1d163c1a0f7e8b1ac7c486a30def5af4bfa765cb9bb0e5ae34662e7d57d82b47

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 22:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

26887f05a0ef1d232b9c67a2cb133f6b_JaffaCakes118.html
Size

79KB
MD5

26887f05a0ef1d232b9c67a2cb133f6b
SHA1

867412bfc0b42bdce59d206e2ade009bbd401f80
SHA256

1d163c1a0f7e8b1ac7c486a30def5af4bfa765cb9bb0e5ae34662e7d57d82b47
SHA512

5530f74c2d2510e7b70394390f0214d1fc99982a89333e8b02b1e0d88602d7443ad0dc5e060352903246aa0de4969eaa8ab39649193f8bf53ffb04b6226ee285
SSDEEP

1536:bX57PYKBjmoNpTzQxHhM06AGFCjB4RGy+YaIKygPovLgRk+RWUq:tYKBjmoNpTcxHhM06AGFCjB4D+YaIKry

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
1964	msedge.exe
1964	msedge.exe
1152	identity_helper.exe
1152	identity_helper.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 232	1964	msedge.exe	80
PID 1964 wrote to memory of 232	1964	msedge.exe	80
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 2304	1964	msedge.exe	81
PID 1964 wrote to memory of 4348	1964	msedge.exe	82
PID 1964 wrote to memory of 4348	1964	msedge.exe	82
PID 1964 wrote to memory of 4356	1964	msedge.exe	83
PID 1964 wrote to memory of 4356	1964	msedge.exe	83
PID 1964 wrote to memory of 4356	1964	msedge.exe	83
PID 1964 wrote to memory of 4356	1964	msedge.exe	83
PID 1964 wrote to memory of 4356	1964	msedge.exe	83
PID 1964 wrote to memory of 4356	1964	msedge.exe	83
PID 1964 wrote to memory of 4356	1964	msedge.exe	83
PID 1964 wrote to memory of 4356	1964	msedge.exe	83
PID 1964 wrote to memory of 4356	1964	msedge.exe	83
PID 1964 wrote to memory of 4356	1964	msedge.exe	83
PID 1964 wrote to memory of 4356	1964	msedge.exe	83
PID 1964 wrote to memory of 4356	1964	msedge.exe	83
PID 1964 wrote to memory of 4356	1964	msedge.exe	83
PID 1964 wrote to memory of 4356	1964	msedge.exe	83
PID 1964 wrote to memory of 4356	1964	msedge.exe	83
PID 1964 wrote to memory of 4356	1964	msedge.exe	83
PID 1964 wrote to memory of 4356	1964	msedge.exe	83
PID 1964 wrote to memory of 4356	1964	msedge.exe	83
PID 1964 wrote to memory of 4356	1964	msedge.exe	83
PID 1964 wrote to memory of 4356	1964	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\26887f05a0ef1d232b9c67a2cb133f6b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xdc,0xe0,0xe4,0xd8,0x108,0x7ffa0f1e46f8,0x7ffa0f1e4708,0x7ffa0f1e4718
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,16029257519792723941,8186469570966646601,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,16029257519792723941,8186469570966646601,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,16029257519792723941,8186469570966646601,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16029257519792723941,8186469570966646601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16029257519792723941,8186469570966646601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16029257519792723941,8186469570966646601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16029257519792723941,8186469570966646601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,16029257519792723941,8186469570966646601,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,16029257519792723941,8186469570966646601,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16029257519792723941,8186469570966646601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16029257519792723941,8186469570966646601,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16029257519792723941,8186469570966646601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16029257519792723941,8186469570966646601,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,16029257519792723941,8186469570966646601,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
40b5602dc7ef2ac033510119977d97a7

SHA1
e9cd3b703ee5a63c12cb2152cc277beb7279d1e8

SHA256
9b45c9fb2d99f100485371a26b8433997af25a0936171feaadfffc7e36be5af4

SHA512
943d8c61e1239d388c988bce659ed9865aae9b871d40bc7ced0ab5d18e145b04542777bf11fea14aac492df4c24955459665aa06e2d869de595c9a0127cee456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0ab094bb1f9acbeb40a6f3d9f7dd593f

SHA1
367abd8c72d50678ae36f01542ffdcb75ffd0de2

SHA256
1f6784ba86283c3392f03abf7a70fa90ba67ee0d35da8b62cc72fa2d40dcdd9c

SHA512
269dee678378e8236753c3205b13c54946eb2db4833ee7288b41d789f55f4597009aacd0d33b8d7aafc61cfa249c75299522e227d0e2a770e3c3ae5c544a9636

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
c1230ad963b64e0e072d9866765a3dc7

SHA1
bc5ebffef81a90beedc3cbdfceca76a4175bf562

SHA256
0312773213ee7ec7b59304c13e3579ca9c345ec5535246a88afe149be6fc6aa2

SHA512
c0e5802a1d4d597234af44a6aa2ab3b209b99ea5fd658d4ac102efd568a1377355b88269855f5f59775113f3d2816dcda752192a62a5ccdc8d11ef871bf27196

Download Submit