a536272f7f1de02550945db92e86c9a0dd83eb37afa2273b547f528c7e4c2837

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 07:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b75068404f8ec6e6f7007c90d900bb94_JaffaCakes118.html
Size

132KB
MD5

b75068404f8ec6e6f7007c90d900bb94
SHA1

6e4ad1b24e85bf7d3f3e11ca27165bf51dd0960b
SHA256

a536272f7f1de02550945db92e86c9a0dd83eb37afa2273b547f528c7e4c2837
SHA512

12ec51c3a2d4cb1307ee9c2116657ee3a2a1aa3aa74cfe9e7a87fe271f8291acdce14d5fec239b8d1d1f8eaa4bbb594f4dfc81f6d230897799afc73a0dcfa2e2
SSDEEP

1536:B9yTPaPj40ZFyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:BFPHnyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
944	msedge.exe
944	msedge.exe
2476	msedge.exe
2476	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 4876	2476	msedge.exe	82
PID 2476 wrote to memory of 4876	2476	msedge.exe	82
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 3540	2476	msedge.exe	83
PID 2476 wrote to memory of 944	2476	msedge.exe	84
PID 2476 wrote to memory of 944	2476	msedge.exe	84
PID 2476 wrote to memory of 4588	2476	msedge.exe	85
PID 2476 wrote to memory of 4588	2476	msedge.exe	85
PID 2476 wrote to memory of 4588	2476	msedge.exe	85
PID 2476 wrote to memory of 4588	2476	msedge.exe	85
PID 2476 wrote to memory of 4588	2476	msedge.exe	85
PID 2476 wrote to memory of 4588	2476	msedge.exe	85
PID 2476 wrote to memory of 4588	2476	msedge.exe	85
PID 2476 wrote to memory of 4588	2476	msedge.exe	85
PID 2476 wrote to memory of 4588	2476	msedge.exe	85
PID 2476 wrote to memory of 4588	2476	msedge.exe	85
PID 2476 wrote to memory of 4588	2476	msedge.exe	85
PID 2476 wrote to memory of 4588	2476	msedge.exe	85
PID 2476 wrote to memory of 4588	2476	msedge.exe	85
PID 2476 wrote to memory of 4588	2476	msedge.exe	85
PID 2476 wrote to memory of 4588	2476	msedge.exe	85
PID 2476 wrote to memory of 4588	2476	msedge.exe	85
PID 2476 wrote to memory of 4588	2476	msedge.exe	85
PID 2476 wrote to memory of 4588	2476	msedge.exe	85
PID 2476 wrote to memory of 4588	2476	msedge.exe	85
PID 2476 wrote to memory of 4588	2476	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b75068404f8ec6e6f7007c90d900bb94_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3c9046f8,0x7fff3c904708,0x7fff3c904718
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,14363902317660961587,11350783391085165446,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,14363902317660961587,11350783391085165446,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,14363902317660961587,11350783391085165446,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14363902317660961587,11350783391085165446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14363902317660961587,11350783391085165446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,14363902317660961587,11350783391085165446,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c5abc082d9d9307e797b7e89a2f755f4

SHA1
54c442690a8727f1d3453b6452198d3ec4ec13df

SHA256
a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716

SHA512
ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4a74bc775caf3de7fc9cde3c30ce482

SHA1
c6ed3161390e5493f71182a6cb98d51c9063775d

SHA256
dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280

SHA512
55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e647e37b9147c8d46f5c45b103248ece

SHA1
cd10459ab6a3a794a0f9e2007827e624e5f701ce

SHA256
7ea9de4f08a1863d5bb7a820d32769dd35f5b34400cb24b56b05d4f203047d43

SHA512
5beac9f5b07700ff97974ae0eab796edcec009b1a690619f4b5a2c94857a25e464f6c85ea5f7bad273e6dc0dc9ddbb269e738b404f43ecace06822b82f1ce877

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5fc2fe9d39ce8cfc53a3e28e57555e61

SHA1
06847c1564cc76d4354d3693d4ffead4b11a5dde

SHA256
ea985d1322cff5b3baea54389bf3aba00f3a7b79e4e6d77fe11c23c0542b87b2

SHA512
9eafaf0beaa0510c2ad76651c14b17c53b3056403d067a540b5f00b75105fa99e4ae02d5b804557352198c028555cc5c5f5fadb0e4e805903c2747b6512af308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3292dda85f0bd70ca61a03ed23b35bb2

SHA1
c0a8964ba29384990dfc252b2ce48c42a209b676

SHA256
4d21f30b9cf56463e39ac615e6ba028a20f1f1b903e60dd96c541a5ed8fd2b85

SHA512
b144f7be9b1b559928a9357f0ee6cd1d58b66363ad090674dc124efd2ccf8c73dfcf6537ec8cd8ca1b589b256b71dbdacc0044aa25082ca2a268776e7d664e5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0a87078e1bb5e1db4128f0394822d60a

SHA1
16e5d614162463a93f4f758ecf26fddcc53802af

SHA256
cc074098000b0c7d45f50ae49655832a1b2382853a9f1e3b002a1ede995680e8

SHA512
6fd255cd4c24679abe59b1d52e8c8c72cb35c1150a242f753f8eb603bfdc1720788d52cef3de2ef5b7c7748f8b9d2e8d2a01723fc0d0c763798d4e8dc51a6922

Download Submit