1f65555bddf63ad1c3f6f30b7f6c88ad98ebc89c5131be2457bdee2b9d721031

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ff1700a67b228cfcbf10b68059ef7c6_JaffaCakes118.html
Size

17KB
MD5

4ff1700a67b228cfcbf10b68059ef7c6
SHA1

4c6da39595937d1d35c27030ade6cfe66035fac0
SHA256

1f65555bddf63ad1c3f6f30b7f6c88ad98ebc89c5131be2457bdee2b9d721031
SHA512

81824dd20ccdec80112538856614cc3664d412e66dac968130f637f61c9b1e3219f4a1b0c98e4a280b2f71bc579c4e72905285f0379a18d320179f8bea2e6391
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIC4YzUnjBhE+82qDB8:SIMd0I5nvH3svEtxDB8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3648	msedge.exe
3648	msedge.exe
320	msedge.exe
320	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
320	msedge.exe
320	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe
320	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 320 wrote to memory of 2236	320	msedge.exe	83
PID 320 wrote to memory of 2236	320	msedge.exe	83
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3480	320	msedge.exe	84
PID 320 wrote to memory of 3648	320	msedge.exe	85
PID 320 wrote to memory of 3648	320	msedge.exe	85
PID 320 wrote to memory of 4860	320	msedge.exe	86
PID 320 wrote to memory of 4860	320	msedge.exe	86
PID 320 wrote to memory of 4860	320	msedge.exe	86
PID 320 wrote to memory of 4860	320	msedge.exe	86
PID 320 wrote to memory of 4860	320	msedge.exe	86
PID 320 wrote to memory of 4860	320	msedge.exe	86
PID 320 wrote to memory of 4860	320	msedge.exe	86
PID 320 wrote to memory of 4860	320	msedge.exe	86
PID 320 wrote to memory of 4860	320	msedge.exe	86
PID 320 wrote to memory of 4860	320	msedge.exe	86
PID 320 wrote to memory of 4860	320	msedge.exe	86
PID 320 wrote to memory of 4860	320	msedge.exe	86
PID 320 wrote to memory of 4860	320	msedge.exe	86
PID 320 wrote to memory of 4860	320	msedge.exe	86
PID 320 wrote to memory of 4860	320	msedge.exe	86
PID 320 wrote to memory of 4860	320	msedge.exe	86
PID 320 wrote to memory of 4860	320	msedge.exe	86
PID 320 wrote to memory of 4860	320	msedge.exe	86
PID 320 wrote to memory of 4860	320	msedge.exe	86
PID 320 wrote to memory of 4860	320	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4ff1700a67b228cfcbf10b68059ef7c6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed44d46f8,0x7ffed44d4708,0x7ffed44d4718
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,15114496964897694582,49113763201706798,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,15114496964897694582,49113763201706798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,15114496964897694582,49113763201706798,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15114496964897694582,49113763201706798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15114496964897694582,49113763201706798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,15114496964897694582,49113763201706798,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0657f1e7be941df0363510f24f728270

SHA1
83f4f479cd42b50b59f0b56044be7bb54f735752

SHA256
05da53982c121459d2ee053111e3be1274eeab7b30bc3a62d13c3f775e599e48

SHA512
1b7a642f4649a1514a8332d25a6b3c5ca127e949e6e4a76a98969af10c6f2f5587072807fc2c20b87d35a70020cd4647eaa98a506ad0bbe05e0dfe220edc5874

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a9dbc6205a1cb926d71c5e1debe4f023

SHA1
c78d5c6274240255e55cffe63f85e470ff6c8f30

SHA256
4677cf7e1c0fc5d60bc9745a26488821b0b227da0eb6c14f249e5f5e0de20f2b

SHA512
590668d25b0ec7174c49873e29cc6054460264e7145d06c6e7ab4fd1c21477e8e70d09afb297683aa3cb8f9a03aaaac2d92cbd32cbdd16fb503486c9f8ef1ef1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4d668e0674cf723ad2cfad86c0b91f0c

SHA1
a322b8da7579d86e0b27dc5b010fc9fb6c1a7f39

SHA256
27b8e24417081f72826006ccd7bc882f6f9591550d2ae3f008feeb8e7a33e350

SHA512
ed14e3dcb62bcca56d130e4ce62347b4c72f71b9720b4d3d24d390aadde89d932c01a4239e364888ce29a0b140cdcf571216fe6efbe03d5fcdb100e70eb22d91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
725a55292e6eedf34261ba186d18eb2b

SHA1
97fc5dae86616f7beff0d174516bc101a64aaf67

SHA256
25b72a0e4909a00b5e2e6b7421058cb29d3452631ed46acd457ed04e35e1cc3b

SHA512
7230aac214638a0fcf518ebe6c66d95430bcf226712ebfdc004ca5035199a3eb43333a6d021e60f5544726eb29ad880eb73a9955d23f102968f11b98f2a788c3

Download Submit