25b76b7e4c98105c9f7d0e88d690e12ca8748318d81f9437f3689109ad5cc325

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 20:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0cccfc668be40386a870883c80006dbc_JaffaCakes118.html
Size 38KB
Sample240501-zh79qaad97
SHA256 25b76b7e4c98105c9f7d0e88d690e12ca8748318d81f9437f3689109ad5cc325
MD5 0cccfc668be40386a870883c80006dbc
SHA1 d5c0a6a054fac13090e6bede224405b27099f95b
SHA512 1e58d521275569ada6cfb9232652cb719e61216b39510f8f9e8bca3fbe5e902a824e563c950a1655dbf5421a8b760882c1946926f2f48ac520e1d07932da9d27
SSDEEP 384:CFJB+Hri8FLx8ocstx8kFCMfUVBvFjgXZyZmsAAque87quYqu/QK7quAwQ37quv6:CFj+HeQVdg8amfAV7+n7qwg7h7N7pe
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
1852	msedge.exe
1852	msedge.exe
1216	identity_helper.exe
1216	identity_helper.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 1448	1852	msedge.exe	84
PID 1852 wrote to memory of 1448	1852	msedge.exe	84
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 2648	1852	msedge.exe	85
PID 1852 wrote to memory of 4592	1852	msedge.exe	86
PID 1852 wrote to memory of 4592	1852	msedge.exe	86
PID 1852 wrote to memory of 1200	1852	msedge.exe	87
PID 1852 wrote to memory of 1200	1852	msedge.exe	87
PID 1852 wrote to memory of 1200	1852	msedge.exe	87
PID 1852 wrote to memory of 1200	1852	msedge.exe	87
PID 1852 wrote to memory of 1200	1852	msedge.exe	87
PID 1852 wrote to memory of 1200	1852	msedge.exe	87
PID 1852 wrote to memory of 1200	1852	msedge.exe	87
PID 1852 wrote to memory of 1200	1852	msedge.exe	87
PID 1852 wrote to memory of 1200	1852	msedge.exe	87
PID 1852 wrote to memory of 1200	1852	msedge.exe	87
PID 1852 wrote to memory of 1200	1852	msedge.exe	87
PID 1852 wrote to memory of 1200	1852	msedge.exe	87
PID 1852 wrote to memory of 1200	1852	msedge.exe	87
PID 1852 wrote to memory of 1200	1852	msedge.exe	87
PID 1852 wrote to memory of 1200	1852	msedge.exe	87
PID 1852 wrote to memory of 1200	1852	msedge.exe	87
PID 1852 wrote to memory of 1200	1852	msedge.exe	87
PID 1852 wrote to memory of 1200	1852	msedge.exe	87
PID 1852 wrote to memory of 1200	1852	msedge.exe	87
PID 1852 wrote to memory of 1200	1852	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0cccfc668be40386a870883c80006dbc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffecda146f8,0x7ffecda14708,0x7ffecda14718
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,13271269433371927432,15045800266689409615,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,13271269433371927432,15045800266689409615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,13271269433371927432,15045800266689409615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13271269433371927432,15045800266689409615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13271269433371927432,15045800266689409615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,13271269433371927432,15045800266689409615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,13271269433371927432,15045800266689409615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13271269433371927432,15045800266689409615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13271269433371927432,15045800266689409615,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13271269433371927432,15045800266689409615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13271269433371927432,15045800266689409615,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,13271269433371927432,15045800266689409615,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4820 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d
MD5 4e96ed67859d0bafd47d805a71041f49
SHA1 7806c54ae29a6c8d01dcbc78e5525ddde321b16b
SHA512 432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c
MD5 1cbd0e9a14155b7f5d4f542d09a83153
SHA1 27a442a921921d69743a8e4b76ff0b66016c4b76
SHA512 17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 203B
SHA256 aef3ac61b005edc44fdf0e7c664427ed0f111adc79e78d3d1aebc567b57c6b9c
MD5 7f682555b9a717fbdfa40e3e6a705279
SHA1 bf3ecf42fd4ecaab2a2651b44404f99c9d636a9f
SHA512 789156d84687970b385dde02666d53ce4e15f3918edeb6b01ec84869c2c993aa640e99bbc6881ba85500f29ea26582ad0e72f5f5e63087b92caaf3fb8fa68c0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4379b9fd180d2ac5f1c87593e579ae89487a4c8cb3d7e04200ee4caf0ba0d256
MD5 ab08dbe9529e4d77f5ad71d2f6fe2b6e
SHA1 b12fe8fb60d9072a4115f34d11d05f05a6c7c949
SHA512 1c51b6554c7bc97c32915c9117cb4d4dbbf1128157b3fdbdb4bb7ba5a02a7c5000d3e4a59bf710181936125fb4b8d9fc701912273ee52d35ed9edf3b13735584
SSDEEP 96:nBkfxm/DQYmq61tXUqzuawpvWMoiVmdeHhaAUWQyV+VDCziEwb:nBkUIdzXUbaGWMXhro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 bca77dcc22d0904ab9c96570ced804046d08ec8925929d442f4e9c6973a427e0
MD5 3090ae7a0331e30d2118fd3af47791b4
SHA1 fb4babcaae05f7be067c3d509c2cf8e36407f8af
SHA512 7a933e6ddc1b281d3807d7d966a618802c1d6c26fd2b63fde5da28b7b23fffb8d28bb7f8aa04cf2f1d09c27e5ea26a28326d20c9a1abc256442b52adf4e6b046
SSDEEP 96:nBkfxm/Dumq61tXUyzuawpvWMoiVmdeHhaAUWQyV+VD7AiEwb:nBkURdzXUTaGWMXhrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 0fd9465e3110d1d5e3fe0d28d7cfd66f2c3a0db7eeb6f84456ddecbb208ef0ac
MD5 f760385a06db805dee976b17e1beb0e2
SHA1 6923d649556a96e08cc1ed488f95e7f3c102aa5c
SHA512 06f749fcf1888fe753abeff8a9d9309aff2772cb280c7d5baf7fa74123a322b842fc3e75078a225aeda8176d0de18bbf6bf1ea0c9166d36d4698f772fe6fd200
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupVhP0Ke2RUr/9qMO+OblfBn:A9iIxuERzA83h09RZxYTcEyDO/XDafEt
MD5 SHA1 SHA512 SSDEEP

Submit Download