e1cb447cefe66350031835a67ef211960c55f771e6bb665370c8ba7fab57fdf7

Analysis

max time kernel
145s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 03:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3b51a6d3ab86b8c6a145c08eb6cceb2_JaffaCakes118.html
Size 37KB
Sample240613-d9geestajf
SHA256 e1cb447cefe66350031835a67ef211960c55f771e6bb665370c8ba7fab57fdf7
MD5 a3b51a6d3ab86b8c6a145c08eb6cceb2
SHA1 e87d039fe6b52631be8c037f1f43a609944fb661
SHA512 3ecb2c401ad2eb5fe59332ae514c6603166699ad07d8f3ee8225ed9bf6aecf0f936d3f006bb4ab8b05177dc93ac6753bb5d6de628050457944e4529f93a3ecee
SSDEEP 768:Q/bVFRFQW81D4RA+vEOjz6rdG2Gil54RZfPGnf3Gu34aYi6781DdRA4vEOjq6h8q:yRFQW81D4RA+vEOjz6raA7IaPC81DdRv
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2404	msedge.exe
2404	msedge.exe
3156	msedge.exe
3156	msedge.exe
4128	identity_helper.exe
4128	identity_helper.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 1460	3156	msedge.exe	81
PID 3156 wrote to memory of 1460	3156	msedge.exe	81
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 4684	3156	msedge.exe	82
PID 3156 wrote to memory of 2404	3156	msedge.exe	83
PID 3156 wrote to memory of 2404	3156	msedge.exe	83
PID 3156 wrote to memory of 3124	3156	msedge.exe	84
PID 3156 wrote to memory of 3124	3156	msedge.exe	84
PID 3156 wrote to memory of 3124	3156	msedge.exe	84
PID 3156 wrote to memory of 3124	3156	msedge.exe	84
PID 3156 wrote to memory of 3124	3156	msedge.exe	84
PID 3156 wrote to memory of 3124	3156	msedge.exe	84
PID 3156 wrote to memory of 3124	3156	msedge.exe	84
PID 3156 wrote to memory of 3124	3156	msedge.exe	84
PID 3156 wrote to memory of 3124	3156	msedge.exe	84
PID 3156 wrote to memory of 3124	3156	msedge.exe	84
PID 3156 wrote to memory of 3124	3156	msedge.exe	84
PID 3156 wrote to memory of 3124	3156	msedge.exe	84
PID 3156 wrote to memory of 3124	3156	msedge.exe	84
PID 3156 wrote to memory of 3124	3156	msedge.exe	84
PID 3156 wrote to memory of 3124	3156	msedge.exe	84
PID 3156 wrote to memory of 3124	3156	msedge.exe	84
PID 3156 wrote to memory of 3124	3156	msedge.exe	84
PID 3156 wrote to memory of 3124	3156	msedge.exe	84
PID 3156 wrote to memory of 3124	3156	msedge.exe	84
PID 3156 wrote to memory of 3124	3156	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3b51a6d3ab86b8c6a145c08eb6cceb2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80fb846f8,0x7ff80fb84708,0x7ff80fb84718
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,11888178292128919464,17049350443573928303,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,11888178292128919464,17049350443573928303,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,11888178292128919464,17049350443573928303,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2332 /prefetch:8
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,11888178292128919464,17049350443573928303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,11888178292128919464,17049350443573928303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,11888178292128919464,17049350443573928303,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 /prefetch:8
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,11888178292128919464,17049350443573928303,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,11888178292128919464,17049350443573928303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,11888178292128919464,17049350443573928303,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,11888178292128919464,17049350443573928303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,11888178292128919464,17049350443573928303,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,11888178292128919464,17049350443573928303,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3440 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 fa5832283d0cee6f9a0708e81080faef9d837676ac6112cfc0bebfef54ca9f19
MD5 4fbaad8da9846e37dc268d6021ff1c35
SHA1 74519fd409398f161f854367234ba8339b8905dd
SHA512 e11c0c6b15b82ac41a977cb132216956bddcc87ac462a4191e987df9ae6492d1796d2f8955b1b6aa79c1a673f0c26e301e3a7cd737b0696fe1fa53ca26a4b760
SSDEEP 96:nL+kGba1kn2wpvWMoiVmdeHk4s1oUWQyV+VDCziEwb:nL+k0aGn2GWMXq1oro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 170b46d3b01d4c6a1cf5657a20091da56683e3173ad6f2ae43c73b81bab13b85
MD5 492d12515d91da72c3e86ad12b5aa5e0
SHA1 07ab7a70b8a037bdb4bf4f4cdd7cef4558aef40c
SHA512 dbbf34365471a31b3dd2253db0af7d83c21cc70aa3772d5db1ed852beee1d0424f27a7340a23a931d166e88488d01e5d0ec2d305e07e4fd8ca8b785b7f6fefb1
SSDEEP 96:nL+kGba1kq2wpvWMoiVmdeGVv3qk4s1oUWQyV+VD7AiEwb:nL+k0aGq2GWM2Vv3qq1org
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2df0666605e0f2ef7a35a69a5b93cd3e4d769345008c41c56f7b2f61a0eef01a
MD5 82d9fe55f40ca7b6e6bdb578911ef7e6
SHA1 0483bb7702f7635fb89ee4c3cd91745624eec8b4
SHA512 30b9f80cb19abb8a2fcf7e72d3c045953983d35a24b1856319c7923a64e2352c6e069cf35510579d013e7c25a8b15d0618729cc6a74795e50259d00161056e3d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupdfHe2RUhsuK/y4Voc:A9iIxuERzA83h09RZxYdv6suK5oc
MD5 SHA1 SHA512 SSDEEP

Submit Download