d0bc8c37d25287888b46f8be651d44502a6c194db5059d6b6d99f4a0709e91ae

Analysis

max time kernel
145s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a48089689e1a8a6bcb2831b9a0c7cae3_JaffaCakes118.html
Size 249KB
Sample240613-jpxtkatflk
SHA256 d0bc8c37d25287888b46f8be651d44502a6c194db5059d6b6d99f4a0709e91ae
MD5 a48089689e1a8a6bcb2831b9a0c7cae3
SHA1 32e6b9bec1b0fe4f764f2532789c120306aedd10
SHA512 a4f350d39a77e27d9cdef695767f0ebd4b48c3166c6fbe21dc3f303d7a56567a801e14b5437087722bbdb4365870deea37a8ca9744245395ebaeb6d4b11f16f1
SSDEEP 3072:S6yfkMY+BES09JXAnyrZalI+YhyfkMY+BES09JXAnyrZalI+YwsE:SfsMYod+X3oI+YksMYod+X3oI+YwsE
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
1788	msedge.exe
1788	msedge.exe
2864	identity_helper.exe
2864	identity_helper.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 2832	1788	msedge.exe	81
PID 1788 wrote to memory of 2832	1788	msedge.exe	81
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 412	1788	msedge.exe	83
PID 1788 wrote to memory of 1004	1788	msedge.exe	84
PID 1788 wrote to memory of 1004	1788	msedge.exe	84
PID 1788 wrote to memory of 440	1788	msedge.exe	85
PID 1788 wrote to memory of 440	1788	msedge.exe	85
PID 1788 wrote to memory of 440	1788	msedge.exe	85
PID 1788 wrote to memory of 440	1788	msedge.exe	85
PID 1788 wrote to memory of 440	1788	msedge.exe	85
PID 1788 wrote to memory of 440	1788	msedge.exe	85
PID 1788 wrote to memory of 440	1788	msedge.exe	85
PID 1788 wrote to memory of 440	1788	msedge.exe	85
PID 1788 wrote to memory of 440	1788	msedge.exe	85
PID 1788 wrote to memory of 440	1788	msedge.exe	85
PID 1788 wrote to memory of 440	1788	msedge.exe	85
PID 1788 wrote to memory of 440	1788	msedge.exe	85
PID 1788 wrote to memory of 440	1788	msedge.exe	85
PID 1788 wrote to memory of 440	1788	msedge.exe	85
PID 1788 wrote to memory of 440	1788	msedge.exe	85
PID 1788 wrote to memory of 440	1788	msedge.exe	85
PID 1788 wrote to memory of 440	1788	msedge.exe	85
PID 1788 wrote to memory of 440	1788	msedge.exe	85
PID 1788 wrote to memory of 440	1788	msedge.exe	85
PID 1788 wrote to memory of 440	1788	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a48089689e1a8a6bcb2831b9a0c7cae3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe706746f8,0x7ffe70674708,0x7ffe70674718
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10694241142331341084,7565123729156740720,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,10694241142331341084,7565123729156740720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,10694241142331341084,7565123729156740720,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10694241142331341084,7565123729156740720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10694241142331341084,7565123729156740720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,10694241142331341084,7565123729156740720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,10694241142331341084,7565123729156740720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10694241142331341084,7565123729156740720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10694241142331341084,7565123729156740720,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10694241142331341084,7565123729156740720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10694241142331341084,7565123729156740720,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10694241142331341084,7565123729156740720,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3032 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
MD5 81e892ca5c5683efdf9135fe0f2adb15
SHA1 39159b30226d98a465ece1da28dc87088b20ecad
SHA512 c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
MD5 56067634f68231081c4bd5bdbfcc202f
SHA1 5582776da6ffc75bb0973840fc3d15598bc09eb1
SHA512 c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f1fccc59a1effb2efca5d30eb2c2f472a55820eeb6b49fb64aa69344fb4581e0
MD5 048e2eeed1796332852c5e1bed21133e
SHA1 efaf7ce29c718f8a6056dfa5900a6dc4c2f9bbdd
SHA512 f4abfb195f23ef77fc99d58b1f845541b7d159327c7b09db222eb68d9ad1e082b399eac9d85341af0ab0d245f57eca25593ddb820277ea68ade616001c845bae
SSDEEP 96:n8kVoxm/DQYmq91aCYwpvWMoiVmdeHIqQ/9UWQyV+VDCziEwb:n8kfI+kCYGWMXdm9ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8a0c95c7023a571a385ade16b1cd00b76217a8b97c88a463af386e033f5b3e7f
MD5 dd9309109197b9fd40e119a863c1d72b
SHA1 bd9964b1e564a65e1dab5f851ccfb74e9a7d4a96
SHA512 de07c9e15fe26cbe1f2870fc3c585c103e8e008e337d5257429a8f332db74bad0ca6b5b7e08057d683e1530d58e876ba673afb7cd7ba5b61586ccca438262dbd
SSDEEP 96:n8kVoxm/Dnmq91aCBwpvWMoiVmdeHIqQ/9UWQyV+VD7AiEwb:n8kf6+kCBGWMXdm9rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 5c9d2b375dddfcf116927da38aadb721eaf3f87851ad63ff2bfe9cf024549476
MD5 dca703b73c88b9c8a2a76eb87cfa0090
SHA1 493e8f3fbce39d36e3fc00bce137f0f8ce6d25c6
SHA512 c585da51f3d7156ed11eb22cf0f94e8abfafc2bcc315af77603d0023a6fab0a1ab223f44c4f9f260df614503660cbbc8244ca244ddff2f9d3618926754b74c47
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupop0Ue2RUhdvM3z2OMDCRHh:A9iIxuERzA83h09RZxYPaEMaOMWRHqlQ
MD5 SHA1 SHA512 SSDEEP

Submit Download