391b54663b8359e2c71b068aa41599d347197599c3c7a7373d8ebf3de779cd97

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 06:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

38b02555a7b2ed150b48e3e8ddf559c2_JaffaCakes118.html
Size

139KB
MD5

38b02555a7b2ed150b48e3e8ddf559c2
SHA1

47da84af578eaf695f8d6f488d4d62e22022d9dc
SHA256

391b54663b8359e2c71b068aa41599d347197599c3c7a7373d8ebf3de779cd97
SHA512

9219c9196621f987031e736a58fa9ba137af42ded758edf98a1b11761e64fef8e4829be62eadfc13d13f9159b7270488ad55ee1629dc4fba570907d3bc8a7ec5
SSDEEP

1536:SWVI5KlHyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy+:SWqEyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe
3328	msedge.exe
3328	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 1020	3328	msedge.exe	82
PID 3328 wrote to memory of 1020	3328	msedge.exe	82
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4416	3328	msedge.exe	83
PID 3328 wrote to memory of 4060	3328	msedge.exe	84
PID 3328 wrote to memory of 4060	3328	msedge.exe	84
PID 3328 wrote to memory of 376	3328	msedge.exe	85
PID 3328 wrote to memory of 376	3328	msedge.exe	85
PID 3328 wrote to memory of 376	3328	msedge.exe	85
PID 3328 wrote to memory of 376	3328	msedge.exe	85
PID 3328 wrote to memory of 376	3328	msedge.exe	85
PID 3328 wrote to memory of 376	3328	msedge.exe	85
PID 3328 wrote to memory of 376	3328	msedge.exe	85
PID 3328 wrote to memory of 376	3328	msedge.exe	85
PID 3328 wrote to memory of 376	3328	msedge.exe	85
PID 3328 wrote to memory of 376	3328	msedge.exe	85
PID 3328 wrote to memory of 376	3328	msedge.exe	85
PID 3328 wrote to memory of 376	3328	msedge.exe	85
PID 3328 wrote to memory of 376	3328	msedge.exe	85
PID 3328 wrote to memory of 376	3328	msedge.exe	85
PID 3328 wrote to memory of 376	3328	msedge.exe	85
PID 3328 wrote to memory of 376	3328	msedge.exe	85
PID 3328 wrote to memory of 376	3328	msedge.exe	85
PID 3328 wrote to memory of 376	3328	msedge.exe	85
PID 3328 wrote to memory of 376	3328	msedge.exe	85
PID 3328 wrote to memory of 376	3328	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\38b02555a7b2ed150b48e3e8ddf559c2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97d9546f8,0x7ff97d954708,0x7ff97d954718
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,11399163075432387384,14209410757513085789,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,11399163075432387384,14209410757513085789,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,11399163075432387384,14209410757513085789,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11399163075432387384,14209410757513085789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11399163075432387384,14209410757513085789,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,11399163075432387384,14209410757513085789,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c84203b1988525e4358087f762782e78

SHA1
3e7d610e081f30d1582eb4b53077f318fd1b84b0

SHA256
4a4c8f49f4df986573abf13630e3af1eacc3893993142a57aaba41ebb56e7e0d

SHA512
ac9b49c2e16bf27e98306a34d440f596bd274300f6b43812bf0f77e8c5979975445fdca861647264ba99ce4a96b5771a554b38292474d510749af9df687a7862

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
900ee9d8d6aa106e946a27ef0d8e7cba

SHA1
2960255a33adee2a6bab07251f0c1549d346ce31

SHA256
1792f05aa49db73827cb6f720ffcdcaa8ca31e9b60e0e64890646f001dc182d5

SHA512
bacfa4fa9352e7e690e32a476e97b5e81639fd6d48fc4183b189215488591bc8e6cfe35912a3e33c6c7f09f92713028e7278c4c43a3841e34577cc2da88d1243

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
67c5b9165fd57260628435d4d31866e6

SHA1
752f439d7cb4c19ed7f00456876a190a9617570e

SHA256
29e6bfc52f9069838eb3e3fed008c7f68dd73b51df6c0206d5f6fff45c6e2b0a

SHA512
bc9bb7af4ebc08de0e424fedefaffc7a1e6b744c035423bea3579bdbe0b46ef0518b74c7dc29610d80dc7ba17a98f7f0f2c1824e9dd373a20201639ad71f5304

Download Submit