d00fe38212be152e93c8b24868f947e8424df7a751a0472f1f3f14846521b4c9

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 05:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4988d3c2256dc6f0d0561fe762751151_JaffaCakes118.html
Size

139KB
MD5

4988d3c2256dc6f0d0561fe762751151
SHA1

d25e0e9774bf80fdb531925ac86cf678cee1ea5a
SHA256

d00fe38212be152e93c8b24868f947e8424df7a751a0472f1f3f14846521b4c9
SHA512

97c8653094831e1fc9bd564a549d1dbe6aa2aacd6fcf4eca1ccd308ffe791f49fc46821a3f4f5021acac60d132da15ec864df3c8df3331ded22ac954185898b2
SSDEEP

1536:SZNGf79l0leyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:SZUz93yfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
4788	msedge.exe
4788	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 1388	4788	msedge.exe	83
PID 4788 wrote to memory of 1388	4788	msedge.exe	83
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 1892	4788	msedge.exe	84
PID 4788 wrote to memory of 2196	4788	msedge.exe	85
PID 4788 wrote to memory of 2196	4788	msedge.exe	85
PID 4788 wrote to memory of 1136	4788	msedge.exe	86
PID 4788 wrote to memory of 1136	4788	msedge.exe	86
PID 4788 wrote to memory of 1136	4788	msedge.exe	86
PID 4788 wrote to memory of 1136	4788	msedge.exe	86
PID 4788 wrote to memory of 1136	4788	msedge.exe	86
PID 4788 wrote to memory of 1136	4788	msedge.exe	86
PID 4788 wrote to memory of 1136	4788	msedge.exe	86
PID 4788 wrote to memory of 1136	4788	msedge.exe	86
PID 4788 wrote to memory of 1136	4788	msedge.exe	86
PID 4788 wrote to memory of 1136	4788	msedge.exe	86
PID 4788 wrote to memory of 1136	4788	msedge.exe	86
PID 4788 wrote to memory of 1136	4788	msedge.exe	86
PID 4788 wrote to memory of 1136	4788	msedge.exe	86
PID 4788 wrote to memory of 1136	4788	msedge.exe	86
PID 4788 wrote to memory of 1136	4788	msedge.exe	86
PID 4788 wrote to memory of 1136	4788	msedge.exe	86
PID 4788 wrote to memory of 1136	4788	msedge.exe	86
PID 4788 wrote to memory of 1136	4788	msedge.exe	86
PID 4788 wrote to memory of 1136	4788	msedge.exe	86
PID 4788 wrote to memory of 1136	4788	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4988d3c2256dc6f0d0561fe762751151_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffffdf846f8,0x7ffffdf84708,0x7ffffdf84718
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,16727757766258191893,16025298247330165068,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,16727757766258191893,16025298247330165068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,16727757766258191893,16025298247330165068,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16727757766258191893,16025298247330165068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16727757766258191893,16025298247330165068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,16727757766258191893,16025298247330165068,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2788 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9f575b418454252f5e0bafeb16613759

SHA1
204ad9a06d008c9bc4439bbc90570d549b4c10d9

SHA256
4a5bec32de81ab6672bccbd8c3fa38b10984dd88e99b3fa860c90e028abce0d9

SHA512
4850ccbf845e318a531dea7d25ae501b88e522cdf7d5f00afa66a40586826d26914a221b5245a99aaf1093bdc0e76ad8c4937bf94204e7b16a0479dda87aa90a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a717fc73ed1cf6e48d166fb440745a19

SHA1
f05f5506d3a4ebd1b4022ac5eacf515917f0979a

SHA256
e7269a85da540980edcded1aa2ddf1a8170b942db9fc873dd4c0065566085674

SHA512
46d367e84ae60b8acdab2cb4c2c63e0b29ae2182e881d502c515caee20f91c719418d395321e75fd1f9d28f7e2d7f141f35c4d00622945eebe8c9bbb967b1054

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6765b85b365136ba0a14771e454c4070

SHA1
e47bc7fb7f74424b16ecebee8f66b55659a7eb28

SHA256
beb29a87c895ac3b0bf7eef4d8e02e2279769c57341ed81232540a16d12ee355

SHA512
15560835c2b632888e1c3c54d2c0248edf418070223cdae9bebdf0ad33e02360f469449240a66c64d22fd1fb5e5dd3ed9c5a2d5147e8325d5461b604f2aca05a

Download Submit