f965403208c99d4f5f7782bfc117b36be49d30b2ad50438e857e4b112511d0fa

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c736bc72b6c22bf18033b7951dbbc4f_JaffaCakes118.html
Size

139KB
MD5

4c736bc72b6c22bf18033b7951dbbc4f
SHA1

6fc915f24f7993c1271e3c96176fae486f4156f9
SHA256

f965403208c99d4f5f7782bfc117b36be49d30b2ad50438e857e4b112511d0fa
SHA512

23d746c2530af354355949123880c0ab75715cae6d36b880e13c00b49d0a23248c8feca27de641c6bcf191441f5a3d788f744f196c6a5dbe9da227561c59bbd0
SSDEEP

1536:S9NazHlqQyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOZ:S93QyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
368	msedge.exe
368	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
368	msedge.exe
368	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 5044	368	msedge.exe	81
PID 368 wrote to memory of 5044	368	msedge.exe	81
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 4212	368	msedge.exe	85
PID 368 wrote to memory of 1076	368	msedge.exe	86
PID 368 wrote to memory of 1076	368	msedge.exe	86
PID 368 wrote to memory of 1400	368	msedge.exe	87
PID 368 wrote to memory of 1400	368	msedge.exe	87
PID 368 wrote to memory of 1400	368	msedge.exe	87
PID 368 wrote to memory of 1400	368	msedge.exe	87
PID 368 wrote to memory of 1400	368	msedge.exe	87
PID 368 wrote to memory of 1400	368	msedge.exe	87
PID 368 wrote to memory of 1400	368	msedge.exe	87
PID 368 wrote to memory of 1400	368	msedge.exe	87
PID 368 wrote to memory of 1400	368	msedge.exe	87
PID 368 wrote to memory of 1400	368	msedge.exe	87
PID 368 wrote to memory of 1400	368	msedge.exe	87
PID 368 wrote to memory of 1400	368	msedge.exe	87
PID 368 wrote to memory of 1400	368	msedge.exe	87
PID 368 wrote to memory of 1400	368	msedge.exe	87
PID 368 wrote to memory of 1400	368	msedge.exe	87
PID 368 wrote to memory of 1400	368	msedge.exe	87
PID 368 wrote to memory of 1400	368	msedge.exe	87
PID 368 wrote to memory of 1400	368	msedge.exe	87
PID 368 wrote to memory of 1400	368	msedge.exe	87
PID 368 wrote to memory of 1400	368	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4c736bc72b6c22bf18033b7951dbbc4f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb44b146f8,0x7ffb44b14708,0x7ffb44b14718
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,15404557535653851821,1537724556341846627,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,15404557535653851821,1537724556341846627,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,15404557535653851821,1537724556341846627,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15404557535653851821,1537724556341846627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15404557535653851821,1537724556341846627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,15404557535653851821,1537724556341846627,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1344 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
043db27f03ca908466ffa341f3cbeaa6

SHA1
6b7f57b80d7339c19899a646e380b6ed37108e1e

SHA256
c40f2e4a8fdc60655271839c125aa5a2971e31fb37de020b9f51eab12bd2438c

SHA512
5e0ddcdcc49329a956988d65e822c2de4ad28b6737819dac5a55d6c8618b282b1a80370bcd51bdc257d311b560b5d6a26613565e5bda79f8767d2f9e7d66dc81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
00b22665051ecb6d972bc97f03ea8ace

SHA1
363bd14ad88b04321b3e7c2ec8da9fa13223b4bd

SHA256
8830fe9c0978b74e994ffc185aa6f9b749d77f7125893e2e265e8d0eb604d9f7

SHA512
355bf89c20c319c254a781e8e42423cca8d9c7941b5dffad4163a89431447d6ea172e78f19756a64783eb1a565001be510b304679e3d92b605c7c4efd466fbb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
68bfe8ab6023a857d30ca31616761f06

SHA1
5d28c133624df3768330fcac1e0e480d8e489aea

SHA256
5394c49b9f33b589bad9c096624c290d81c615342c764e69c4708adbacebe366

SHA512
494ae0be8eb1b77c690cf4292e9c55011c5da348e22314b22cbecd91b5a47de837b77ab5d8b778a3328a428a3a8319e923ed5afb675d1aecfb758d4a290cb0ce

Download Submit