452059c84e4efa4c22072383efab13b8c7cad2f8ca20660b4f7fa8f297f49bbf

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 10:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

398b923a4322a41b08526177159a3e4c_JaffaCakes118.html
Size

31KB
MD5

398b923a4322a41b08526177159a3e4c
SHA1

a69523dd781cb02f1e6c67906cec440f6d80fa98
SHA256

452059c84e4efa4c22072383efab13b8c7cad2f8ca20660b4f7fa8f297f49bbf
SHA512

72ca9e9cc4b56f599b4893d7ef9fa68c2d77a2d25d941ee843abaf0aed7523ea75436b330a87de592cb7b4520f6c52b8998b8d0f53493789a6dd4b49cc5b1ed0
SSDEEP

384:4B9iy2KfzmUBMtJ9rJvYOxnmpspG/IJe+xw/TjeEeSO2yeTU5ilh7vMFC3I57yfy:Ty2qmUCeJP+xw/PeEFdU5IvpQNPJ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
3216	msedge.exe
3216	msedge.exe
3176	identity_helper.exe
3176	identity_helper.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 2296	3216	msedge.exe	82
PID 3216 wrote to memory of 2296	3216	msedge.exe	82
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 2956	3216	msedge.exe	83
PID 3216 wrote to memory of 4492	3216	msedge.exe	84
PID 3216 wrote to memory of 4492	3216	msedge.exe	84
PID 3216 wrote to memory of 464	3216	msedge.exe	85
PID 3216 wrote to memory of 464	3216	msedge.exe	85
PID 3216 wrote to memory of 464	3216	msedge.exe	85
PID 3216 wrote to memory of 464	3216	msedge.exe	85
PID 3216 wrote to memory of 464	3216	msedge.exe	85
PID 3216 wrote to memory of 464	3216	msedge.exe	85
PID 3216 wrote to memory of 464	3216	msedge.exe	85
PID 3216 wrote to memory of 464	3216	msedge.exe	85
PID 3216 wrote to memory of 464	3216	msedge.exe	85
PID 3216 wrote to memory of 464	3216	msedge.exe	85
PID 3216 wrote to memory of 464	3216	msedge.exe	85
PID 3216 wrote to memory of 464	3216	msedge.exe	85
PID 3216 wrote to memory of 464	3216	msedge.exe	85
PID 3216 wrote to memory of 464	3216	msedge.exe	85
PID 3216 wrote to memory of 464	3216	msedge.exe	85
PID 3216 wrote to memory of 464	3216	msedge.exe	85
PID 3216 wrote to memory of 464	3216	msedge.exe	85
PID 3216 wrote to memory of 464	3216	msedge.exe	85
PID 3216 wrote to memory of 464	3216	msedge.exe	85
PID 3216 wrote to memory of 464	3216	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\398b923a4322a41b08526177159a3e4c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc502e46f8,0x7ffc502e4708,0x7ffc502e4718
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2268,11155359935266553183,4036760270151060344,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2268,11155359935266553183,4036760270151060344,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2268,11155359935266553183,4036760270151060344,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,11155359935266553183,4036760270151060344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,11155359935266553183,4036760270151060344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,11155359935266553183,4036760270151060344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2268,11155359935266553183,4036760270151060344,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2268,11155359935266553183,4036760270151060344,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,11155359935266553183,4036760270151060344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,11155359935266553183,4036760270151060344,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,11155359935266553183,4036760270151060344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,11155359935266553183,4036760270151060344,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2268,11155359935266553183,4036760270151060344,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3804 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
649B

MD5
7c25796aab820cadb3fde87c5eadeebd

SHA1
6163a41135e0382e45935a9917bef1cbf003f6b8

SHA256
5eede69eed13baeafeb1d59a353e80e98b2d98a96591e9d6156f2f84388b358b

SHA512
cd6249328d7fe367dced417dfb32d83149350652b333897c900b99c6371e9c4d2881bf3acc53349b1e1ce18749326ee3e09c2030d764d45b7e5b7184b9db22a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
96005c3ee569daef72551edc5f39f1e8

SHA1
a7544f00c884a711e5e8e3849e986b0713d49ae9

SHA256
9125081e155a00183972d7a4261710792a6c875c3eb98c1f7b770778ca8e7e20

SHA512
31a77a2467ecc8b160b2c888a8eb514addd78da2a665cbe5620f044030ac8a844817cbfc28119b7929730f04e1158b3cbc2fec39c59b11b4f36a4c431584b0a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5233160da747a806cbb94dd638d2c697

SHA1
6373d9557e40633d54b9c7b883cef41463b75a9d

SHA256
fea31b09d53b71e005e099322ecf59d7416980f6e81b6ce34b4f0004f78be422

SHA512
8251c7cfebc86bff42b2275be3c394da7dbf1c71ec9f8c2edb3f91c1258f45ed5e803d82271d2866af9125b275d99fe30626a67dfcddcab8f124691329b15790

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
62030ebd0e3b39354021ce1a4f7fd8d6

SHA1
c5f7501c5743b3837f0175a759512280867f0a98

SHA256
43dedefc31bf7c3f751b5b0e83f21561ccbdeea0f8aeea285b41e93969fe0fd4

SHA512
0153fdfe9455a3532798cd422189b612c336986ee3bbba35d9f3379019b1c2773ffb6a69e5bbd6907ee2aef74f9aa06ed8a0945653469e2e6a3cb1c45dbafb91

Download Submit