a5ce903b83d5ce27a9cf79a585e3655c6bd4642f3d1599fc4b7479dab19efbdb

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 00:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4db613a22bd54e8737b024f0ba6d57df_JaffaCakes118.html
Size

31KB
MD5

4db613a22bd54e8737b024f0ba6d57df
SHA1

12be1da5536d12b54dfcedcd8db1f16059a39725
SHA256

a5ce903b83d5ce27a9cf79a585e3655c6bd4642f3d1599fc4b7479dab19efbdb
SHA512

bc4466c5baa30c8f41c8c45f86133559ba46057ec4c0288d2810f03f913a7839a75681bca4d9f6c9507052e01eeb8838d7ca3465c1371c7dcd7a660a2b3efc7f
SSDEEP

384:ZLXQ64LZjRByrUB1ysbBjkP19TOLTB7MV2E+4B8roSXV1Bt5WONzW2IM4375KDqe:9Xt8ZAsbBIPbwB6BBSfBt5/Na2a3bY

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe
884	msedge.exe
884	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
884	msedge.exe
884	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 3500	884	msedge.exe	83
PID 884 wrote to memory of 3500	884	msedge.exe	83
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 2776	884	msedge.exe	84
PID 884 wrote to memory of 3316	884	msedge.exe	85
PID 884 wrote to memory of 3316	884	msedge.exe	85
PID 884 wrote to memory of 3476	884	msedge.exe	86
PID 884 wrote to memory of 3476	884	msedge.exe	86
PID 884 wrote to memory of 3476	884	msedge.exe	86
PID 884 wrote to memory of 3476	884	msedge.exe	86
PID 884 wrote to memory of 3476	884	msedge.exe	86
PID 884 wrote to memory of 3476	884	msedge.exe	86
PID 884 wrote to memory of 3476	884	msedge.exe	86
PID 884 wrote to memory of 3476	884	msedge.exe	86
PID 884 wrote to memory of 3476	884	msedge.exe	86
PID 884 wrote to memory of 3476	884	msedge.exe	86
PID 884 wrote to memory of 3476	884	msedge.exe	86
PID 884 wrote to memory of 3476	884	msedge.exe	86
PID 884 wrote to memory of 3476	884	msedge.exe	86
PID 884 wrote to memory of 3476	884	msedge.exe	86
PID 884 wrote to memory of 3476	884	msedge.exe	86
PID 884 wrote to memory of 3476	884	msedge.exe	86
PID 884 wrote to memory of 3476	884	msedge.exe	86
PID 884 wrote to memory of 3476	884	msedge.exe	86
PID 884 wrote to memory of 3476	884	msedge.exe	86
PID 884 wrote to memory of 3476	884	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4db613a22bd54e8737b024f0ba6d57df_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8c3c46f8,0x7fff8c3c4708,0x7fff8c3c4718
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,5735790130369985762,8598243473608033550,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,5735790130369985762,8598243473608033550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,5735790130369985762,8598243473608033550,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5735790130369985762,8598243473608033550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5735790130369985762,8598243473608033550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,5735790130369985762,8598243473608033550,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1268 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
182B

MD5
136a8627c9f4b9e2c7d3a90d2556f6d1

SHA1
a0950a4a78f7bf1a4d08fe5dc8040d25e5e7094b

SHA256
06d0224a7ed0c632fe0d506783ac4be33fdfa3c3b3b4a46dcfd4bbf0a1a08ea5

SHA512
2399bbaeaf845478196f713f1e78c222568650d1cddaac47ffd82d93ef2a60d1cc7e40bed100afff0101713e70373793d2608f90e75e471f849888c19c88af1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
93a8cc51971d18575c108350c254dd79

SHA1
7edf4919cec2c9899214a11e198d9fff4a037bba

SHA256
f5c498932d0c9f5d9601c6b3045271bdd3ff7a77f5af2ff70f127291577e2199

SHA512
52329665b4c8ce0710b75622bb5c02e4b37e9a8bb875f7bb67733bb7bf268e5fcb0d2f69f0394eddac65725e55c92728f4b075deef94a0135d43df4ab48499b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1e337379cc4bde9b4cca10818b49634a

SHA1
f43c5ef8edfba713275716f51f5749fb89f5284b

SHA256
467774140891e077101b6ee2eecb0d0ec5cc1f236e47a6641eea95b0e6ceb484

SHA512
c86626ed30fa49b67b3d0aca53d3e876f587875754fcb0ecd289fe463155e0e7ac3a228f033bc43594db1dc0f4c3d2d735d57a261371a16f693f4d91884a77ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8e11c8107173aa2e5d50372e6db4ad39

SHA1
fab0dba75ec235531c88b32397e6ade63eee8baa

SHA256
acce6ceb3400238f0f1dca4ad7698c749e3af42748fbc16a4be6f9ed875e23b4

SHA512
47e67f5092f995caa1b737a5f3daa26dabb323f6640fc9c3bcd5963ae87d6f9f286cd6b34372209c554258df43290a9bbd4bd383202c7b66df1e6af5341a7ed9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5a282d09623ba027bda8d1acab88da28

SHA1
c2ba8eb386d7d2f7d0fac8e48492075dcb26be09

SHA256
7166e35fe76dea4de6292040b2e934521c8e300e01b87ca06162c237a8969e66

SHA512
7db3e59a03b090008b62a9df69d6369e11d1da58fe46d73d3d9518319fcb3b6d0c9f066bb9a56cebcc1b41d5a2df3cc39509aed21f124ed82e8dc3193d2bc7ac

Download Submit