ebb2beafcce5a4d2a58bc382394c18a30c2a4e97f05d8099e05427fbce2c6e88

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 05:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49840749c3da2baad85c4fef1d8a78f3_JaffaCakes118.html
Size

471KB
MD5

49840749c3da2baad85c4fef1d8a78f3
SHA1

5e3f0ceb759ac48183304be51f7ac5ff787c42f4
SHA256

ebb2beafcce5a4d2a58bc382394c18a30c2a4e97f05d8099e05427fbce2c6e88
SHA512

84fab3d2ce9dc48a3926b3632248d9be6b89085192f44dbbe103b9a305727389a84347e6bd2136ef51c74f3b61ef2368ff988aa786094aa57396519c85835385
SSDEEP

6144:esMYod+X3oI+YI1fsMYod+X3oI+YksMYod+X3oI+Y7sMYod+X3oI+YW:c5d+X3I5d+X3Y5d+X315d+X3c

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2088	msedge.exe
2088	msedge.exe
4016	msedge.exe
4016	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4016	msedge.exe
4016	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 1692	4016	msedge.exe	84
PID 4016 wrote to memory of 1692	4016	msedge.exe	84
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2812	4016	msedge.exe	85
PID 4016 wrote to memory of 2088	4016	msedge.exe	86
PID 4016 wrote to memory of 2088	4016	msedge.exe	86
PID 4016 wrote to memory of 3500	4016	msedge.exe	87
PID 4016 wrote to memory of 3500	4016	msedge.exe	87
PID 4016 wrote to memory of 3500	4016	msedge.exe	87
PID 4016 wrote to memory of 3500	4016	msedge.exe	87
PID 4016 wrote to memory of 3500	4016	msedge.exe	87
PID 4016 wrote to memory of 3500	4016	msedge.exe	87
PID 4016 wrote to memory of 3500	4016	msedge.exe	87
PID 4016 wrote to memory of 3500	4016	msedge.exe	87
PID 4016 wrote to memory of 3500	4016	msedge.exe	87
PID 4016 wrote to memory of 3500	4016	msedge.exe	87
PID 4016 wrote to memory of 3500	4016	msedge.exe	87
PID 4016 wrote to memory of 3500	4016	msedge.exe	87
PID 4016 wrote to memory of 3500	4016	msedge.exe	87
PID 4016 wrote to memory of 3500	4016	msedge.exe	87
PID 4016 wrote to memory of 3500	4016	msedge.exe	87
PID 4016 wrote to memory of 3500	4016	msedge.exe	87
PID 4016 wrote to memory of 3500	4016	msedge.exe	87
PID 4016 wrote to memory of 3500	4016	msedge.exe	87
PID 4016 wrote to memory of 3500	4016	msedge.exe	87
PID 4016 wrote to memory of 3500	4016	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\49840749c3da2baad85c4fef1d8a78f3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5bce46f8,0x7ffa5bce4708,0x7ffa5bce4718
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,7618099454024079522,2778970712118972258,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,7618099454024079522,2778970712118972258,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,7618099454024079522,2778970712118972258,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7618099454024079522,2778970712118972258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7618099454024079522,2778970712118972258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,7618099454024079522,2778970712118972258,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4840 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
70ef4c4904307718d53788698a519870

SHA1
a15f71c30f04f09b60d1b72a0a7ae3fbae13bafc

SHA256
f455ec89797e41e5c0f2f791ae0247581846fd613e00f170cebcfcf6a1134e0e

SHA512
966a646ad9c48417cedfca112c2426830496061b082fc81457d314a5d47bbb220cbaf9fddc9e382f97c1ac84169de464c57c5f45310c2f57c8da0a84a0ef9891

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
22dd78a6624a79d50cf89fd5f89d8a78

SHA1
3764aff65b5807e002f7dddb68cfe102ce343219

SHA256
78046dafa2e3e856f31251e0d99f32030b3085f6f8a673956e5b0fe55ed00287

SHA512
567bf64cb8215606e41c0b8c5ca6c140d91189b0fce0aa79e5d56a76e144d8d10e62f0fc6a477966584058d36b904253d4d659304b151c799a9ef8cbf9ca6384

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ea017cb2bfc699834ed3b2bf9a988a8a

SHA1
4304c5d167b5181be1a54d4f89346b154c438664

SHA256
6c1c7e2a7393afee78adb3be49c1a2cb68e37a6d3e9007826f88ba4797c5fc86

SHA512
b984246995e400520720339d7b13542d278b04d26c076f8998023d90cee13a750b2301c2b207fdc5f7b34039712d19b1c725b3f86e868d625dc47e100c810c8c

Download Submit