d4795f6990b9441708d9b047787b9ac274ec05cb5ce705cf56608efdc0cbfc0a

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 21:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3109e222879a74493d01185eceada39d_JaffaCakes118.html
Size

136KB
MD5

3109e222879a74493d01185eceada39d
SHA1

fec48982b83562501ab7c54daaca1d20aba42d13
SHA256

d4795f6990b9441708d9b047787b9ac274ec05cb5ce705cf56608efdc0cbfc0a
SHA512

3e2b2b5498fbc81ddd404d22ea70cd4746b85da5162b00d66ed4625fc64ce3578c23eca92ea8acc8111ae5e40ec644d9c752162e3b4d40dbdf444fb6d8cd56f3
SSDEEP

3072:jsamm4kofDJ6K5NI8wSD4OlFh4Kl1C7hlFTYEl15nfDiz6xkipiugBF5syAygsup:EDJ6K5NI8wSD4OlFh4Kl1C7hlFTYEl1b

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
396	msedge.exe
396	msedge.exe
624	msedge.exe
624	msedge.exe
3780	identity_helper.exe
3780	identity_helper.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 5068	624	msedge.exe	84
PID 624 wrote to memory of 5068	624	msedge.exe	84
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 1212	624	msedge.exe	85
PID 624 wrote to memory of 396	624	msedge.exe	86
PID 624 wrote to memory of 396	624	msedge.exe	86
PID 624 wrote to memory of 1668	624	msedge.exe	87
PID 624 wrote to memory of 1668	624	msedge.exe	87
PID 624 wrote to memory of 1668	624	msedge.exe	87
PID 624 wrote to memory of 1668	624	msedge.exe	87
PID 624 wrote to memory of 1668	624	msedge.exe	87
PID 624 wrote to memory of 1668	624	msedge.exe	87
PID 624 wrote to memory of 1668	624	msedge.exe	87
PID 624 wrote to memory of 1668	624	msedge.exe	87
PID 624 wrote to memory of 1668	624	msedge.exe	87
PID 624 wrote to memory of 1668	624	msedge.exe	87
PID 624 wrote to memory of 1668	624	msedge.exe	87
PID 624 wrote to memory of 1668	624	msedge.exe	87
PID 624 wrote to memory of 1668	624	msedge.exe	87
PID 624 wrote to memory of 1668	624	msedge.exe	87
PID 624 wrote to memory of 1668	624	msedge.exe	87
PID 624 wrote to memory of 1668	624	msedge.exe	87
PID 624 wrote to memory of 1668	624	msedge.exe	87
PID 624 wrote to memory of 1668	624	msedge.exe	87
PID 624 wrote to memory of 1668	624	msedge.exe	87
PID 624 wrote to memory of 1668	624	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3109e222879a74493d01185eceada39d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbac2346f8,0x7ffbac234708,0x7ffbac234718
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,7330366673601864956,17803367417361035682,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,7330366673601864956,17803367417361035682,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,7330366673601864956,17803367417361035682,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7330366673601864956,17803367417361035682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7330366673601864956,17803367417361035682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,7330366673601864956,17803367417361035682,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,7330366673601864956,17803367417361035682,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7330366673601864956,17803367417361035682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7330366673601864956,17803367417361035682,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7330366673601864956,17803367417361035682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7330366673601864956,17803367417361035682,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,7330366673601864956,17803367417361035682,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4868 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
21e498abcca1d07206d28d58307c95fb

SHA1
0541097d1ba1be2bbbd0a1e8f12ce1b79cbdb3f6

SHA256
006ad4b66aaf67c1d5406a50ec410fed4ae325955d10b00bea7a9e2edc6ee9e2

SHA512
d1c33b2592f1a7199de6090b3ab1b7c2c2cc7e7efa13b7df4da9e54e05178dad0105fe40453df8f404e6a12426d634b5aadf0f74588ee93de466f4175ab3c091

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
abb1dfa3abcfc2ff0cb6c0357584f8e1

SHA1
af290cb055e447c56804610b50cc96d58aad55d9

SHA256
b8a3c4f3879b292ce2dbd6950e7db535cdb3659f92233b6ec5817a686df9752b

SHA512
1552ebb33a21c957d79c0973d37f5fbc00e4b9a5e6d14cd6f6bedcb8d0b6e4351a091c285b1db020144cfb3ad641ad174e4ff791e8e16a5f4a88093a71445813

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f27fdc9bbc96a6f77a2fe315036b8484

SHA1
9af28ec6d59c5450baba5577063ef72702a9dad6

SHA256
490eec66f78b79bd072def39388ba05d91352ea4261c2a0a761ffd4155ffb0d6

SHA512
3d7fb62f83c7a21025c8cb6e1f8ed0a009269d83f35169077bbac990f66a2325191d08fb9b00eced5b3d841406c784b272c55d8bf87ecb259e3d006f7a96eb17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4fd7b3b473ccdffcd7b7fa7477d90fdd

SHA1
1ed3a05856da57cf091c00d9c9d2ce4fbf818e0b

SHA256
c9dfa2450b7ad537961a1c92e8b4f0f94f302f9d3836e779fe3b1896d00f626b

SHA512
8c77cff898b7d35fc625e737ff43bce784909637ff3eeec81501b7875c1905d22c9bcff93109dce85bfc65327d5534a1d77c96a204da26b941d543f4b3643d1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
60efe3e589ed986bbd452dcf90c9d2a5

SHA1
ac37fadadd88bf4dd791de6f2595e00fc3a304d7

SHA256
8f848cc2416c3349beda33be779062a47df32b41b4e3c4df3cead3269d949258

SHA512
7c7667274135ded53dd6ce2f3940d66b1533e265fdeea21e9c16f95049ef400ba37695a65e696d9e8077cef56aceb64049ba6cb9d1c31fcc301117d82c37d073

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a43b9ed54b0a51e0425050f4eb075382

SHA1
f7075e9e7f395b7a9c11aca886482f570931bb44

SHA256
c55c79d812f41d8729c0eb9caef333dde29fcf4f7931c0179fbf04be685dd450

SHA512
75a0ba4cf5aac91da87fd0e9b909ee30ea81fe03a557b2583d4107cc9d8693326554284f11ecaa910e57371706a9290f66f70cf87584e0ebcd8ff5307ec2cc2c

Download Submit