4939036bc20b00231649653ecb00caa3503caaad91d2caadd5997011a40b2401

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
699804f6cc98dab25e2ffd96a54dd625_JaffaCakes118.html
Size 30KB
Sample240523-d2rv7ace22
SHA256 4939036bc20b00231649653ecb00caa3503caaad91d2caadd5997011a40b2401
MD5 699804f6cc98dab25e2ffd96a54dd625
SHA1 e3810ac6be5e2a5ca9e8ae6f10a35787eb9e4e31
SHA512 fbc56ba9a420750bf20d76380b1040998cb2ff87dfd8bec6a8e98330141c0888ffaf466943bbdd183940ec8fa40c68464f4b9d4e33e94cfbc26e6b52ff82a93a
SSDEEP 384:SbHAoGzygTeyUtTmF3i2hV+5cV4GUvMt/FHnG6xKZyRtcfx3yn:SbizyIeyUUO5Au56x4yn
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
11	sites.google.com
18	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4184	msedge.exe
4184	msedge.exe
1100	msedge.exe
1100	msedge.exe
1060	identity_helper.exe
1060	identity_helper.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 800	1100	msedge.exe	84
PID 1100 wrote to memory of 800	1100	msedge.exe	84
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4808	1100	msedge.exe	85
PID 1100 wrote to memory of 4184	1100	msedge.exe	86
PID 1100 wrote to memory of 4184	1100	msedge.exe	86
PID 1100 wrote to memory of 3832	1100	msedge.exe	87
PID 1100 wrote to memory of 3832	1100	msedge.exe	87
PID 1100 wrote to memory of 3832	1100	msedge.exe	87
PID 1100 wrote to memory of 3832	1100	msedge.exe	87
PID 1100 wrote to memory of 3832	1100	msedge.exe	87
PID 1100 wrote to memory of 3832	1100	msedge.exe	87
PID 1100 wrote to memory of 3832	1100	msedge.exe	87
PID 1100 wrote to memory of 3832	1100	msedge.exe	87
PID 1100 wrote to memory of 3832	1100	msedge.exe	87
PID 1100 wrote to memory of 3832	1100	msedge.exe	87
PID 1100 wrote to memory of 3832	1100	msedge.exe	87
PID 1100 wrote to memory of 3832	1100	msedge.exe	87
PID 1100 wrote to memory of 3832	1100	msedge.exe	87
PID 1100 wrote to memory of 3832	1100	msedge.exe	87
PID 1100 wrote to memory of 3832	1100	msedge.exe	87
PID 1100 wrote to memory of 3832	1100	msedge.exe	87
PID 1100 wrote to memory of 3832	1100	msedge.exe	87
PID 1100 wrote to memory of 3832	1100	msedge.exe	87
PID 1100 wrote to memory of 3832	1100	msedge.exe	87
PID 1100 wrote to memory of 3832	1100	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\699804f6cc98dab25e2ffd96a54dd625_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c93a46f8,0x7ff8c93a4708,0x7ff8c93a4718
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,7427401887459361578,4068926370999291516,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,7427401887459361578,4068926370999291516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,7427401887459361578,4068926370999291516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7427401887459361578,4068926370999291516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7427401887459361578,4068926370999291516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7427401887459361578,4068926370999291516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7427401887459361578,4068926370999291516,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,7427401887459361578,4068926370999291516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,7427401887459361578,4068926370999291516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7427401887459361578,4068926370999291516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7427401887459361578,4068926370999291516,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,7427401887459361578,4068926370999291516,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6100 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
MD5 4f7152bc5a1a715ef481e37d1c791959
SHA1 c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA512 2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
MD5 ea98e583ad99df195d29aa066204ab56
SHA1 f89398664af0179641aa0138b337097b617cb2db
SHA512 e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 700B
SHA256 b7ca790b00805d36439e9745ec8566b6c2bd1d9126fad095f0d2cc5abce1d7b0
MD5 a64cd74b76122c4f7ab2d406f16218fc
SHA1 f9190ec62e121f416074930bfdbe509b7d742c72
SHA512 a6b3f225129c3fde118e4aae0ae01d7c60b8808f3abdfb43d976d996d2b79e0bdb26824a13e457c68515a5cb44fdebb7f4d5af93f65f419e4406c86ff2c6f0b3
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 e58c4bca5e4ec92efdb95f079e9c208db4adfd1f2a49b45dceb8f038f9b69355
MD5 d874cb41fc320e6c03f4a9314cb80804
SHA1 95c80a55afe8b9dffe4937eb45c28872c0173582
SHA512 728a95a39cffd4c8a3931b1d332c41484c3e8159fc5405646777727224587a8080e6faca1df498f609f33f3e2133ab2634b9c39a2d0d8be4b2dfc07d8b4e1e00
SSDEEP 96:nmk5A1d33XwpvWMoiVmdeHp1kNkUWQyV+VDCziEwb:nmkqPnXGWMXp8kro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 09e06da786b4e5d70293c699e431b4213f4f15f8b766f58f2e98ac1fd2abf50e
MD5 8c037394adebe6c8dd6c1ec359b77128
SHA1 3c37211ab4d188b39d89c0c6d7cdbcc37bf5b181
SHA512 ecaa78a08851f011034a5f30b248797cb036193f349bb6a80ff2485d03f38dab323a2abc43ed8f369fc531c1e79ad158bcbeef7a32f9774206da35bf17a5ae4b
SSDEEP 96:nmkEA1dR3XwpvWMoiVmdemHPd2p1kNkUWQyV+VDCAiEwb:nmkRPdXGWMWHPd2p8krV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1f4b2f2629afd41f2b332eecc4983c8b8056125a58afe907706a80ded7bb2358
MD5 68a377a3a7fbb180a19d50ed40ef7f6f
SHA1 62784cf5ba88e218e7798163d63e44c842c96e15
SHA512 f29f0c22aaebe5abb3a3ec1672b1e4f3e1a942fd867ac71f8697185aa9f082d0a299a6949f014cd8db175883c1519a3f366e2a0fdd83c1f0f46498bf57bae6b8
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupH7We2RUuo5yM3z2OMDCRH2:A9iIxuERzA83h09RZxYH0IyMaOMWRHqZ
MD5 SHA1 SHA512 SSDEEP

Submit Download