0a911e9f0e151a440c4f0d318c2d3aa377b6fa0dcba50be591ddaecf6687cd24

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 14:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

46940079fb5b61c7424edd33aab32ce9_JaffaCakes118.html
Size

138KB
MD5

46940079fb5b61c7424edd33aab32ce9
SHA1

69e9d00d16b451c52ef344da296c00f8cf7bcf9e
SHA256

0a911e9f0e151a440c4f0d318c2d3aa377b6fa0dcba50be591ddaecf6687cd24
SHA512

06bb3b7bad5d82ff649cda40c169110229eb82b7a078495766cbd08eeb77841ebb556e9a039b597dd7aef072dc416f28a2db857b9100bf66a712c17e531731b0
SSDEEP

3072:eQyyfkMY+BES09JXAnyrZalI+YyuZnl4voX:J3sMYod+X3oI+YFluvoX

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3556	msedge.exe
3556	msedge.exe
1836	msedge.exe
1836	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1836	msedge.exe
1836	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 3620	1836	msedge.exe	82
PID 1836 wrote to memory of 3620	1836	msedge.exe	82
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 2436	1836	msedge.exe	83
PID 1836 wrote to memory of 3556	1836	msedge.exe	84
PID 1836 wrote to memory of 3556	1836	msedge.exe	84
PID 1836 wrote to memory of 3508	1836	msedge.exe	85
PID 1836 wrote to memory of 3508	1836	msedge.exe	85
PID 1836 wrote to memory of 3508	1836	msedge.exe	85
PID 1836 wrote to memory of 3508	1836	msedge.exe	85
PID 1836 wrote to memory of 3508	1836	msedge.exe	85
PID 1836 wrote to memory of 3508	1836	msedge.exe	85
PID 1836 wrote to memory of 3508	1836	msedge.exe	85
PID 1836 wrote to memory of 3508	1836	msedge.exe	85
PID 1836 wrote to memory of 3508	1836	msedge.exe	85
PID 1836 wrote to memory of 3508	1836	msedge.exe	85
PID 1836 wrote to memory of 3508	1836	msedge.exe	85
PID 1836 wrote to memory of 3508	1836	msedge.exe	85
PID 1836 wrote to memory of 3508	1836	msedge.exe	85
PID 1836 wrote to memory of 3508	1836	msedge.exe	85
PID 1836 wrote to memory of 3508	1836	msedge.exe	85
PID 1836 wrote to memory of 3508	1836	msedge.exe	85
PID 1836 wrote to memory of 3508	1836	msedge.exe	85
PID 1836 wrote to memory of 3508	1836	msedge.exe	85
PID 1836 wrote to memory of 3508	1836	msedge.exe	85
PID 1836 wrote to memory of 3508	1836	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\46940079fb5b61c7424edd33aab32ce9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa72446f8,0x7fffa7244708,0x7fffa7244718
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,15779525917780041792,3099647872820909473,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,15779525917780041792,3099647872820909473,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,15779525917780041792,3099647872820909473,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15779525917780041792,3099647872820909473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15779525917780041792,3099647872820909473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,15779525917780041792,3099647872820909473,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1364 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8f77f2dbc532d23efd9b93e1fb8b7ac7

SHA1
f7fff06e6f71d1d618dafd84cb6b6d8ec09e86f6

SHA256
145a89476d5b780f66d63c51e8da4492fce2a53e5874004859188bd6d0b68a6d

SHA512
5ffc307e065093d37531bf8686f00bd832cc1ed40e4e2c33b57186fdb6e779141a61671079a3b8db5128b499a84811ca841eb9e3f0ea43875789942047ecb0f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4cec3b831d6559cab6b79ecd4e5470df

SHA1
7d2997460ae25e5364073779becd8943f9739f1b

SHA256
032d8376295a4f25c1ed1f499859c5d46ee7b650992d41346d9a863044f58cd2

SHA512
10dabae1a706a6e0d005f995b1fa98cbca5a22555aff1565263cac1f992f7d41dfd17fa07d8b6bfc8dffa46f876ac2c5c828ce19bb2b6a06dfe49889e7b1c5e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
97ea95a46c50b29037c0e18dec361ff4

SHA1
6fa2253f254f88b457b0efc6c9f4f9d5ce9b439a

SHA256
004828f94e2827a0b3eee8bdde96c9d1b5f3eb98d011fa9f28ba923f2c6d2441

SHA512
e3b6a2baadbcbd45b7a5ce6f62d2233b65cfead4bef46763f2e3b38bdb2eb157e06440fbc46fc2945716e5409cebd9861a093c5b38817ae992070ce317061856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
49f80249ba4f5a5c6b030726680fd824

SHA1
5330a99c3569db01775b1b23094d703c67081096

SHA256
e92bb2b9745bc379f7406ba5e0d39c014bb448b2ee50f050411ea480ce969934

SHA512
2573f8a6591a2e08d49d87f145d6de0ec54f1138a9a5c26933e8fcc6f27e99dbd675047ff34d09f6768b42c49fd8259cf50fcea7ce2d22af4b773892306eb3f3

Download Submit