d461c43952b3e905a5736a77f1967cb46c8f47c11dcb49d1d4bee45918e648a8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 19:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b860f49efb5d1385b0cc0fdef956a2e_JaffaCakes118.html
Size

139KB
MD5

8b860f49efb5d1385b0cc0fdef956a2e
SHA1

2f0ce5c76bfaa3e71de613673b382f312bfa4412
SHA256

d461c43952b3e905a5736a77f1967cb46c8f47c11dcb49d1d4bee45918e648a8
SHA512

b3dc43c648e7f58f8c6fc0d3f33c798870ef9f25c685705a07b66133735c9fb4ef4bd0f8cfb1ea329f0a2bb6fb3b88856f7907fa0b709c106f68ec65b6356a75
SSDEEP

1536:SO391pqe2leqyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:SO30ebqyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
4656	msedge.exe
4656	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 4524	4656	msedge.exe	83
PID 4656 wrote to memory of 4524	4656	msedge.exe	83
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 528	4656	msedge.exe	84
PID 4656 wrote to memory of 1696	4656	msedge.exe	85
PID 4656 wrote to memory of 1696	4656	msedge.exe	85
PID 4656 wrote to memory of 4840	4656	msedge.exe	86
PID 4656 wrote to memory of 4840	4656	msedge.exe	86
PID 4656 wrote to memory of 4840	4656	msedge.exe	86
PID 4656 wrote to memory of 4840	4656	msedge.exe	86
PID 4656 wrote to memory of 4840	4656	msedge.exe	86
PID 4656 wrote to memory of 4840	4656	msedge.exe	86
PID 4656 wrote to memory of 4840	4656	msedge.exe	86
PID 4656 wrote to memory of 4840	4656	msedge.exe	86
PID 4656 wrote to memory of 4840	4656	msedge.exe	86
PID 4656 wrote to memory of 4840	4656	msedge.exe	86
PID 4656 wrote to memory of 4840	4656	msedge.exe	86
PID 4656 wrote to memory of 4840	4656	msedge.exe	86
PID 4656 wrote to memory of 4840	4656	msedge.exe	86
PID 4656 wrote to memory of 4840	4656	msedge.exe	86
PID 4656 wrote to memory of 4840	4656	msedge.exe	86
PID 4656 wrote to memory of 4840	4656	msedge.exe	86
PID 4656 wrote to memory of 4840	4656	msedge.exe	86
PID 4656 wrote to memory of 4840	4656	msedge.exe	86
PID 4656 wrote to memory of 4840	4656	msedge.exe	86
PID 4656 wrote to memory of 4840	4656	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8b860f49efb5d1385b0cc0fdef956a2e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc65f46f8,0x7ffdc65f4708,0x7ffdc65f4718
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,12379681775632206979,4807576186059727113,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,12379681775632206979,4807576186059727113,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,12379681775632206979,4807576186059727113,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12379681775632206979,4807576186059727113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12379681775632206979,4807576186059727113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,12379681775632206979,4807576186059727113,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4696 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
470f72f897b1bbbabb74216e7f60fa65

SHA1
bf1d79d5e65024271bfb49b4d4373e0cdc30afd6

SHA256
4122cd047bf722d7161d047c10b60730eeae981090831feaa5a55f727e303669

SHA512
c31a831d719d87545632f9f029ec23c0c913a4ef75eab7fb48f6af149e44de87d7cfafd84ffca084d05b2848c7c18de63e583e6f53b7a23c91a55e41af3cfbc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6ba934dadcb5ff8f86158922044cf901

SHA1
29db0fb65044d82d4202a8df147428f67c4dc3c4

SHA256
0629557384c205edbd16f067c15069fadc78a771fc2b35781b1af98b0e56b0fa

SHA512
dd2f31abd6522af280cd1b974609a4e017cff40e96bb3c44775e9ff2a418d3a82e0f984458ae4d301dc0db4a1df8850f7646ec8d5d2666ec9510e97ef9ef31bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f94225dab20416a15f7bacb914a07c99

SHA1
6025fdf4b66d47dc8a4509efc63c935afbef3106

SHA256
61223a97d8a3281a63b1ce41cd6096b4a82bfcf49265e92120bc682d80fa56fc

SHA512
49ce83dea815a1d146083997504e60cebfa46ec2717cc096f5356b8bb7f7f1c0aa9de5a401805faf292e75341a78341ac53432fe60110c56e3386bc142e6a5eb

Download Submit