4cacc32f000420a4b6006370b42ea5c4a3b160feeccf11b202f0fafd2b1a1b5c

Analysis

max time kernel
145s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 13:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d0e623bc84de4df94502a2ea0a16b8d_JaffaCakes118.html
Size

464KB
MD5

7d0e623bc84de4df94502a2ea0a16b8d
SHA1

cc3f43dc1289b4aea7462a3b8797aec71bed5bef
SHA256

4cacc32f000420a4b6006370b42ea5c4a3b160feeccf11b202f0fafd2b1a1b5c
SHA512

776193b79bb798dedb2940c1c8cdf8e81cf35d6945ade27813dd515f44227f2be3fe0e1c3a6c025c088570eeff0f55ab77081b2fcc31489e2acae68ac9dc3546
SSDEEP

6144:SJsMYod+X3oI+YlsMYod+X3oI+Y+sMYod+X3oI+YLsMYod+X3oI+YQ:u5d+X3z5d+X3q5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3196	msedge.exe
3196	msedge.exe
2216	identity_helper.exe
2216	identity_helper.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 3164	3196	msedge.exe	81
PID 3196 wrote to memory of 3164	3196	msedge.exe	81
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 880	3196	msedge.exe	82
PID 3196 wrote to memory of 3124	3196	msedge.exe	83
PID 3196 wrote to memory of 3124	3196	msedge.exe	83
PID 3196 wrote to memory of 1768	3196	msedge.exe	84
PID 3196 wrote to memory of 1768	3196	msedge.exe	84
PID 3196 wrote to memory of 1768	3196	msedge.exe	84
PID 3196 wrote to memory of 1768	3196	msedge.exe	84
PID 3196 wrote to memory of 1768	3196	msedge.exe	84
PID 3196 wrote to memory of 1768	3196	msedge.exe	84
PID 3196 wrote to memory of 1768	3196	msedge.exe	84
PID 3196 wrote to memory of 1768	3196	msedge.exe	84
PID 3196 wrote to memory of 1768	3196	msedge.exe	84
PID 3196 wrote to memory of 1768	3196	msedge.exe	84
PID 3196 wrote to memory of 1768	3196	msedge.exe	84
PID 3196 wrote to memory of 1768	3196	msedge.exe	84
PID 3196 wrote to memory of 1768	3196	msedge.exe	84
PID 3196 wrote to memory of 1768	3196	msedge.exe	84
PID 3196 wrote to memory of 1768	3196	msedge.exe	84
PID 3196 wrote to memory of 1768	3196	msedge.exe	84
PID 3196 wrote to memory of 1768	3196	msedge.exe	84
PID 3196 wrote to memory of 1768	3196	msedge.exe	84
PID 3196 wrote to memory of 1768	3196	msedge.exe	84
PID 3196 wrote to memory of 1768	3196	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7d0e623bc84de4df94502a2ea0a16b8d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9303d46f8,0x7ff9303d4708,0x7ff9303d4718
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,8210632097674733418,9024510835380486145,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,8210632097674733418,9024510835380486145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,8210632097674733418,9024510835380486145,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8210632097674733418,9024510835380486145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8210632097674733418,9024510835380486145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,8210632097674733418,9024510835380486145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4708 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,8210632097674733418,9024510835380486145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4708 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8210632097674733418,9024510835380486145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8210632097674733418,9024510835380486145,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8210632097674733418,9024510835380486145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8210632097674733418,9024510835380486145,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,8210632097674733418,9024510835380486145,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8356f6b5846946de3d8f1d62f4265ee7

SHA1
c0ea22a024d366b1d4cc74bea1b82e3510f3ae3b

SHA256
28b789f2db38eb40a033e00a413a32d745a3b7e0fdeb0dfb31befaaa756da08e

SHA512
a141f65929eda35cba18cde4a8804aeaa6e36b738cf682c967b119bd5e7d50f24519db49b7767ccc60614a04dad5ea665389289029bcc8d22b82db049dbb3e6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2d3649d3d95f497ab288283fc11621c9

SHA1
220afc4a2b3c73c82219b3613c7549a43547b70a

SHA256
3f47344d2a42733063ce16bd4ad390adc7a60735c5bce9f8d922d01978bce4b0

SHA512
ee301baa68d308004446fe03c487ae59982e006a4d05654f38161089f3e689ed30c1859de1b4ab43ca0edf388f3145d7db74ad9733acf10af67ad0e1cb6257fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
008e5476e4d436b67fb4a68d16ff7db9

SHA1
e4b3e486289587b5ee2e84b8b9667223cb492148

SHA256
22ff83de4b8df7fd6e20a0eb4479a2891f4c4d8e471cc2c30e83662a84db1d3f

SHA512
53a755dd05f71dbe3bacab67da4110d163a281bd605525b4deae5ded7a973bacbce78d603e657c75f5362bc50d4f1cdc37147868fb0890e43dec4248e164d415

Download Submit