4256d7b611d4d9a8b224769dd5b15e6452859262d7c7b7921d732ed3872f49a5

Analysis

max time kernel
145s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 18:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c8ec0792008b74baea8405983076370_JaffaCakes118.html
Size

69KB
MD5

4c8ec0792008b74baea8405983076370
SHA1

ef9ab4ebf642afc27f9dacc7e1625dd10a1706d3
SHA256

4256d7b611d4d9a8b224769dd5b15e6452859262d7c7b7921d732ed3872f49a5
SHA512

e0294ad328e26b6eb158a0d9b31f71130cec2156cfa7ea4cf4ebc63f146a1a8eb5bf01934069242438d1a2fdfad463574c28b8519f2c78c1bb8d83ac7647d2e0
SSDEEP

768:Ji7gcMiR3sI2PDDnX0g6sL6dv4jx+bxPAzJoTyS1wCZkoTyMdtbBnfBgN8/lboii:J3QTzNen0tbrga94hcuNnQC

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
2112	msedge.exe
2112	msedge.exe
1864	identity_helper.exe
1864	identity_helper.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 432	2112	msedge.exe	84
PID 2112 wrote to memory of 432	2112	msedge.exe	84
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 2984	2112	msedge.exe	85
PID 2112 wrote to memory of 4900	2112	msedge.exe	86
PID 2112 wrote to memory of 4900	2112	msedge.exe	86
PID 2112 wrote to memory of 4232	2112	msedge.exe	87
PID 2112 wrote to memory of 4232	2112	msedge.exe	87
PID 2112 wrote to memory of 4232	2112	msedge.exe	87
PID 2112 wrote to memory of 4232	2112	msedge.exe	87
PID 2112 wrote to memory of 4232	2112	msedge.exe	87
PID 2112 wrote to memory of 4232	2112	msedge.exe	87
PID 2112 wrote to memory of 4232	2112	msedge.exe	87
PID 2112 wrote to memory of 4232	2112	msedge.exe	87
PID 2112 wrote to memory of 4232	2112	msedge.exe	87
PID 2112 wrote to memory of 4232	2112	msedge.exe	87
PID 2112 wrote to memory of 4232	2112	msedge.exe	87
PID 2112 wrote to memory of 4232	2112	msedge.exe	87
PID 2112 wrote to memory of 4232	2112	msedge.exe	87
PID 2112 wrote to memory of 4232	2112	msedge.exe	87
PID 2112 wrote to memory of 4232	2112	msedge.exe	87
PID 2112 wrote to memory of 4232	2112	msedge.exe	87
PID 2112 wrote to memory of 4232	2112	msedge.exe	87
PID 2112 wrote to memory of 4232	2112	msedge.exe	87
PID 2112 wrote to memory of 4232	2112	msedge.exe	87
PID 2112 wrote to memory of 4232	2112	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4c8ec0792008b74baea8405983076370_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1e4f46f8,0x7ffa1e4f4708,0x7ffa1e4f4718
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,16891782835172744600,1005017844751151724,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,16891782835172744600,1005017844751151724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,16891782835172744600,1005017844751151724,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16891782835172744600,1005017844751151724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16891782835172744600,1005017844751151724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,16891782835172744600,1005017844751151724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,16891782835172744600,1005017844751151724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16891782835172744600,1005017844751151724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16891782835172744600,1005017844751151724,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16891782835172744600,1005017844751151724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16891782835172744600,1005017844751151724,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,16891782835172744600,1005017844751151724,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f2ca5b56dff8f40e1e55085964f1858d

SHA1
bedc9c1724cab07f1109ffc4ce1fa65f01726ec1

SHA256
fb660c623371d3fabbfb06e0410ab411bcaf63038a7b0ba7aec75a76538f3b80

SHA512
78e41f4affc42f486044071dc1f98e54bd7cfa62f61e6a4003df6d31419f73c3af62db9122692b5a1ae3cf23e88f521c9c13b5ff5e6498a45e15cb53a4023122

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
af13745deb1f68daa9dcf4e9a49f7a3b

SHA1
4a9bad33ef39efe507d0f419a93013ca80f63bc0

SHA256
5e58019f54dc4f7f396127d42aa35c524af29eeb1e5f60c85e6d0d5a7f95b42b

SHA512
7c6fd741ff19cc164d4f5052f6446ae06ba62927dcf63079dfbdb82dc956bf5fad9546f08f0800106173f0e2aef9fca5119c28c7d6dfdc1b207f951f0ccc3c6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6f03c2b15ad57792c3c0590675fcf0e8

SHA1
467a9b974913821004f3154f8a8394965084e753

SHA256
80de66adb186a17264349880e357afcbc32887792701d0bd20705809e6f1b81d

SHA512
21de361080e2d47a4eb8e0d065fa1e746ef8ff2b5fad6c8cee0ca128c5e5a5900ecc8065755fadd69e3d5d99891b672f00be226856550736316289d3bea42ff8

Download Submit