5285b94ad81c551ff03f28c71f440baf4fe6dea01715064f0fa65d41ce85863d

Analysis

max time kernel
145s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b7170e0871e6bae6ea040602f554b285_JaffaCakes118.html
Size 27KB
Sample240617-gp47ja1fmm
SHA256 5285b94ad81c551ff03f28c71f440baf4fe6dea01715064f0fa65d41ce85863d
MD5 b7170e0871e6bae6ea040602f554b285
SHA1 b7d19df7a9d9968984053c2ce27dc10ae4f3c423
SHA512 1bb5d7b3699e28a6841cffe43f5a73715fbc676ad8c6e3eba9e0e37f58dc09227b6440984f35bd2c6c28a7660a103fa9c72482c36075dbbaec10fc97896025c5
SSDEEP 768:SDaNx802rCvC3CCCBC+CzC27+eAiueGScW0e0eVOoaoUonoZoOOCOPOpOgOv55dy:S70o2CFUvmyexueGS90e0ehUz
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
452	msedge.exe
452	msedge.exe
1728	msedge.exe
1728	msedge.exe
1680	identity_helper.exe
1680	identity_helper.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 2984	452	msedge.exe	81
PID 452 wrote to memory of 2984	452	msedge.exe	81
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1524	452	msedge.exe	82
PID 452 wrote to memory of 1728	452	msedge.exe	83
PID 452 wrote to memory of 1728	452	msedge.exe	83
PID 452 wrote to memory of 2548	452	msedge.exe	84
PID 452 wrote to memory of 2548	452	msedge.exe	84
PID 452 wrote to memory of 2548	452	msedge.exe	84
PID 452 wrote to memory of 2548	452	msedge.exe	84
PID 452 wrote to memory of 2548	452	msedge.exe	84
PID 452 wrote to memory of 2548	452	msedge.exe	84
PID 452 wrote to memory of 2548	452	msedge.exe	84
PID 452 wrote to memory of 2548	452	msedge.exe	84
PID 452 wrote to memory of 2548	452	msedge.exe	84
PID 452 wrote to memory of 2548	452	msedge.exe	84
PID 452 wrote to memory of 2548	452	msedge.exe	84
PID 452 wrote to memory of 2548	452	msedge.exe	84
PID 452 wrote to memory of 2548	452	msedge.exe	84
PID 452 wrote to memory of 2548	452	msedge.exe	84
PID 452 wrote to memory of 2548	452	msedge.exe	84
PID 452 wrote to memory of 2548	452	msedge.exe	84
PID 452 wrote to memory of 2548	452	msedge.exe	84
PID 452 wrote to memory of 2548	452	msedge.exe	84
PID 452 wrote to memory of 2548	452	msedge.exe	84
PID 452 wrote to memory of 2548	452	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b7170e0871e6bae6ea040602f554b285_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf8c646f8,0x7ffbf8c64708,0x7ffbf8c64718
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,1949802004159044351,1169615983272481568,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,1949802004159044351,1169615983272481568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,1949802004159044351,1169615983272481568,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1949802004159044351,1169615983272481568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2960 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1949802004159044351,1169615983272481568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2968 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,1949802004159044351,1169615983272481568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,1949802004159044351,1169615983272481568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1949802004159044351,1169615983272481568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1949802004159044351,1169615983272481568,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1949802004159044351,1169615983272481568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1949802004159044351,1169615983272481568,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,1949802004159044351,1169615983272481568,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4564 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 558db3eddf562310bd887e59ba3e2aca99bc4ba1899477ad2661293b46224791
MD5 84c774d1f5628ea5b76413b574a23307
SHA1 7d3179cdbbaf03759a6d3d8fd0aac198156209b3
SHA512 90a65a5c82b3fef081ec944a5ea32dfbcba735f4ef13c7cdd55a74d5d376001af2db487e4d25a30b565be911f54579e9758c62b4910d031e1a192b8a0cd0e5bb
SSDEEP 96:n7Uk0Ld991UBwpvWMoiVmdeHBrz4UWQyV+VDCziEwb:noko2BGWMXuro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0d3841948002abc5976b20a9d0d7e861597b736438a72dcf5cfc00444f55d479
MD5 d598f7fe6ef49a17d18e1d42ae41f335
SHA1 34b1d66fae18837c7ad29f2db3f5c39199ad2642
SHA512 279b70903fdd191844021fc44d63b2297aa08aa2cb706b5ed868b5d3bad9291b71185dac4696435ff2667547f5bfbeddd854ad3df0124ee0fdd0ccc5551baf39
SSDEEP 96:n7Uk0Ld991UQwpvWMoiVmdeHBrz4UWQyV+VD7AiEwb:noko2QGWMXurg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 672b587e1a9c0f9a5e701af8a68cfe4da8d3d59ca62dc7d3c629ae2730f1d0b3
MD5 add0fd2de30c777917a185764f52e141
SHA1 e114f378ba79bb7601ab9c955b9d4113197f31d4
SHA512 aadf1d2ec3a1433450d7de3e867617677d13c7b920cbc41fd0e6f042e929e190ad34d655b8351ed71c1ecb5c5212d1b8faf974ab117f662471f5269406ebcffa
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupfH2e2RUutMj2IB:A9iIxuERzA83h09RZxYfHYfmyY
MD5 SHA1 SHA512 SSDEEP

Submit Download