c34ba59a95acb6762e0bcb93c47e53c517278b3c16c5abbc723fc1612fc1c06f

Analysis

max time kernel
145s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5f1f3e9f04dc4ca90d0db7b51be708ef_JaffaCakes118.html
Size

91KB
MD5

5f1f3e9f04dc4ca90d0db7b51be708ef
SHA1

2b0358cc65a41315545cc8a60d5bae1d6b446223
SHA256

c34ba59a95acb6762e0bcb93c47e53c517278b3c16c5abbc723fc1612fc1c06f
SHA512

b054278a0141fda7f8881a0a1c25f3f19b881fd1494ad9ade74d3f8f4db60689cd948ae0d96d1e40df4ecc814f9475c19e465e2695781a80e5cc043af44a8046
SSDEEP

1536:pbMjw2fMk1D3O9Pj2fcAcuHAHi6LCis0cZlUMCMp:s5G9L7c

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2800	msedge.exe
2800	msedge.exe
1492	msedge.exe
1492	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1708	1492	msedge.exe	84
PID 1492 wrote to memory of 1708	1492	msedge.exe	84
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 4800	1492	msedge.exe	85
PID 1492 wrote to memory of 2800	1492	msedge.exe	86
PID 1492 wrote to memory of 2800	1492	msedge.exe	86
PID 1492 wrote to memory of 3456	1492	msedge.exe	87
PID 1492 wrote to memory of 3456	1492	msedge.exe	87
PID 1492 wrote to memory of 3456	1492	msedge.exe	87
PID 1492 wrote to memory of 3456	1492	msedge.exe	87
PID 1492 wrote to memory of 3456	1492	msedge.exe	87
PID 1492 wrote to memory of 3456	1492	msedge.exe	87
PID 1492 wrote to memory of 3456	1492	msedge.exe	87
PID 1492 wrote to memory of 3456	1492	msedge.exe	87
PID 1492 wrote to memory of 3456	1492	msedge.exe	87
PID 1492 wrote to memory of 3456	1492	msedge.exe	87
PID 1492 wrote to memory of 3456	1492	msedge.exe	87
PID 1492 wrote to memory of 3456	1492	msedge.exe	87
PID 1492 wrote to memory of 3456	1492	msedge.exe	87
PID 1492 wrote to memory of 3456	1492	msedge.exe	87
PID 1492 wrote to memory of 3456	1492	msedge.exe	87
PID 1492 wrote to memory of 3456	1492	msedge.exe	87
PID 1492 wrote to memory of 3456	1492	msedge.exe	87
PID 1492 wrote to memory of 3456	1492	msedge.exe	87
PID 1492 wrote to memory of 3456	1492	msedge.exe	87
PID 1492 wrote to memory of 3456	1492	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5f1f3e9f04dc4ca90d0db7b51be708ef_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb094046f8,0x7ffb09404708,0x7ffb09404718
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,6921726790692811865,4857578897056801394,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,6921726790692811865,4857578897056801394,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,6921726790692811865,4857578897056801394,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6921726790692811865,4857578897056801394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6921726790692811865,4857578897056801394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,6921726790692811865,4857578897056801394,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4892 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
930157978a1479d68bbf7ba8f1853b40

SHA1
124f454e66f4a24a8ca63c270f1fc319faaf5c99

SHA256
d4a680363480e1be9af342ede78cf015ee080316f87a8682fdb6bf96e19865cb

SHA512
d4a9b22a7ec604e11846652df4b3c61fdff2d57652cc871755ab405446510ebaef1c7cb8fce85e7a77f91fca2d4b4b4f8ed8d272a5811c3959451af2fceae233

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6a14b2ea34737b0ee52e00bd38714c5c

SHA1
a26ef3f9c78e57f03b4b166bf3a75cab003236b9

SHA256
54b24211e1a6e2b820cca7ed3a5a87ab02721688b53736d7dd96deaa83107161

SHA512
40dd3b0789e2adf6e4faf86941048175f158a7999cb41f7b564e2f47ef3bc1ce95e6e41f380638e8ed2b10d756fc43461913174f29d6ea58ef1518ced356bdec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e94a4d7f6bd6d22fa6ce2e294de621d2

SHA1
4af1bcbaffca92d4672177113678da872354ad92

SHA256
0829742c012bfdc479bb3160d2322f25c48cc162339b7638a5ec35a0680dea3d

SHA512
7798945517b5451988f7ff9f7aa835f85d4f3843369b699a39f04fde564909e24639261e3844b4e580fd113ed43b0d1e9254be74b0b6a52b1290a7e1d6f6bdb9

Download Submit