86ce6193a02cdf24f3e0030ff69053ade9a90fcef30005747a16f9112e6c669a

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 03:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3b5ac0833e55f3a408cc42edb10b2c0_JaffaCakes118.html
Size 26KB
Sample240613-d9tprawhkn
SHA256 86ce6193a02cdf24f3e0030ff69053ade9a90fcef30005747a16f9112e6c669a
MD5 a3b5ac0833e55f3a408cc42edb10b2c0
SHA1 b3a6f0d762789888ad698def609dbe1d675a6346
SHA512 8ba050eff1e8bab7981db4ecdcb2d491328337c7c326f12718e88d48ce8b44550f32f7a76abdbd8ed69594d1636a367001ddc7ed9c7cfcba6bd2aa80c39e9d41
SSDEEP 192:uqBf7lb5nDmnQjxn5Q/qnQiexNnonQOkEntusnQTbnxnQhCJVevo7Nt0Fo+NzQ4q:ndQ/mygcDLbbD
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
3536	msedge.exe
3536	msedge.exe
1548	identity_helper.exe
1548	identity_helper.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 4176	3536	msedge.exe	82
PID 3536 wrote to memory of 4176	3536	msedge.exe	82
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 1200	3536	msedge.exe	84
PID 3536 wrote to memory of 4452	3536	msedge.exe	85
PID 3536 wrote to memory of 4452	3536	msedge.exe	85
PID 3536 wrote to memory of 3736	3536	msedge.exe	86
PID 3536 wrote to memory of 3736	3536	msedge.exe	86
PID 3536 wrote to memory of 3736	3536	msedge.exe	86
PID 3536 wrote to memory of 3736	3536	msedge.exe	86
PID 3536 wrote to memory of 3736	3536	msedge.exe	86
PID 3536 wrote to memory of 3736	3536	msedge.exe	86
PID 3536 wrote to memory of 3736	3536	msedge.exe	86
PID 3536 wrote to memory of 3736	3536	msedge.exe	86
PID 3536 wrote to memory of 3736	3536	msedge.exe	86
PID 3536 wrote to memory of 3736	3536	msedge.exe	86
PID 3536 wrote to memory of 3736	3536	msedge.exe	86
PID 3536 wrote to memory of 3736	3536	msedge.exe	86
PID 3536 wrote to memory of 3736	3536	msedge.exe	86
PID 3536 wrote to memory of 3736	3536	msedge.exe	86
PID 3536 wrote to memory of 3736	3536	msedge.exe	86
PID 3536 wrote to memory of 3736	3536	msedge.exe	86
PID 3536 wrote to memory of 3736	3536	msedge.exe	86
PID 3536 wrote to memory of 3736	3536	msedge.exe	86
PID 3536 wrote to memory of 3736	3536	msedge.exe	86
PID 3536 wrote to memory of 3736	3536	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3b5ac0833e55f3a408cc42edb10b2c0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeba3b46f8,0x7ffeba3b4708,0x7ffeba3b4718
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,4224328297587984607,11519352518395281868,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,4224328297587984607,11519352518395281868,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,4224328297587984607,11519352518395281868,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4224328297587984607,11519352518395281868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4224328297587984607,11519352518395281868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,4224328297587984607,11519352518395281868,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,4224328297587984607,11519352518395281868,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4224328297587984607,11519352518395281868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4224328297587984607,11519352518395281868,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4224328297587984607,11519352518395281868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4224328297587984607,11519352518395281868,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,4224328297587984607,11519352518395281868,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4936 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
MD5 dabfafd78687947a9de64dd5b776d25f
SHA1 16084c74980dbad713f9d332091985808b436dea
SHA512 dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
MD5 c39b3aa574c0c938c80eb263bb450311
SHA1 f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA512 eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a6a57dea7afbb1e603a614b86259fd7097110efbbe1a7b8088c3ece8f80c781f
MD5 73a12bbe9ab25945b7807e67e40e3f06
SHA1 cc18d490c2693d288b037742940278c92f9e43eb
SHA512 80aa72d0d72c05e502f090590113f23a2f338236008428d43fee962090a20ab05a181daf193d8c09c3aee18eefe8e25a68c113e0dfdcc1859f3768a711a50609
SSDEEP 96:nekVoxm/DQYmqa1FGmwpvWMoiVmdeH1DLUWQyV+VDCziEwb:nekfIpbGmGWMXVro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c21c919a85ae191dc070e64a3145a3c5b626f5febb2733846811ee4c2c2b286c
MD5 a5180d4827e969170cf5a9e3ff852ab5
SHA1 d7c036948dfae0ebda2b3a2131a23709fc352237
SHA512 29188a5af3a96a8cfdd4afcf2e4e9ca1c04cb3d3d6634f30101dcd0136e4ff778edcae59b3768864d6e17bc52f186459e076fe0df87d7edb213aa56d430e4f1f
SSDEEP 96:nekVoxm/Dnmqa1FGmwpvWMoiVmdeH1DLUWQyV+VDCAiEwb:nekf6pbGmGWMXVrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ffb0601380614c52de23ad08dccae34f71ecb3f47e4fa60681ec21f5f96ac49f
MD5 e25d48d0856c5828f44883172b7e4561
SHA1 acfaedea2b62d88d7968ef605e2c13cd34928ef1
SHA512 9d6028949d1ba281dc74ddbcecdf13f5b9a6766e87d7d375928b61aa4c355b4c380a7882382ba3c205b0d81679665cb5df3ed06d997a8f117804667fd56d0b14
SSDEEP 96:nekVoxm/Dnmqa1FEmwpvWMoiVmdeH1DLUWQyV+VDCAiEwb:nekf6pbEmGWMXVrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c8e22eed5d5fca3c9b06455cbedaa73dd37adedb8ffefcbcb362e19315c67459
MD5 73c308f182e627f07eb34a6a5f99a4d3
SHA1 c8bf78a3f89ee429f7f6d4ebcf5a82cef3797b3d
SHA512 1c4e20adf14b9f1c0543f82cd90857dfc4a33bc9131b7cd25a33d2a317a4fd4a5ac3efc4d8819950f8e6cb3cb989141a1fbd29bc2b55e7cd999a5080f5cd77da
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuphWe2RU9/SRs93z2OMDCRHc:A9iIxuERzA83h09RZxYCwaG9aOMWRHqn
MD5 SHA1 SHA512 SSDEEP

Submit Download