f585787852d2bddbe7ccf25a5a9be7c1c366e51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5349726f507ad5f59a4f9b1efcd4bf72

SHA1
8f6d4a533c6bd4b3d3f807ce0c48bc58bd7f7856

SHA256
d2a2b6d2e4eb910241bca858b394043041decb2b37a24f2ad2fbbb1f365994a6

SHA512
207bbe437587c196d755dc3d818ee49ea4dc4e0b1597c830369796cdd9fbcc3b9d5d925f8cd87f6dab1a86af3de052eab8e0f25e328ec48e1484509be8475138

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
27d063dd922f7acc1ca88497a3ad62fb

SHA1
118eee58bb3409ecb47faee64f18bfba8d057dde

SHA256
0ca04923562dac538b2eecc9ee80b34a65e9b5d8225bdbfa73aca84f38d63e3e

SHA512
ea5e1ecb58d407d47a191648d468dec80097536f6ce89b39aae054929fb9333d5b39d5d7bf7531c13cddd5b836fc8b1d294f04d9ad1f28178ebfcbc8bb3d2d65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
327453f814e8ce037c51b556c5a47f39

SHA1
1c8139578b58f291d56fd8aae588bb44bc6e72d9

SHA256
1251938d8fda59a0f40a0cd2ccea49a408a08d17c1d518bd2aab1cefd075a685

SHA512
20d33d00b1bfe43457a6a38b0ecfbe98bfc9c279c71ba0ff2f3243ee37d635cd3c69d5a2b4d6b3a129629b396624f75b2f96e88ad7b71f1d150c56964c7fbf8b

Download Submit