d4ece4b2e2b083527ff77af3a45de907f79b26926b580b75f279e2a42d7e1071

Analysis

max time kernel
145s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 17:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0c70112eccd1c4693ba48af62630baa6_JaffaCakes118.html
Size 124KB
Sample240501-wcetfacd9y
SHA256 d4ece4b2e2b083527ff77af3a45de907f79b26926b580b75f279e2a42d7e1071
MD5 0c70112eccd1c4693ba48af62630baa6
SHA1 61cde94284fa81eeb7888e9100e394707e504359
SHA512 e6808152f1711fecf7301b055576f6258166ce53da1362785bd4adc670401d5fe21d19d009ed229001d5446113afc03b079cd4a5ae6638d618c91f217a6eb82b
SSDEEP 3072:iC5n3Kf0CXKzgcOUAFUyfkMY+BES09JXAnyrZalI+YQ:iC5n3Kf0CXKzgcOUAFZsMYod+X3oI+YQ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1284	msedge.exe
1284	msedge.exe
1956	msedge.exe
1956	msedge.exe
2420	identity_helper.exe
2420	identity_helper.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 3988	1956	msedge.exe	83
PID 1956 wrote to memory of 3988	1956	msedge.exe	83
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 5104	1956	msedge.exe	84
PID 1956 wrote to memory of 1284	1956	msedge.exe	85
PID 1956 wrote to memory of 1284	1956	msedge.exe	85
PID 1956 wrote to memory of 760	1956	msedge.exe	86
PID 1956 wrote to memory of 760	1956	msedge.exe	86
PID 1956 wrote to memory of 760	1956	msedge.exe	86
PID 1956 wrote to memory of 760	1956	msedge.exe	86
PID 1956 wrote to memory of 760	1956	msedge.exe	86
PID 1956 wrote to memory of 760	1956	msedge.exe	86
PID 1956 wrote to memory of 760	1956	msedge.exe	86
PID 1956 wrote to memory of 760	1956	msedge.exe	86
PID 1956 wrote to memory of 760	1956	msedge.exe	86
PID 1956 wrote to memory of 760	1956	msedge.exe	86
PID 1956 wrote to memory of 760	1956	msedge.exe	86
PID 1956 wrote to memory of 760	1956	msedge.exe	86
PID 1956 wrote to memory of 760	1956	msedge.exe	86
PID 1956 wrote to memory of 760	1956	msedge.exe	86
PID 1956 wrote to memory of 760	1956	msedge.exe	86
PID 1956 wrote to memory of 760	1956	msedge.exe	86
PID 1956 wrote to memory of 760	1956	msedge.exe	86
PID 1956 wrote to memory of 760	1956	msedge.exe	86
PID 1956 wrote to memory of 760	1956	msedge.exe	86
PID 1956 wrote to memory of 760	1956	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0c70112eccd1c4693ba48af62630baa6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xe0,0xe4,0xd8,0xdc,0x108,0x7ffe080f46f8,0x7ffe080f4708,0x7ffe080f4718
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,5732805766638400284,3202226320522199632,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,5732805766638400284,3202226320522199632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,5732805766638400284,3202226320522199632,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5732805766638400284,3202226320522199632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5732805766638400284,3202226320522199632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5732805766638400284,3202226320522199632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,5732805766638400284,3202226320522199632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,5732805766638400284,3202226320522199632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5732805766638400284,3202226320522199632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5732805766638400284,3202226320522199632,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5732805766638400284,3202226320522199632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5732805766638400284,3202226320522199632,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,5732805766638400284,3202226320522199632,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4964 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561
MD5 2a70f1bd4da893a67660d6432970788d
SHA1 ddf4047e0d468f56ea0c0d8ff078a86a0bb62873
SHA512 26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51
MD5 fbe1ce4d182aaffb80de94263be1dd35
SHA1 bc6c9827aa35a136a7d79be9e606ff359e2ac3ea
SHA512 3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 404e275f13b1dc34f128e5092d655d463f2354adc00dd703cb050c9419031491
MD5 808fd651154dd8642c2026c62c7f2baf
SHA1 ccd9f09ceb367205bc9e452bc87837e222f87a5f
SHA512 1e48f4a3b11661973711e3023ef329b61ff61a7cf1486df440da9da418cd4293bc3f890b6fc8f15ed18177835fd59f14711afa5cb42dbf254ee1854a2084df89
SSDEEP 96:nCk/xm/DQYmqB1bnJaJniK1wpvWMoiVmdeHdt76UWQyV+VDCziEwb:nCk0IGVnJawkGWMXbero
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 2d89aae7c6083232b58f358cee4324c59b3beba8de1e8d8970d282e0c872ac35
MD5 4ac97ca1567d8200a6ad92ff9454f047
SHA1 21b389c5aa058346bceb85b5c8dad1dd587c08d3
SHA512 36d003e4490ca82fe1f8fd085c3ba829c3c703dbe7335aab7a0c375c85bc4dbf3b93beeed4c9839ab64dc9d59156b98546186dc21e8b2f77b17c5947b96bd2de
SSDEEP 96:nCk/xm/DnmqB1bnJaJniK1wpvWMoiVmdeHdt76UWQyV+VDCAiEwb:nCk06GVnJawkGWMXberV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 17ba208cc782ff24f9bcaf0258ce9c77694eb2eef2cdd3115291ca6bb55d9828
MD5 4d7b513f49f75c9778fad0c49eda8cbc
SHA1 6dcfaefc89577e281cb9b96eef6a6544137e0f6b
SHA512 fcaaf647a5a46b18595fa1544cb9495b65e4b6df48b0b44651f09d9468441cfb27b8c82e45c40988d9cddfb500f618234ff0d8688bac1cfaf447a5d9de75a854
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup/sBcle2RUWOiP/+OblfBhH:A9iIxuERzA83h09RZxYrNP//XDafEBxf
MD5 SHA1 SHA512 SSDEEP

Submit Download