7374e2592190808fda4ff047e8b6c10025885e3ff252d24274f8aebab4121002

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 19:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8b7525799a12aa87afd7041353250872_JaffaCakes118.html
Size 348KB
Sample240601-xrdelaca2v
SHA256 7374e2592190808fda4ff047e8b6c10025885e3ff252d24274f8aebab4121002
MD5 8b7525799a12aa87afd7041353250872
SHA1 a0f1e916e8c066fe7ec085ef5e4a624194027953
SHA512 558e0e932d71275be5cc5a971915de439792834c04e7fd4e1f434b2bb3f04b3380f82098516c372b3571caf6e9d852cc489afabfcc2ca678cd5c6e343bb23808
SSDEEP 6144:nsMYod+X3oI+YqLsMYod+X3oI+Y5sMYod+X3oI+YQ:L5d+X3c5d+X3f5d+X3+
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1280	msedge.exe
1280	msedge.exe
1400	msedge.exe
1400	msedge.exe
4352	identity_helper.exe
4352	identity_helper.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 2224	1400	msedge.exe	84
PID 1400 wrote to memory of 2224	1400	msedge.exe	84
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 3464	1400	msedge.exe	86
PID 1400 wrote to memory of 1280	1400	msedge.exe	87
PID 1400 wrote to memory of 1280	1400	msedge.exe	87
PID 1400 wrote to memory of 4928	1400	msedge.exe	88
PID 1400 wrote to memory of 4928	1400	msedge.exe	88
PID 1400 wrote to memory of 4928	1400	msedge.exe	88
PID 1400 wrote to memory of 4928	1400	msedge.exe	88
PID 1400 wrote to memory of 4928	1400	msedge.exe	88
PID 1400 wrote to memory of 4928	1400	msedge.exe	88
PID 1400 wrote to memory of 4928	1400	msedge.exe	88
PID 1400 wrote to memory of 4928	1400	msedge.exe	88
PID 1400 wrote to memory of 4928	1400	msedge.exe	88
PID 1400 wrote to memory of 4928	1400	msedge.exe	88
PID 1400 wrote to memory of 4928	1400	msedge.exe	88
PID 1400 wrote to memory of 4928	1400	msedge.exe	88
PID 1400 wrote to memory of 4928	1400	msedge.exe	88
PID 1400 wrote to memory of 4928	1400	msedge.exe	88
PID 1400 wrote to memory of 4928	1400	msedge.exe	88
PID 1400 wrote to memory of 4928	1400	msedge.exe	88
PID 1400 wrote to memory of 4928	1400	msedge.exe	88
PID 1400 wrote to memory of 4928	1400	msedge.exe	88
PID 1400 wrote to memory of 4928	1400	msedge.exe	88
PID 1400 wrote to memory of 4928	1400	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8b7525799a12aa87afd7041353250872_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe6c446f8,0x7ffbe6c44708,0x7ffbe6c44718
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,16641382422373963084,9569060048157218617,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,16641382422373963084,9569060048157218617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,16641382422373963084,9569060048157218617,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16641382422373963084,9569060048157218617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16641382422373963084,9569060048157218617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,16641382422373963084,9569060048157218617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,16641382422373963084,9569060048157218617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16641382422373963084,9569060048157218617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16641382422373963084,9569060048157218617,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16641382422373963084,9569060048157218617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16641382422373963084,9569060048157218617,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,16641382422373963084,9569060048157218617,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
MD5 1ac52e2503cc26baee4322f02f5b8d9c
SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
MD5 b2a1398f937474c51a48b347387ee36a
SHA1 922a8567f09e68a04233e84e5919043034635949
SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 130e781968a9fb4a3080d467e72a03bd7c7d2f8ae90132db346c63344723d118
MD5 5cc28cd02c239ad62d319deb338e6dc0
SHA1 22b33e9445dfa2a16e7f5cd9be8fdbb1c301392c
SHA512 184c559aaf4ed57ed8001ef424b04b4be0034cbc8afb364df9e2808f8891e73e3a3371260da39cfd018bcdd4ffc256cd3504d4e702f849014c5b6d1d8e96d12b
SSDEEP 96:nekur1F6ga9IQwpvWMoiVmdeHpCr9bgUWQyV+VD7ziEwb:neksjpaCQGWMXpabgrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d4422124906570252fa1dcdd5887445d05ed1a65184a7efb4673e02a7eae7a25
MD5 042205c10cbe7d74787f0f02cd1af416
SHA1 4cffdaee923c483049afee2d78bd2b0f92d9437c
SHA512 748258017ed8e1f5225c1015cb0253f1f1c790ee42b88385e30edf149b2107c97274cec69b7d82ff5907f20ca24746815ea8a00bd789d17b6f520f7457e14d6a
SSDEEP 96:neklr1FLga9IQwpvWMoiVmdeHpCr9bgUWQyV+VD7AiEwb:nekJjEaCQGWMXpabgrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 58155a43dd73fd6b93248f462dcaf5c9d40920319dbc1a24250c4036c8c9e13c
MD5 306c6c440d5d695dc3d95c15f350a475
SHA1 74a7f813c5b079f26a520920b35ef48f383ed5a7
SHA512 53a3af1ecb11c2f485d6b4a3ce2e50b715cd0c32976ac348ef2c820256013babd8c05ee572b05578fc5852322634e27ca541f698fd94d1dbce19a7919438b109
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupOkhe2RUfjf7Z83z2OMDCR5:A9iIxuERzA83h09RZxYOk1SzZ8aOMWR5
MD5 SHA1 SHA512 SSDEEP

Submit Download