d0879f389edcb14d957d2d0678c4b5d0bcb0bb46ba03e7ea552f4bc71178d4f5

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f0b3a3ff958ae45550872d162731631_JaffaCakes118.html
Size

139KB
MD5

1f0b3a3ff958ae45550872d162731631
SHA1

4a842f0cf19be98a84289ac2e6cbdc8b93fe5078
SHA256

d0879f389edcb14d957d2d0678c4b5d0bcb0bb46ba03e7ea552f4bc71178d4f5
SHA512

fc67f54c95320064a7e2bb87ecf08053a01a6d804bbee199320cbcc5fa3752b4c07d3a6e073a57b563175b2e8b8e882bd731202c510baea28d356968d848599f
SSDEEP

1536:SzNG+exl3gyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTs:SzEgyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4032	msedge.exe
4032	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 3888	4032	msedge.exe	83
PID 4032 wrote to memory of 3888	4032	msedge.exe	83
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4556	4032	msedge.exe	84
PID 4032 wrote to memory of 4548	4032	msedge.exe	85
PID 4032 wrote to memory of 4548	4032	msedge.exe	85
PID 4032 wrote to memory of 2184	4032	msedge.exe	86
PID 4032 wrote to memory of 2184	4032	msedge.exe	86
PID 4032 wrote to memory of 2184	4032	msedge.exe	86
PID 4032 wrote to memory of 2184	4032	msedge.exe	86
PID 4032 wrote to memory of 2184	4032	msedge.exe	86
PID 4032 wrote to memory of 2184	4032	msedge.exe	86
PID 4032 wrote to memory of 2184	4032	msedge.exe	86
PID 4032 wrote to memory of 2184	4032	msedge.exe	86
PID 4032 wrote to memory of 2184	4032	msedge.exe	86
PID 4032 wrote to memory of 2184	4032	msedge.exe	86
PID 4032 wrote to memory of 2184	4032	msedge.exe	86
PID 4032 wrote to memory of 2184	4032	msedge.exe	86
PID 4032 wrote to memory of 2184	4032	msedge.exe	86
PID 4032 wrote to memory of 2184	4032	msedge.exe	86
PID 4032 wrote to memory of 2184	4032	msedge.exe	86
PID 4032 wrote to memory of 2184	4032	msedge.exe	86
PID 4032 wrote to memory of 2184	4032	msedge.exe	86
PID 4032 wrote to memory of 2184	4032	msedge.exe	86
PID 4032 wrote to memory of 2184	4032	msedge.exe	86
PID 4032 wrote to memory of 2184	4032	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1f0b3a3ff958ae45550872d162731631_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe732246f8,0x7ffe73224708,0x7ffe73224718
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,9298868697383429064,5335170634483198625,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,9298868697383429064,5335170634483198625,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,9298868697383429064,5335170634483198625,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9298868697383429064,5335170634483198625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9298868697383429064,5335170634483198625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,9298868697383429064,5335170634483198625,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
47cc78e05faffad142cdcd841ca2f51c

SHA1
95d852ca204db097a1d1206750cc170457a9457c

SHA256
6d27f02d0d20f478af2adecbc8e63e969c0f8146fe4e95ef6269b732cc5ed0a4

SHA512
72ca9c52d85124ca938fe6aca0e62024033c48cc5295326458582e35a7f525d163ab832daeac28af4d40bb16aba8972c479ad6535d96deb1cd23e5e81706c7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
da75a244a9d4f055fe02dfe65fec5078

SHA1
97d2e87db9669fcf578c48f56367082aa83e6c14

SHA256
7b72564aadd75d37ebf86f9bc7381e52e668f254bd507118468aed5ee7551371

SHA512
33dc50f746c8ebccd71f68c0b508bf161e97a924a7fc5d0f3848147cf13a02e260bd9d3c4177994d3895cd61c36fe6ce3aada961881e85201a00a108e10edc9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ef82cec3cb001fcce4e2c77cc71a43ef

SHA1
8bd90d9af10b1ef6251e279e61743eef3526425d

SHA256
507f31e0d5a31c3cafeddf2bb2211c1b90df537d5ddd614e3517ff371188c25f

SHA512
132d9e0d7b3742bc6cb06cc4aef674cac0b54b4e54052d1466c15ebe5a0bd3d8db95ed6e5f906971a61e3dd33196473766d51dfc5df07a8b26b78e02e514a0e5

Download Submit