411e9d7bed8ce80ce0030a146f098021d2901165c2cf4348ba423f61efde74b3

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 16:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8eb8e98e1f4cd8795f0c5b0e80ba7736_JaffaCakes118.html
Size

213KB
MD5

8eb8e98e1f4cd8795f0c5b0e80ba7736
SHA1

795aef7d3412d3eb847a40f55960de9a420a8bd9
SHA256

411e9d7bed8ce80ce0030a146f098021d2901165c2cf4348ba423f61efde74b3
SHA512

64d2beb9a7c477612a496f6ce3383d41b9c6ff5c423cf7319f2d58722b7711f154018f65ffbed2d4f1d013649263d3b25f7dc52bca91a8af0859c88dafa4d8fe
SSDEEP

3072:Sk0eTPcwLzrqaJyfkMY+BES09JXAnyrZalI+YQ:SkthXssMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1716	msedge.exe
1716	msedge.exe
2296	msedge.exe
2296	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 1060	2296	msedge.exe	83
PID 2296 wrote to memory of 1060	2296	msedge.exe	83
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 2376	2296	msedge.exe	84
PID 2296 wrote to memory of 1716	2296	msedge.exe	85
PID 2296 wrote to memory of 1716	2296	msedge.exe	85
PID 2296 wrote to memory of 1832	2296	msedge.exe	86
PID 2296 wrote to memory of 1832	2296	msedge.exe	86
PID 2296 wrote to memory of 1832	2296	msedge.exe	86
PID 2296 wrote to memory of 1832	2296	msedge.exe	86
PID 2296 wrote to memory of 1832	2296	msedge.exe	86
PID 2296 wrote to memory of 1832	2296	msedge.exe	86
PID 2296 wrote to memory of 1832	2296	msedge.exe	86
PID 2296 wrote to memory of 1832	2296	msedge.exe	86
PID 2296 wrote to memory of 1832	2296	msedge.exe	86
PID 2296 wrote to memory of 1832	2296	msedge.exe	86
PID 2296 wrote to memory of 1832	2296	msedge.exe	86
PID 2296 wrote to memory of 1832	2296	msedge.exe	86
PID 2296 wrote to memory of 1832	2296	msedge.exe	86
PID 2296 wrote to memory of 1832	2296	msedge.exe	86
PID 2296 wrote to memory of 1832	2296	msedge.exe	86
PID 2296 wrote to memory of 1832	2296	msedge.exe	86
PID 2296 wrote to memory of 1832	2296	msedge.exe	86
PID 2296 wrote to memory of 1832	2296	msedge.exe	86
PID 2296 wrote to memory of 1832	2296	msedge.exe	86
PID 2296 wrote to memory of 1832	2296	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8eb8e98e1f4cd8795f0c5b0e80ba7736_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa75c46f8,0x7fffa75c4708,0x7fffa75c4718
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,18035721096965294597,12963529697741318428,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,18035721096965294597,12963529697741318428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,18035721096965294597,12963529697741318428,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18035721096965294597,12963529697741318428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18035721096965294597,12963529697741318428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,18035721096965294597,12963529697741318428,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
27efa3d3c7902c418209a6d89feda982

SHA1
ea8668f66f8ec1cf54c04ebcef7928f6bb07e079

SHA256
c5c981382d588f78c16146e8bee25765b9e11364bf4ff5566b06a0b93234e877

SHA512
10b89d3c3ff6b0f944397050392c0e1f47af8eb9a47b5861367def7dbaec02d9204229e4ccec05a0c92557e5fc7ce8a44162e340cc8d61395251fcf9fdc84851

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9dd2fca66440ec42de594f1ec62f5f52

SHA1
d62dfbe09490a5ccb9cb5920c94bfb82710f3538

SHA256
b3fda5decc1e79602e76f76f16c81d3b04ffcd1adbb0c8ebf329276dc83b6908

SHA512
a9ba4dc4beb9b280d81b7a922c207221caf4f07291c706f0e4248f6dc5ef4255d57f85a443ad321cf2aa2b03e064f8a8f6851f5cf1b981b434e06f60098198cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d5fd1c6e3c740e4ebba5c969de12a676

SHA1
cf7efce22cc5706f56338c56870600a25cdaf5d5

SHA256
bf2040ca0f2507cfbec7510c4b013204fefd2f1e45df0a1a728a958662bb670b

SHA512
2202c9a2dd1248036f1563241eb9aae6bf23e0df9814c55b5ee283ba5303e63a342f9eac499617050ccdc8e6281a83766ed2fbd479824a622a2f4c96f51eec6f

Download Submit