98628cead5d89a113c8f2771488ef613f56ae4493813f2fb80891ed960dc42a3

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 14:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4007ccb96bc8471b06b15ed53fd851c3_JaffaCakes118.html
Size

139KB
MD5

4007ccb96bc8471b06b15ed53fd851c3
SHA1

9da114861830f9e408affe68f78e2a29f82851e7
SHA256

98628cead5d89a113c8f2771488ef613f56ae4493813f2fb80891ed960dc42a3
SHA512

4cecb94aba717623ad621c4dc4820010b7118d5ca876507d549a6a2bd6227afc37e0b0631f0ca8ef2a5deb2c2484a9abeb54a14a976a1808ac08f104f7ae3a66
SSDEEP

1536:SIHNGl2GyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy+:SIlGyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
912	msedge.exe
912	msedge.exe
1592	msedge.exe
1592	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1592	msedge.exe
1592	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 2684	1592	msedge.exe	83
PID 1592 wrote to memory of 2684	1592	msedge.exe	83
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 3012	1592	msedge.exe	84
PID 1592 wrote to memory of 912	1592	msedge.exe	85
PID 1592 wrote to memory of 912	1592	msedge.exe	85
PID 1592 wrote to memory of 4288	1592	msedge.exe	86
PID 1592 wrote to memory of 4288	1592	msedge.exe	86
PID 1592 wrote to memory of 4288	1592	msedge.exe	86
PID 1592 wrote to memory of 4288	1592	msedge.exe	86
PID 1592 wrote to memory of 4288	1592	msedge.exe	86
PID 1592 wrote to memory of 4288	1592	msedge.exe	86
PID 1592 wrote to memory of 4288	1592	msedge.exe	86
PID 1592 wrote to memory of 4288	1592	msedge.exe	86
PID 1592 wrote to memory of 4288	1592	msedge.exe	86
PID 1592 wrote to memory of 4288	1592	msedge.exe	86
PID 1592 wrote to memory of 4288	1592	msedge.exe	86
PID 1592 wrote to memory of 4288	1592	msedge.exe	86
PID 1592 wrote to memory of 4288	1592	msedge.exe	86
PID 1592 wrote to memory of 4288	1592	msedge.exe	86
PID 1592 wrote to memory of 4288	1592	msedge.exe	86
PID 1592 wrote to memory of 4288	1592	msedge.exe	86
PID 1592 wrote to memory of 4288	1592	msedge.exe	86
PID 1592 wrote to memory of 4288	1592	msedge.exe	86
PID 1592 wrote to memory of 4288	1592	msedge.exe	86
PID 1592 wrote to memory of 4288	1592	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4007ccb96bc8471b06b15ed53fd851c3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8354246f8,0x7ff835424708,0x7ff835424718
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,5869740067000700717,954482910163466770,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,5869740067000700717,954482910163466770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,5869740067000700717,954482910163466770,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5869740067000700717,954482910163466770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5869740067000700717,954482910163466770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,5869740067000700717,954482910163466770,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
07f51874cbcbea452bd63554b85d79f6

SHA1
9ec8722845d913207446bd3ea953105e43d963f3

SHA256
0fe5432aa4719c5cc6a2a7d12153e7e472933a3046a6ea506099fe3d35dd4cb2

SHA512
51d80359d415b3f5e2024eefcdd83ec689d5a4ea64aae007589a9cdb194991b8a2c328af45416ad11f32565c65ef2d164f5f48371bdb85ea104ad1dd332d8001

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b7db28eecbb9d81f35942f1a7edad390

SHA1
93ad054b9ea806ee8e16baaff628f99150bbc0bd

SHA256
254008cf5bfc5d7417ffa6c21ed88a1ab53994d6773fc2ed78bd8aa1a19359bb

SHA512
e02537d478d93e3ca12e95fd8aae58165b175fabf26c606cf8ea40348a5d7b5eead7e70b971bb73ee8c023ffacecdc75502ac6ea10f5598e5b7e1024c3d9fcf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bcdc568c-d1ef-40cb-8203-36f9b596c1b2.tmp

Filesize
11KB

MD5
aef6dfcd0df965290a077a12c45be67d

SHA1
4ad89bd070726fe905aff40351c7bb7f1d5fccf2

SHA256
c9545e4ad50b2836b18214d604899c293ed051ad9a1c2ab4f8fdd94c14549d7e

SHA512
12168b733e30016412132d603b5c2db7404dd0f808444b898d7f074ad6f5cd48d2054ac5d36d19e5dd0f1631ed90277ff1ccf4cf86ac0b11db6dc493292f8c8e

Download Submit