f199953ea450935715b327a412d50390efa857b88b5bb44aa9f7c4cd2d44ea40

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 11:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
67081ada19bcef23b208f39c6b5f7313_JaffaCakes118.html
Size 89KB
Sample240522-m4ehbacd94
SHA256 f199953ea450935715b327a412d50390efa857b88b5bb44aa9f7c4cd2d44ea40
MD5 67081ada19bcef23b208f39c6b5f7313
SHA1 ccc76218c0fbb44e6b1c78cac9fa1661340eca02
SHA512 4bc7871ee7358f1a38ac45dd3a38bbc1bd1b540ba1f799e415c7d9755e50ca0eb75f0cfd9b8b84f612116ea8165bffe3a3d1ed7787cba4405d55741e79337af6
SSDEEP 1536:+E/tgXqM88b3D1es4jqznSkiIvF83yhIi52d4sXF4O/VpLzErt:01es4jiSkPvXEL1RNNzErt
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe
2856	msedge.exe
2856	msedge.exe
636	identity_helper.exe
636	identity_helper.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2112	2856	msedge.exe	83
PID 2856 wrote to memory of 2112	2856	msedge.exe	83
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 60	2856	msedge.exe	84
PID 2856 wrote to memory of 3308	2856	msedge.exe	85
PID 2856 wrote to memory of 3308	2856	msedge.exe	85
PID 2856 wrote to memory of 1744	2856	msedge.exe	86
PID 2856 wrote to memory of 1744	2856	msedge.exe	86
PID 2856 wrote to memory of 1744	2856	msedge.exe	86
PID 2856 wrote to memory of 1744	2856	msedge.exe	86
PID 2856 wrote to memory of 1744	2856	msedge.exe	86
PID 2856 wrote to memory of 1744	2856	msedge.exe	86
PID 2856 wrote to memory of 1744	2856	msedge.exe	86
PID 2856 wrote to memory of 1744	2856	msedge.exe	86
PID 2856 wrote to memory of 1744	2856	msedge.exe	86
PID 2856 wrote to memory of 1744	2856	msedge.exe	86
PID 2856 wrote to memory of 1744	2856	msedge.exe	86
PID 2856 wrote to memory of 1744	2856	msedge.exe	86
PID 2856 wrote to memory of 1744	2856	msedge.exe	86
PID 2856 wrote to memory of 1744	2856	msedge.exe	86
PID 2856 wrote to memory of 1744	2856	msedge.exe	86
PID 2856 wrote to memory of 1744	2856	msedge.exe	86
PID 2856 wrote to memory of 1744	2856	msedge.exe	86
PID 2856 wrote to memory of 1744	2856	msedge.exe	86
PID 2856 wrote to memory of 1744	2856	msedge.exe	86
PID 2856 wrote to memory of 1744	2856	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\67081ada19bcef23b208f39c6b5f7313_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe344246f8,0x7ffe34424708,0x7ffe34424718
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,5625244902735310644,8588511225702576163,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,5625244902735310644,8588511225702576163,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,5625244902735310644,8588511225702576163,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1844 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5625244902735310644,8588511225702576163,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5625244902735310644,8588511225702576163,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,5625244902735310644,8588511225702576163,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,5625244902735310644,8588511225702576163,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5625244902735310644,8588511225702576163,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5625244902735310644,8588511225702576163,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5625244902735310644,8588511225702576163,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5625244902735310644,8588511225702576163,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,5625244902735310644,8588511225702576163,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1352 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
MD5 537815e7cc5c694912ac0308147852e4
SHA1 2ccdd9d9dc637db5462fe8119c0df261146c363c
SHA512 63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
MD5 8b167567021ccb1a9fdf073fa9112ef0
SHA1 3baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA512 726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 768B
SHA256 b8116f49b8b9a3e61957150b3d2f1e023b022e401e80a5e88db6af3f3ecf1ca9
MD5 19fac878e90fc7c280a28f542bcbdcb6
SHA1 c8768ba9d8af5f3ea1ae04f828b5dbcffeb21409
SHA512 221ffa799b29a7ef5649e5c57a80430005a6c9805c703c27f235806b671075e4016b37e35b24b00804da9207e0e64db64e335b807f179cff096ce61094fcb0ca
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 87b1be4f88c5d736907c01bd6e6ea6c6854b292db0fc4e5122ac26002cf59092
MD5 a8bccae443165d28eeae8868f3f80c04
SHA1 d646a1b874b449382c51d5a966b4e7c9199cf33f
SHA512 b4673d821dc4de066b1c71521323967b5764886e4f23a71ccf5ac7f55afdd674a8ca3fb39ada436c69c3d569c9859512e27be31f571f8e490c8c3c41d7b20d60
SSDEEP 96:nTkgKw1HD9wpvWMoiVmdeHpRQAmUWQyV+VD7AiEwb:nTko1D9GWMXp9mrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 adecce8ea882459f7dea60349633df350a2edc768b8daf9f8f7b2b7659cffc3c
MD5 3ddb1d3375da7a762a107db30bcd75af
SHA1 8b2133f9d012d5cfad147a3fb9587104f02162eb
SHA512 93e3e8f016178ec3931410670e5bb5c4446b7dada1080bed2ba3575730319c1042ab8a0c5abd9a313698edb9989c492c25b3e7868a48869f5f97270baf81293e
SSDEEP 96:nTkKKw1HD9wpvWMoiVmdeHpRQAmUWQyV+VDCziEwb:nTk61D9GWMXp9mro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f1efc775850068eae037e41bb3f2ca59fac11376edac375fb8e96b111f3940f9
MD5 af98c83823dd7d11e77a196d4c90bbc2
SHA1 6b3a28dd3d8be007155345c1d95eb3cb3861453e
SHA512 b9c35f58bb12c8bdee9829b4d23c458471d7490a212865dc4f4fb7748793f850c92676b4fa51d353f8fb8244bdd1a7affc0e4fb09d78df29324510107e9c4e6b
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupCZe2RUvqTc3z2OMDCRHql+:A9iIxuERzA83h09RZxYCNPcaOMWRHql+
MD5 SHA1 SHA512 SSDEEP

Submit Download