4d74ff2f785581008b0081431a39014ee0dd6a0b8ad30e7d3066c19fb0f329b0

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 08:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a4abc1695901bac62964cc060e42ed97_JaffaCakes118.html
Size 118KB
Sample240613-kkpg3a1fkd
SHA256 4d74ff2f785581008b0081431a39014ee0dd6a0b8ad30e7d3066c19fb0f329b0
MD5 a4abc1695901bac62964cc060e42ed97
SHA1 e3c687321cae6b12811326cba3980dc52312e66c
SHA512 5d2ca3878b1b541b2de2c58af33caa0a057e81ecc5860bc5ad6b164321740ab71dc72efe6ca168973a0c1d1b9870c03b1431efb1704163855b0d8ef33217332d
SSDEEP 1536:y9rz85TKMHGQNhhGZtJ74uKUKdRkuLPvhluQ6QFClzZ0ruDjNet2uRtoQ1z0c6wj:gcHGbZmTv223/FfAfgeefR9Dt+JbQ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3808065738-1666277613-1125846146-1000\{095294F3-7B7E-4155-A53A-834AB0B46892}	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 2656	3168	msedge.exe	105
PID 3168 wrote to memory of 2656	3168	msedge.exe	105
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 3688	3168	msedge.exe	106
PID 3168 wrote to memory of 4152	3168	msedge.exe	107
PID 3168 wrote to memory of 4152	3168	msedge.exe	107
PID 3168 wrote to memory of 3836	3168	msedge.exe	108
PID 3168 wrote to memory of 3836	3168	msedge.exe	108
PID 3168 wrote to memory of 3836	3168	msedge.exe	108
PID 3168 wrote to memory of 3836	3168	msedge.exe	108
PID 3168 wrote to memory of 3836	3168	msedge.exe	108
PID 3168 wrote to memory of 3836	3168	msedge.exe	108
PID 3168 wrote to memory of 3836	3168	msedge.exe	108
PID 3168 wrote to memory of 3836	3168	msedge.exe	108
PID 3168 wrote to memory of 3836	3168	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a4abc1695901bac62964cc060e42ed97_JaffaCakes118.html
1⤵
PID:1480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=4908 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
1⤵
PID:2184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4940 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
1⤵
PID:3832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5344 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5560 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
1⤵
PID:1284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=4944 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:4664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff980c42e98,0x7ff980c42ea4,0x7ff980c42eb0
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2348 --field-trial-handle=2352,i,4818322913880237984,8730878803291543373,262144 --variations-seed-version /prefetch:2
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3104 --field-trial-handle=2352,i,4818322913880237984,8730878803291543373,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3120 --field-trial-handle=2352,i,4818322913880237984,8730878803291543373,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4436 --field-trial-handle=2352,i,4818322913880237984,8730878803291543373,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4436 --field-trial-handle=2352,i,4818322913880237984,8730878803291543373,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4508 --field-trial-handle=2352,i,4818322913880237984,8730878803291543373,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4620 --field-trial-handle=2352,i,4818322913880237984,8730878803291543373,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4624 --field-trial-handle=2352,i,4818322913880237984,8730878803291543373,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c688fe57afdc8b20f8aef36080922f83e2ed3300a51a15248549d042433aab1c
MD5 bd5d72921901de617fe5ab46e86854fe
SHA1 ab9d4a626a84436f2c971e438ae161aa5416d314
SHA512 c518b78a6a8232713b2c1f326977d7c69ae325377ce01e8071c8bd5ad537134a718918b5560ec9c54d99f5576cab6910e170ff59be110b88d25b612bb8e98f64
MD5 SHA1 SHA512

Submit Download

5faec07b-7309-4626-913a-e895a92848be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5faec07b-7309-4626-913a-e895a92848be.tmp
Size 30KB
SHA256 74aad143e028acd323332407f9ea2626173a88683c9a8e65260aa24b20db75a3
MD5 1dc08bcdb8fa0f0fe572cf4f37ba6d76
SHA1 3c54c0cf43c42d8d2cee7b8813d08762e22cd1fd
SHA512 78dda876724855123e8961311833d584b26272a3728b8e1fd345fd670e2db6ed85c75b27b9f87538ec2f8f2f09cb0f0504c3822932f62a657db1a720dcd4102b
SSDEEP 768:34b1f74LQLqqZWFEIeE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBPLly8spQrw8Ij:34b1f7GeqqZWFEIeEu1ja8PL0Vph8Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c76ee20240c8b9713d763481b26a6f05ce086063d006c44888f49ea160c3a698
MD5 0a373c96d0cbb1308798b5a59cc0a84d
SHA1 f2a25aaa0a938a6d988c161dd980020f17a3357f
SHA512 770acf6143357cd8c918572a8fd350548e7d71ad910d3b88e84214624cb7595bae51011365f8278cb386420592057f960809ea3bab847de624d4352436e608a0
SSDEEP 192:sV1Ff5IysAWcYdswCyVIRHooxSj+FX0Qj0Vm6O05pJ:sV1FuysAWce2BSUkQgT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 69KB
SHA256 75978922193e5c59d4fae011d9a9c3231b9baad498d6d05103b104b50b5cad2a
MD5 2fc5fe74a55912a6a2dd2f4e2385b11d
SHA1 a38bff875778567c423bdc8e71408e4b0b589ba8
SHA512 c150557fa8cc20977973aeb82806512009057de4dd25bc0de3c578e27aa263362dc01b89673f92f8349979b182577a161ce52ad23997de66e4aeded30675cff5
SSDEEP 1536:KQ6O4F//gHKMl5htUg9aLelXnmfdfiD7A83akV1:KQH4F/4B5QGqu0iDV1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 60KB
SHA256 7a61a2ffc2de504d6e8a3fab7cebcba85ad523fa37a2e0a2431fb0d746ccf3e7
MD5 20789efc4a60a91dbc51c48664fcbc42
SHA1 20f181388e20f8cc07bb23d4043d9240deb43de4
SHA512 026f45fc30749ea6922ba40c7e99124125d3acc9e85abdb33eacbdfa24b8f8ac2a2109de98732a965f81029587db4879a28866f67418fdaae123d2016b2300b4
SSDEEP 1536:lCMivHF//gHKMl5htUg9aLelXnmfdf8akVQA8i:kHF/4B5QGqu00F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads