620696fb6058bbb91e46178ff684648b53c9193a4c5dc6b3f532578d6d9dc7ea

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
54e265f3ba80dd362f03132bab050054_JaffaCakes118.html
Size 53KB
Sample241018-ch78dstbnp
SHA256 620696fb6058bbb91e46178ff684648b53c9193a4c5dc6b3f532578d6d9dc7ea
MD5 54e265f3ba80dd362f03132bab050054
SHA1 d8bc458440e7c7c0c7fa25cf71bda85f7010fb3d
SHA512 99c3eb5e40ff10d96bf70790d8e7e19cc90cddd213dfae31c17617d5cd1a9e6296adc5f04f8ff63e3b899a2e9c1942d4917ba3160729fe3536997d0ab10d572e
SSDEEP 1536:CkgUiIakTqGivi+PyUUrunlYr63Nj+q5VyvR0w2AzTICbbio8/t9M/dNwIUTDmDo:CkgUiIakTqGivi+PyUUrunlYr63Nj+qB
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2224	msedge.exe
2224	msedge.exe
2580	msedge.exe
2580	msedge.exe
2948	identity_helper.exe
2948	identity_helper.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 4468	2580	msedge.exe	84
PID 2580 wrote to memory of 4468	2580	msedge.exe	84
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 1936	2580	msedge.exe	85
PID 2580 wrote to memory of 2224	2580	msedge.exe	86
PID 2580 wrote to memory of 2224	2580	msedge.exe	86
PID 2580 wrote to memory of 3980	2580	msedge.exe	87
PID 2580 wrote to memory of 3980	2580	msedge.exe	87
PID 2580 wrote to memory of 3980	2580	msedge.exe	87
PID 2580 wrote to memory of 3980	2580	msedge.exe	87
PID 2580 wrote to memory of 3980	2580	msedge.exe	87
PID 2580 wrote to memory of 3980	2580	msedge.exe	87
PID 2580 wrote to memory of 3980	2580	msedge.exe	87
PID 2580 wrote to memory of 3980	2580	msedge.exe	87
PID 2580 wrote to memory of 3980	2580	msedge.exe	87
PID 2580 wrote to memory of 3980	2580	msedge.exe	87
PID 2580 wrote to memory of 3980	2580	msedge.exe	87
PID 2580 wrote to memory of 3980	2580	msedge.exe	87
PID 2580 wrote to memory of 3980	2580	msedge.exe	87
PID 2580 wrote to memory of 3980	2580	msedge.exe	87
PID 2580 wrote to memory of 3980	2580	msedge.exe	87
PID 2580 wrote to memory of 3980	2580	msedge.exe	87
PID 2580 wrote to memory of 3980	2580	msedge.exe	87
PID 2580 wrote to memory of 3980	2580	msedge.exe	87
PID 2580 wrote to memory of 3980	2580	msedge.exe	87
PID 2580 wrote to memory of 3980	2580	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\54e265f3ba80dd362f03132bab050054_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e4f646f8,0x7ff9e4f64708,0x7ff9e4f64718
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,16276965320918875033,7951875996341293214,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,16276965320918875033,7951875996341293214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,16276965320918875033,7951875996341293214,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16276965320918875033,7951875996341293214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16276965320918875033,7951875996341293214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16276965320918875033,7951875996341293214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,16276965320918875033,7951875996341293214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,16276965320918875033,7951875996341293214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16276965320918875033,7951875996341293214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16276965320918875033,7951875996341293214,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16276965320918875033,7951875996341293214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16276965320918875033,7951875996341293214,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,16276965320918875033,7951875996341293214,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4996 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea
MD5 fab8d8d865e33fe195732aa7dcb91c30
SHA1 2637e832f38acc70af3e511f5eba80fbd7461f2c
SHA512 39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6
MD5 36988ca14952e1848e81a959880ea217
SHA1 a0482ef725657760502c2d1a5abe0bb37aebaadb
SHA512 d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 bfcf344ba6efa3a7d1acc83cd23d5d4781ac6b750df569759f99e7dbe56f7aab
MD5 c394b8424be9cd77fd3bb029fe8695db
SHA1 9df78bcc43bb1825fd4ee0114be9877b429d8e89
SHA512 f1246407bf7fdd049fd3cdac6e60abb9b03309550b071115d19bc5c8c1e8dbb0b8b8fdc7b339e9fee0adc5660e8ed2617853e4d580dee7bdb3a7e74f6b6f866f
SSDEEP 96:nSkip1KwmSwpvWMoiVmdeHBjsXUWQyV+VDCziEwb:nSkm0wtGWMXBaro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 39e51cc4fcfef511afa431aa9f028ac10884b276c6131d0d5d288c6498637129
MD5 0eb228e98f6909e205fe36143e9435d8
SHA1 0ee4b1f023073d84788300ca46bb8accc46a1937
SHA512 8c352483d2af45c9cc2051ba777fb9ecacdf4796f6f1b7f67a0ab864380e54867d00227a83dc42ca57fcbbf0c83604e29e3e13e3b0b2e73e622946a0a257d885
SSDEEP 96:nSkMp1KwySwpvWMoiVmdeb2BjsXUWQyV+VD7AiEwb:nSkU0wpGWMr2Barg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ce152952a7efef93d08bd58712139fd70bcc375895bcd40da09445df13ca7bc3
MD5 1289ca503b793181704ddd754e68df88
SHA1 e1d37b402b86e30ff346227c76b4a747af717c2d
SHA512 c10aa99f7689623bf3fcc998ebe125c6cb02860b6f3ee97230dbe8d41814fccbb4fff96e37c15f6ce2eb2817c84e88fc7b289c91c175ce9165c96808cbd220b2
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup3e2RUFchG1K3wNnuu:A9iIxuERzA83h09RZxY/fWKkuu
MD5 SHA1 SHA512 SSDEEP

Submit Download