c276059294a1b805f81d0b57e3411c6b139d5db690d99343d693f512bf065a23

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2024, 10:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a14b96b7c322df21c9d8c1a3dc884d43_JaffaCakes118.html
Size 240KB
Sample241126-l3amasspgj
SHA256 c276059294a1b805f81d0b57e3411c6b139d5db690d99343d693f512bf065a23
MD5 a14b96b7c322df21c9d8c1a3dc884d43
SHA1 bec654d6620233dae8e09d3e82cbfad9b6c0335a
SHA512 ee8c192e07d766fea98e65979addc4e49561312f360a17cd1bf3191881a583d4b40a804c5bdbcd2fd51a569e19d9fce7f33a85676b31139fdcbc5163f2901088
SSDEEP 6144:Nhso+MyOUBdl4KBtXvIIreMStTPoop91xqC2RkhJV4c8pJC2KALt6Ph+1VWt4h9H:Eo+MyOUBdl4KBtXvIIreMStTAop91xqr
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2224	msedge.exe
2224	msedge.exe
2648	msedge.exe
2648	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 732	2648	msedge.exe	83
PID 2648 wrote to memory of 732	2648	msedge.exe	83
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 4508	2648	msedge.exe	84
PID 2648 wrote to memory of 2224	2648	msedge.exe	85
PID 2648 wrote to memory of 2224	2648	msedge.exe	85
PID 2648 wrote to memory of 1952	2648	msedge.exe	86
PID 2648 wrote to memory of 1952	2648	msedge.exe	86
PID 2648 wrote to memory of 1952	2648	msedge.exe	86
PID 2648 wrote to memory of 1952	2648	msedge.exe	86
PID 2648 wrote to memory of 1952	2648	msedge.exe	86
PID 2648 wrote to memory of 1952	2648	msedge.exe	86
PID 2648 wrote to memory of 1952	2648	msedge.exe	86
PID 2648 wrote to memory of 1952	2648	msedge.exe	86
PID 2648 wrote to memory of 1952	2648	msedge.exe	86
PID 2648 wrote to memory of 1952	2648	msedge.exe	86
PID 2648 wrote to memory of 1952	2648	msedge.exe	86
PID 2648 wrote to memory of 1952	2648	msedge.exe	86
PID 2648 wrote to memory of 1952	2648	msedge.exe	86
PID 2648 wrote to memory of 1952	2648	msedge.exe	86
PID 2648 wrote to memory of 1952	2648	msedge.exe	86
PID 2648 wrote to memory of 1952	2648	msedge.exe	86
PID 2648 wrote to memory of 1952	2648	msedge.exe	86
PID 2648 wrote to memory of 1952	2648	msedge.exe	86
PID 2648 wrote to memory of 1952	2648	msedge.exe	86
PID 2648 wrote to memory of 1952	2648	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\a14b96b7c322df21c9d8c1a3dc884d43_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf0f146f8,0x7ffbf0f14708,0x7ffbf0f14718
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,9967445338897976874,14705979862956720515,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,9967445338897976874,14705979862956720515,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,9967445338897976874,14705979862956720515,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9967445338897976874,14705979862956720515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9967445338897976874,14705979862956720515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9967445338897976874,14705979862956720515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,9967445338897976874,14705979862956720515,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2732 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031
MD5 d7cb450b1315c63b1d5d89d98ba22da5
SHA1 694005cd9e1a4c54e0b83d0598a8a0c089df1556
SHA512 df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8
MD5 37f660dd4b6ddf23bc37f5c823d1c33a
SHA1 1c35538aa307a3e09d15519df6ace99674ae428b
SHA512 807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 716B
SHA256 a7275edbad31755870f51f25498340aa7efbbeb256e77db7fdca85816cb4c63e
MD5 0989c2033be5f1ae03377afaa082bff3
SHA1 b68ed342ac6b388e16cd7a0e3e1d2bb84449274c
SHA512 242dab88b8d5772fd239c45d3b1a48f5d7c476ee3fa721d0c40357fbb82b4c2a2221bb229033ec3ff312f2089dab95d9d9bb744b68f5ba56618af2462c1ae397
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 b4857e33aff4895e870fcca303446931f7cb6930b9bfab0c25a713ca5006c47e
MD5 616b60fb3cfae19ab719759084675c37
SHA1 7f56a32a1680b25100105b333753b61d60b8d065
SHA512 7a40e34aa482ba3e969df3619258ed65e7d473e77fcff63ec9e63952df944ff5f3b3e0bf5215c2fbd5fee7d4af823256f03579c70150a11359c0613671de8298
SSDEEP 96:nCDkcSa1NJwpvWMoiVmdeHqZ71IhUWQyV+VDCziEwb:nYkQbJGWMX++ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f5e4b9951e7db12a7f66667e0aa0e20726eab059d6d812095945ecf061d340c5
MD5 3c50f639138859e188d3b6da9a17d96a
SHA1 9fb08b4f75abcbcf3728b2ae32f80df95a704194
SHA512 e72a93612e59147c9af8a23df964e70fb9370e931471d0cbb2b81c510c332b1f85619f4c505e8be76be35feced93f65a8048b9f636d984b490e110efc8e83886
SSDEEP 96:nCDknSa1NJwpvWMoiVmdeMuO8rc2YpY2qZ71IhUWQyV+VDCAiEwb:nYkhbJGWM8t+D4Y2++rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 6c664a7f47a559ee07a6aa180d8c5dacce091b545eb9f4c5e747124076f43e20
MD5 a6e084a10ebfd468692fa8aa2600aafc
SHA1 259ce87533ba144a70eed53efd3c188a19a42c13
SHA512 9beb3f328c252795e102f001c74d0bd99fb4883d552d0220c476a4677afe94f7cdc39b099e2e5494a8340bfe02544a5ff8648a1c30a9c7b5c307e0a3e204010a
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupVWW+e2RU9eDSYYdF980JQT:A9iIxuERzA83h09RZxYVWnfmYYi0YMu
MD5 SHA1 SHA512 SSDEEP

Submit Download