d0c195e826675880db03ebfe18532fb9f9b5f5813479a9b5ba846306bf42b3d9

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 23:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4da3bdc51118fe1145a27261c26d5551_JaffaCakes118.html
Size

140KB
MD5

4da3bdc51118fe1145a27261c26d5551
SHA1

db445d7c09cd7d12993427814f6ffceb4cefe162
SHA256

d0c195e826675880db03ebfe18532fb9f9b5f5813479a9b5ba846306bf42b3d9
SHA512

e315257ee2c8c13b8fdb55cb886dc8077c1d952a63d932bf9a48ad3b22d3d66f855b47894de31fd61c820fdcd11f426c2f23d543179425da6d97525624a3dab3
SSDEEP

1536:Smb9pFOcc3lOyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:SmbjTyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe
4272	msedge.exe
4272	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 1008	4272	msedge.exe	83
PID 4272 wrote to memory of 1008	4272	msedge.exe	83
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 3844	4272	msedge.exe	84
PID 4272 wrote to memory of 1968	4272	msedge.exe	85
PID 4272 wrote to memory of 1968	4272	msedge.exe	85
PID 4272 wrote to memory of 3528	4272	msedge.exe	86
PID 4272 wrote to memory of 3528	4272	msedge.exe	86
PID 4272 wrote to memory of 3528	4272	msedge.exe	86
PID 4272 wrote to memory of 3528	4272	msedge.exe	86
PID 4272 wrote to memory of 3528	4272	msedge.exe	86
PID 4272 wrote to memory of 3528	4272	msedge.exe	86
PID 4272 wrote to memory of 3528	4272	msedge.exe	86
PID 4272 wrote to memory of 3528	4272	msedge.exe	86
PID 4272 wrote to memory of 3528	4272	msedge.exe	86
PID 4272 wrote to memory of 3528	4272	msedge.exe	86
PID 4272 wrote to memory of 3528	4272	msedge.exe	86
PID 4272 wrote to memory of 3528	4272	msedge.exe	86
PID 4272 wrote to memory of 3528	4272	msedge.exe	86
PID 4272 wrote to memory of 3528	4272	msedge.exe	86
PID 4272 wrote to memory of 3528	4272	msedge.exe	86
PID 4272 wrote to memory of 3528	4272	msedge.exe	86
PID 4272 wrote to memory of 3528	4272	msedge.exe	86
PID 4272 wrote to memory of 3528	4272	msedge.exe	86
PID 4272 wrote to memory of 3528	4272	msedge.exe	86
PID 4272 wrote to memory of 3528	4272	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4da3bdc51118fe1145a27261c26d5551_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3ad546f8,0x7ffa3ad54708,0x7ffa3ad54718
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,10265774788038196865,5448762311455087346,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,10265774788038196865,5448762311455087346,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,10265774788038196865,5448762311455087346,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10265774788038196865,5448762311455087346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2360 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10265774788038196865,5448762311455087346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,10265774788038196865,5448762311455087346,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3016 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
66cee0d63d15bc0a80f7b877a2f58c1c

SHA1
51cf55c99bfb199c51f20b3682e7ba1bbcb9f6c6

SHA256
76c75141e3d706247e8fd77de58b4f195cff12f06b871cb1e80aa08159862662

SHA512
c65e95491582cafcbc4b5da22075adea6f6ae6990319c5fde304a1c8358ebff78628f3ffcbbf367c4515fd6fcee30475b76653a6ebde2d789b5f7a81c51c56c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a56d8ea94ed27c74417dbe79deb1e7b2

SHA1
37282abd607912569514e7ad790c4a43e963f435

SHA256
c87914ad8376365db704fd90b8b9194f04a1e7ff417d2071573d3508c49714e3

SHA512
419331508d50054f31012a62af12bb113fe44a78e62843d3da04ba9056c2aadbd5bde18d411b541ebe231ed5ce6bfb79808c923138c99415d20d0a8edd6d35f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2e9d80c43a420f80fb4fa60947a01c44

SHA1
4cbe2b661235e973993cbc0a9e59fe0d4a6fff9b

SHA256
6c41fe7292899975b70839a902a5dcafea873bcb55b2106acb4310e55612cdd2

SHA512
930847ff2d26ddfae6c48fb9a2c1b3d097f50a9b62ec85ec525cd0888d93524a98640c78f32e355a76d653dc47cc906686c98d574d3fd42cb58719daae56e0c7

Download Submit