c1ebe1093d337fbf5700f0d1a1aa3e26156d5a628a75532585493bc3cb87309b

Analysis

max time kernel
145s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b14af33d0b8149cfe6729d1697dfd2e_JaffaCakes118.html
Size

107KB
MD5

1b14af33d0b8149cfe6729d1697dfd2e
SHA1

efb054b7375ad9bf7a35cf69b660a736bbe20d69
SHA256

c1ebe1093d337fbf5700f0d1a1aa3e26156d5a628a75532585493bc3cb87309b
SHA512

6382eb327c77314cc0c5cc6f13f1992ad077ff8397157e69a110f6eaf2436221e070327588204d236a605b192676e0bbe8b3bd69c4ae283ad1df1ca56dbbe2e7
SSDEEP

768:tlGrXLwoH9qsgVuU3wGzQa0njmxZx5piL:tlGrXLwoH9qsgVuU3wGzQa0njIpI

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
2004	msedge.exe
2004	msedge.exe
2144	identity_helper.exe
2144	identity_helper.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 4308	2004	msedge.exe	81
PID 2004 wrote to memory of 4308	2004	msedge.exe	81
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 4644	2004	msedge.exe	82
PID 2004 wrote to memory of 5100	2004	msedge.exe	83
PID 2004 wrote to memory of 5100	2004	msedge.exe	83
PID 2004 wrote to memory of 2216	2004	msedge.exe	84
PID 2004 wrote to memory of 2216	2004	msedge.exe	84
PID 2004 wrote to memory of 2216	2004	msedge.exe	84
PID 2004 wrote to memory of 2216	2004	msedge.exe	84
PID 2004 wrote to memory of 2216	2004	msedge.exe	84
PID 2004 wrote to memory of 2216	2004	msedge.exe	84
PID 2004 wrote to memory of 2216	2004	msedge.exe	84
PID 2004 wrote to memory of 2216	2004	msedge.exe	84
PID 2004 wrote to memory of 2216	2004	msedge.exe	84
PID 2004 wrote to memory of 2216	2004	msedge.exe	84
PID 2004 wrote to memory of 2216	2004	msedge.exe	84
PID 2004 wrote to memory of 2216	2004	msedge.exe	84
PID 2004 wrote to memory of 2216	2004	msedge.exe	84
PID 2004 wrote to memory of 2216	2004	msedge.exe	84
PID 2004 wrote to memory of 2216	2004	msedge.exe	84
PID 2004 wrote to memory of 2216	2004	msedge.exe	84
PID 2004 wrote to memory of 2216	2004	msedge.exe	84
PID 2004 wrote to memory of 2216	2004	msedge.exe	84
PID 2004 wrote to memory of 2216	2004	msedge.exe	84
PID 2004 wrote to memory of 2216	2004	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1b14af33d0b8149cfe6729d1697dfd2e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3ad546f8,0x7ffa3ad54708,0x7ffa3ad54718
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9920448433743307845,8137767639633318042,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,9920448433743307845,8137767639633318042,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,9920448433743307845,8137767639633318042,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9920448433743307845,8137767639633318042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9920448433743307845,8137767639633318042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9920448433743307845,8137767639633318042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,9920448433743307845,8137767639633318042,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,9920448433743307845,8137767639633318042,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9920448433743307845,8137767639633318042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9920448433743307845,8137767639633318042,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9920448433743307845,8137767639633318042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9920448433743307845,8137767639633318042,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9920448433743307845,8137767639633318042,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4564 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
539bd9db6bd6eafa1f0124326df946e0

SHA1
b7f0acd0e1c0fe2531c81e32627431bcdebe69d6

SHA256
b6bba2ae509a84f07f06a9b526345690a0b712c5e93ca99d6892e86b46163814

SHA512
3e438ca652a50778968f3382da1413cf75438e1173b9b274f9d92edb711bde365a736f7641016f5f19e25cab757dd7fba88fba796dd5d37c17f0706fd85f8086

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ecb1c4fbeefbc68b2b961ad40dbf5a3f

SHA1
dee2c0cbc28605199a8722e01a90ada59a8688d5

SHA256
b399d790f3c5320be4541a3db7d785cf0aeb3b9fd6ee18d167e7fe0b63701202

SHA512
2e9123477de24db808c316ae6950d046de4d37a06891e894e93ec7d268a3956aef9d2417f687c596da472196c24ea7819cf09bca4aee2e7d22d2ff64a8193e8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
89e65944b01f8408f361ec3151df7948

SHA1
fc081dbb6141621022c58332b6a2fa2780e76639

SHA256
ad8bf15060a986373cc5c84dc10f01d77683cb87504508ca04cf5c7349c5b965

SHA512
e43315a10555216f237a540fc169ddf5615c66cfb903dff5730a904e45d50fab9ea686761b2eac3b1eaf7cf1ecf8633a604446785a7534659bef77c7da2258cd

Download Submit