74ebbd1996a559a9afb4956daac09ffbe503013d9b6ec73f4048f204b73a505c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

481c405a23d83a70b7c31c32180104cc_JaffaCakes118.html
Size

138KB
MD5

481c405a23d83a70b7c31c32180104cc
SHA1

ac07fa024ce545eab5b609388171d7467b6a9134
SHA256

74ebbd1996a559a9afb4956daac09ffbe503013d9b6ec73f4048f204b73a505c
SHA512

f954e024a630adae4c0135251f04851d8cd2c6bf703f3e0a666e6073de8f69831f89907f0531fd6a0b59d844a1e4ea0168c557cf0838cf374b7c58de5fd70ba9
SSDEEP

3072:Sk3lzBF++ewKzEuVC585HjiUrDNwRXaQVyfkVTJc:SUlHejroyiT2

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3552	msedge.exe
3552	msedge.exe
1284	msedge.exe
1284	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1284	msedge.exe
1284	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 3388	1284	msedge.exe	83
PID 1284 wrote to memory of 3388	1284	msedge.exe	83
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 4608	1284	msedge.exe	84
PID 1284 wrote to memory of 3552	1284	msedge.exe	85
PID 1284 wrote to memory of 3552	1284	msedge.exe	85
PID 1284 wrote to memory of 2576	1284	msedge.exe	86
PID 1284 wrote to memory of 2576	1284	msedge.exe	86
PID 1284 wrote to memory of 2576	1284	msedge.exe	86
PID 1284 wrote to memory of 2576	1284	msedge.exe	86
PID 1284 wrote to memory of 2576	1284	msedge.exe	86
PID 1284 wrote to memory of 2576	1284	msedge.exe	86
PID 1284 wrote to memory of 2576	1284	msedge.exe	86
PID 1284 wrote to memory of 2576	1284	msedge.exe	86
PID 1284 wrote to memory of 2576	1284	msedge.exe	86
PID 1284 wrote to memory of 2576	1284	msedge.exe	86
PID 1284 wrote to memory of 2576	1284	msedge.exe	86
PID 1284 wrote to memory of 2576	1284	msedge.exe	86
PID 1284 wrote to memory of 2576	1284	msedge.exe	86
PID 1284 wrote to memory of 2576	1284	msedge.exe	86
PID 1284 wrote to memory of 2576	1284	msedge.exe	86
PID 1284 wrote to memory of 2576	1284	msedge.exe	86
PID 1284 wrote to memory of 2576	1284	msedge.exe	86
PID 1284 wrote to memory of 2576	1284	msedge.exe	86
PID 1284 wrote to memory of 2576	1284	msedge.exe	86
PID 1284 wrote to memory of 2576	1284	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\481c405a23d83a70b7c31c32180104cc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb6a6b46f8,0x7ffb6a6b4708,0x7ffb6a6b4718
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,131100056184794980,12670147740939733835,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,131100056184794980,12670147740939733835,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,131100056184794980,12670147740939733835,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,131100056184794980,12670147740939733835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,131100056184794980,12670147740939733835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,131100056184794980,12670147740939733835,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4888 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
266B

MD5
d9b1f04bc5db503ae45aa524b454f4ba

SHA1
703fc30acbfd6a795029c2a85c1323c688445bcc

SHA256
c7935c2e71e9ad736655c8d83a9a19b76ee3e3c38873b9b2b58f85e51519ad29

SHA512
8ef02d590aa5fee3767567ae0326cfcd37e97056ab736889b2486428b0dd806c984ec121147130889cb3533eba60219e0afb0e762d7556c0a5e16252d25fc901

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6c6651324ea73d190b001fcbe69885df

SHA1
69255f712afc6604ab1c568f1ee968fa1331cb18

SHA256
93341cf86d9879bb7da1fda32e577181e4dcac3ad6a7a6eaf1a421628d26226e

SHA512
ccbc45211677e94e99924d97b0ce3400a0f8bbefd6941becc4f5fe4df169aadab2309f62835dd9ccc6dc8e20e2d69fe84985d772695eac42ac9f2eb7b9045acf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ab25047c8fa10b5f6040fbe5a19f1acb

SHA1
1658d436fe5f94eeadc001af320391e8e66f971a

SHA256
169369c9b49caed34ab273e7122598b87b6f16506d0b0fe76c56f562d4504b73

SHA512
17fd94a7ffba9ceefd6eb1e32188b5bdb0312d9f7b819f7f4372651bfed253ed524654b7a6229e8b31a2498317309db42c6e0ac8df2c879719fcabc1dd8aa0a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
71d1c997b95d10762cb659aef3bab4b4

SHA1
691bffdba6f85c7b6b7e6d817a1f81a808de8bd5

SHA256
8631e00b08039877f950373ac72848bc9cad28054d954b9de8cdf75dff2415f5

SHA512
a84377bf6c1e66496375ece18fccbe8b27b53ce85a924011c2abb14f04d92382b4bfa4b89fa89cae46422ce698911ffa9a35009152ce26edc7741c4f2761f3a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0876328471e9125bdda60831e36a27e4

SHA1
b1d79ecf24cc4647870d658a06da13fab5756c06

SHA256
bc87bb035b2e23c14db9f151f7d0aa88e6c8a659fdd4964eda3647024daa30ff

SHA512
55edd0ccf3d13f81af5352002f1222fd97814d91772ff8d9c2738b3e58bf30321a767385a53429091f1a0899106dd617abd82a619f84a7f305835c464b1655b1

Download Submit