d16e08a097189cfb80d39599454bf1603864fc4280cd08e259a0df98b81af219

Analysis

max time kernel
146s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 15:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92396321ecd690f2e5630aead12cee66_JaffaCakes118.html
Size 85KB
Sample240603-skftxsbf69
SHA256 d16e08a097189cfb80d39599454bf1603864fc4280cd08e259a0df98b81af219
MD5 92396321ecd690f2e5630aead12cee66
SHA1 8ece642d1f8eb0d3ef883e1cfa50cc49f76f78c5
SHA512 3b55125acaa81a6c6c28acb0865a5bb9964520f9f6ecb55219a32d4ab6a453cbd946fc0990b5a98478d4ebd1ab19942aeef47d216991e9090bc2afce064ed1ac
SSDEEP 1536:3c84QZBzMXUY8hjgGF9EoPkQ50gytQoFb4n/5gcFahyMOYWbnjLu1mQYleWGrzGp:sl8hkGF9EoPkQ50gHgea8jjLu1mQYle8
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4596	msedge.exe
4596	msedge.exe
4648	identity_helper.exe
4648	identity_helper.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 4588	4596	msedge.exe	84
PID 4596 wrote to memory of 4588	4596	msedge.exe	84
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 1316	4596	msedge.exe	85
PID 4596 wrote to memory of 4952	4596	msedge.exe	86
PID 4596 wrote to memory of 4952	4596	msedge.exe	86
PID 4596 wrote to memory of 3372	4596	msedge.exe	87
PID 4596 wrote to memory of 3372	4596	msedge.exe	87
PID 4596 wrote to memory of 3372	4596	msedge.exe	87
PID 4596 wrote to memory of 3372	4596	msedge.exe	87
PID 4596 wrote to memory of 3372	4596	msedge.exe	87
PID 4596 wrote to memory of 3372	4596	msedge.exe	87
PID 4596 wrote to memory of 3372	4596	msedge.exe	87
PID 4596 wrote to memory of 3372	4596	msedge.exe	87
PID 4596 wrote to memory of 3372	4596	msedge.exe	87
PID 4596 wrote to memory of 3372	4596	msedge.exe	87
PID 4596 wrote to memory of 3372	4596	msedge.exe	87
PID 4596 wrote to memory of 3372	4596	msedge.exe	87
PID 4596 wrote to memory of 3372	4596	msedge.exe	87
PID 4596 wrote to memory of 3372	4596	msedge.exe	87
PID 4596 wrote to memory of 3372	4596	msedge.exe	87
PID 4596 wrote to memory of 3372	4596	msedge.exe	87
PID 4596 wrote to memory of 3372	4596	msedge.exe	87
PID 4596 wrote to memory of 3372	4596	msedge.exe	87
PID 4596 wrote to memory of 3372	4596	msedge.exe	87
PID 4596 wrote to memory of 3372	4596	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\92396321ecd690f2e5630aead12cee66_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa592846f8,0x7ffa59284708,0x7ffa59284718
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,8314033152720813641,9362483953978557911,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,8314033152720813641,9362483953978557911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,8314033152720813641,9362483953978557911,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8314033152720813641,9362483953978557911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8314033152720813641,9362483953978557911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,8314033152720813641,9362483953978557911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,8314033152720813641,9362483953978557911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8314033152720813641,9362483953978557911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8314033152720813641,9362483953978557911,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8314033152720813641,9362483953978557911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,8314033152720813641,9362483953978557911,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,8314033152720813641,9362483953978557911,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5016 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
MD5 2daa93382bba07cbc40af372d30ec576
SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
MD5 ecdc2754d7d2ae862272153aa9b9ca6e
SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 88e71099b95ab78777fc28641d0590d09d8d501c206ccbaee76362590c12d94b
MD5 8caae66fa606998a86796d62bba0592e
SHA1 ef75b2841c333b05e138122044e21227ae38cd7a
SHA512 e0a07cbb1719ca92d948fad084774974b46973377b23787de0fa17d8c7e8f0b60c42a28439fb4e1f987af33404f0abfec8588cf640d1b8b87ff993cb8d1d03f8
SSDEEP 96:naAkoE1Wn3wpvWMoiVmdeHplwtPac/UWQyV+VDCziEwb:naAkFU3GWMXpKX/ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ebf6468dca7ea8afd70f0b5f4d6c57a1fa9f136b3a5707424446bd0eca22690e
MD5 2cdef39e16a060cdd523d792cef273ea
SHA1 bad9fa8a9ccbc33514992fa1cf03fe5f2cf63498
SHA512 767e049fec43ad6b30bf81f6047c6e5f8f57e7617f5ccdbc2c9f0f24b62628f49414b1400089615bc97e40b83e29efd2bf6903869cfbcd4a88f0460c77b53790
SSDEEP 96:naAkDE1Wn3wpvWMoiVmdeHplwtPac/UWQyV+VDCAiEwb:naAkIU3GWMXpKX/rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 6396c7954af9fe530438906fe48a761b4618ac14053a8cce153488c37698c4a1
MD5 ec8d53122dc7c3bc403e294dedba122f
SHA1 40b735efd2325acae7ef4e19e96f318a94cf06ad
SHA512 f1dc9e480ebf699fad996ab84762a91b5cbbbc7076d0c5bc8ba138c24e1f51734f0e1632af915bf139e52f3bb3e820a282d42e0a60494bea9afc85c536606260
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupVzqe2RUI2Zw3z2OMDCRHq6:A9iIxuERzA83h09RZxYi2waOMWRHqlWN
MD5 SHA1 SHA512 SSDEEP

Submit Download