4efdfafd345a3c496bbd42c09472365b4fe52912ad9d10ff529dfbdc9c817023

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 08:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8ca5bbbdbc04bece0e15f0dd2d8618a_JaffaCakes118.html
Size

22KB
MD5

a8ca5bbbdbc04bece0e15f0dd2d8618a
SHA1

39205ae728768153f40e5469eca47bcd5da82352
SHA256

4efdfafd345a3c496bbd42c09472365b4fe52912ad9d10ff529dfbdc9c817023
SHA512

a6e58e720c9c700666724911cda4862009a3cea63e59af7c8f738af44ada09d85f96db319099146a0cb56f9ada11d507ce6176b08e8a7bb92aac8cbd7b7f8ca0
SSDEEP

384:8XA+cbjvkYfGarbVtV6ZYlqq1zr3c+qq1z/Ptt453We5fECOoppv4//Zc1zDA5Kb:ScbjvkYfGarbHCqtiqxPW3WCfEir4/Ry

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
2304	msedge.exe
2304	msedge.exe
4428	identity_helper.exe
4428	identity_helper.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2032	2304	msedge.exe	84
PID 2304 wrote to memory of 2032	2304	msedge.exe	84
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 1464	2304	msedge.exe	85
PID 2304 wrote to memory of 3904	2304	msedge.exe	86
PID 2304 wrote to memory of 3904	2304	msedge.exe	86
PID 2304 wrote to memory of 3096	2304	msedge.exe	87
PID 2304 wrote to memory of 3096	2304	msedge.exe	87
PID 2304 wrote to memory of 3096	2304	msedge.exe	87
PID 2304 wrote to memory of 3096	2304	msedge.exe	87
PID 2304 wrote to memory of 3096	2304	msedge.exe	87
PID 2304 wrote to memory of 3096	2304	msedge.exe	87
PID 2304 wrote to memory of 3096	2304	msedge.exe	87
PID 2304 wrote to memory of 3096	2304	msedge.exe	87
PID 2304 wrote to memory of 3096	2304	msedge.exe	87
PID 2304 wrote to memory of 3096	2304	msedge.exe	87
PID 2304 wrote to memory of 3096	2304	msedge.exe	87
PID 2304 wrote to memory of 3096	2304	msedge.exe	87
PID 2304 wrote to memory of 3096	2304	msedge.exe	87
PID 2304 wrote to memory of 3096	2304	msedge.exe	87
PID 2304 wrote to memory of 3096	2304	msedge.exe	87
PID 2304 wrote to memory of 3096	2304	msedge.exe	87
PID 2304 wrote to memory of 3096	2304	msedge.exe	87
PID 2304 wrote to memory of 3096	2304	msedge.exe	87
PID 2304 wrote to memory of 3096	2304	msedge.exe	87
PID 2304 wrote to memory of 3096	2304	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a8ca5bbbdbc04bece0e15f0dd2d8618a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9db446f8,0x7ffa9db44708,0x7ffa9db44718
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,4421256873384958191,15869758989437844466,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,4421256873384958191,15869758989437844466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,4421256873384958191,15869758989437844466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4421256873384958191,15869758989437844466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4421256873384958191,15869758989437844466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4421256873384958191,15869758989437844466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1344 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,4421256873384958191,15869758989437844466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,4421256873384958191,15869758989437844466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4421256873384958191,15869758989437844466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1852 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4421256873384958191,15869758989437844466,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4421256873384958191,15869758989437844466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4421256873384958191,15869758989437844466,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,4421256873384958191,15869758989437844466,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4832 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6f2b44c0-d2e5-4f43-b253-71f57dfce89e.tmp

Filesize
11KB

MD5
f4fde657d335091f615eec78137a25c3

SHA1
e4644ec114be69705a566d17565ca6710cb2252c

SHA256
d08d4c7e3162129557357dc0ca38ca15a5587926237090fd29d6a1c44ad9f49c

SHA512
483f0009255676015030e96b39bab7cbb1b9093695e9baa114b85598231787c2b4ee5223cd4f48ab37eed5db11b219be6737f441865ab867326dc36206b23255

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
480B

MD5
95de2e8c39e69045d1165086e623d84a

SHA1
2c5320cc339104f51d81989755b4f7ca8505d638

SHA256
19e7c13fecc4659b64ddf8191b6d7d82a2fe7c2136d7ae91df7869a7270227e2

SHA512
36f7dc5fd98bedd49aafb9e877f12fac5bdddd46450541da662ca06f2df871d60646ffe80e3c7bf7bdc18eaf93c5a856c014ecff796f0a5ded8d2aef3b84f039

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
192d7d00e6cf2121b8c831ae4c3bb119

SHA1
ca98c0f7a8ee1a1aae8fd9eeb519959336a5685a

SHA256
ef2811bfa8e7850e1aface757b2421d066fdd655f051e4bbfac4bd0a13f265bf

SHA512
b4b572375dc125c4d4d817361fef406fb1021612a506e8546c94adf2b28f89319e7ecdf7c3194d02e8e4a125c06f227bf158b32a2a15e70571dd460e1f6ddd91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
301a757a4951967b5de6a37ef6436f30

SHA1
4c720e3e928f6ef50748f579941bd7ef4c8710bb

SHA256
34abacd19fbd9fe26ab990c41977f9b3d5db2536cf6414f81b7defbd41d951b2

SHA512
e653c2b554e4bbea41a9848b4fa337bc9bc7ed9ea50d2539452bde79d18cd898bf65286d89693d98ebe541cf648ce02f30d3027f2c335c0348b851812704dfde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dfbed1bb6e3e9da457b6ebb2b3e6ceaa

SHA1
fa332daff7f66019f332cab6e222196ee8e40f87

SHA256
7714d131e1a1803ab854c1f6be3a5d24c7bfa0e53401e9fe544cdbb5cd0278f6

SHA512
26f176a905e8b61a8fdc147fecc914546c115404f129d6d7f94c06380e0162ea4c19596ce119e90f00e623af15887a881a040cc9f30c90f01ecee7cb893b66ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit