55e179f8aac45c3f651815346b20bf805065af73e8d226fc5d58a806871507b2

Analysis

max time kernel
145s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3cce0164cde69aafa7ba15c925ba36f_JaffaCakes118.html
Size 175KB
Sample240613-ev7hqstfph
SHA256 55e179f8aac45c3f651815346b20bf805065af73e8d226fc5d58a806871507b2
MD5 a3cce0164cde69aafa7ba15c925ba36f
SHA1 8d09ef19847c4a2bd79a63ff980c458f69212263
SHA512 ec01157c82557d9dfdb52bfb4a4933f6506c541e06255e0a333707de3c5c9d657821c313452a1f7da80be002a07d7917de81bcc03e77b48d44410b436b702b45
SSDEEP 1536:Sqt58gd8Wu8pI8Cd8hd8dQgbH//WoS3HGNkFPYfBCJiZVc+aeTH+WK/Lf1/hpnV+:SHCT3H/FuBCJi5B
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3504	msedge.exe
3504	msedge.exe
2076	msedge.exe
2076	msedge.exe
4824	identity_helper.exe
4824	identity_helper.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 3200	2076	msedge.exe	82
PID 2076 wrote to memory of 3200	2076	msedge.exe	82
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 2572	2076	msedge.exe	83
PID 2076 wrote to memory of 3504	2076	msedge.exe	84
PID 2076 wrote to memory of 3504	2076	msedge.exe	84
PID 2076 wrote to memory of 3352	2076	msedge.exe	85
PID 2076 wrote to memory of 3352	2076	msedge.exe	85
PID 2076 wrote to memory of 3352	2076	msedge.exe	85
PID 2076 wrote to memory of 3352	2076	msedge.exe	85
PID 2076 wrote to memory of 3352	2076	msedge.exe	85
PID 2076 wrote to memory of 3352	2076	msedge.exe	85
PID 2076 wrote to memory of 3352	2076	msedge.exe	85
PID 2076 wrote to memory of 3352	2076	msedge.exe	85
PID 2076 wrote to memory of 3352	2076	msedge.exe	85
PID 2076 wrote to memory of 3352	2076	msedge.exe	85
PID 2076 wrote to memory of 3352	2076	msedge.exe	85
PID 2076 wrote to memory of 3352	2076	msedge.exe	85
PID 2076 wrote to memory of 3352	2076	msedge.exe	85
PID 2076 wrote to memory of 3352	2076	msedge.exe	85
PID 2076 wrote to memory of 3352	2076	msedge.exe	85
PID 2076 wrote to memory of 3352	2076	msedge.exe	85
PID 2076 wrote to memory of 3352	2076	msedge.exe	85
PID 2076 wrote to memory of 3352	2076	msedge.exe	85
PID 2076 wrote to memory of 3352	2076	msedge.exe	85
PID 2076 wrote to memory of 3352	2076	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3cce0164cde69aafa7ba15c925ba36f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcdb8546f8,0x7ffcdb854708,0x7ffcdb854718
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,15611517336817160655,10172303741605864824,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,15611517336817160655,10172303741605864824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,15611517336817160655,10172303741605864824,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15611517336817160655,10172303741605864824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15611517336817160655,10172303741605864824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15611517336817160655,10172303741605864824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15611517336817160655,10172303741605864824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15611517336817160655,10172303741605864824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15611517336817160655,10172303741605864824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15611517336817160655,10172303741605864824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15611517336817160655,10172303741605864824,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15611517336817160655,10172303741605864824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15611517336817160655,10172303741605864824,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,15611517336817160655,10172303741605864824,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
MD5 4b4f91fa1b362ba5341ecb2836438dea
SHA1 9561f5aabed742404d455da735259a2c6781fa07
SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
MD5 eaa3db555ab5bc0cb364826204aad3f0
SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 7d83427cefb60c281d314ddd10f267a4172d5265ae871cbfa512fde1c3afb7a2
MD5 3f0da96375d5eac582952bc99e1b035b
SHA1 c4cb93b18752caabb26433ea519692a940470a03
SHA512 00e7795e6be74299fac78356543a37b2e306778cf08fa38c56f8fe6ec1dda1932bf8623242b9d4971e4ac8e4a5be17d778a5eaba97e625a506d5c495f67eb6d4
SSDEEP 96:nYk0721My7j0wpvWMoiVmde0V8RQK2mQIu3UWQyV+VD7AiEwb:nYkP+y7j0GWMEqz2X3rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 78e96498b8d4f3c6cc3819cbf787a360dfcd5980de8c8b13cd6995d5acf95cb8
MD5 a764cb86a79bce1358f6b621eb174805
SHA1 ed014b3a245245d15e7d5e98e8823b3c655cbc8f
SHA512 c3ddc358e157af2352b132e0ffce510093476fb509158c838b529b3f497dc7fa70491d5ebedc881b33e8093ff977be70a658217d76d8a1865c798e5feb7f5d88
SSDEEP 96:nYk0721MyEj0wpvWMoiVmdeHmQIu3UWQyV+VDCziEwb:nYkP+yEj0GWMXX3ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b25e5ed57f5836084d258c932b6c368871aab5f8db6ffc579e8753427f363d5d
MD5 b3fc893bc9e3585beae4cd3176b91e08
SHA1 88455166b7308add33f9bdfe20ca5406803cfa21
SHA512 6acafaf4ef656a596aa6059a053e8ac59f5a4b8a7ffd4c8dcaed65dee56530fef31cd0e59dcf4ec32000f9341a85b81013ea5c1505f5e6108cd49d5c5504e093
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupAne2RUiIKbk:A9iIxuERzA83h09RZxYAPlk
MD5 SHA1 SHA512 SSDEEP

Submit Download