5b038e435434c82be0a8d54dc95a742ac09ef5683d91a45aa3e4cf212eb75979

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91abc15f87cbd808ee17b21098b030ab_JaffaCakes118.html
Size 292B
Sample240603-nyscnadd51
SHA256 5b038e435434c82be0a8d54dc95a742ac09ef5683d91a45aa3e4cf212eb75979
MD5 91abc15f87cbd808ee17b21098b030ab
SHA1 06ae5d9ce390170a76bc935640ff8f06dcf267f4
SHA512 4db094c2b302ebfb47473e18f26b2bde695530aca9804d3739fa9eb0b1ec3bc9c287b3bf93dd3b170541f39734943c5bcc3363e68c6bcf46a07d36c6abbc38a8
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2648	msedge.exe
2648	msedge.exe
692	msedge.exe
692	msedge.exe
3984	identity_helper.exe
3984	identity_helper.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 692 wrote to memory of 3548	692	msedge.exe	82
PID 692 wrote to memory of 3548	692	msedge.exe	82
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 4800	692	msedge.exe	83
PID 692 wrote to memory of 2648	692	msedge.exe	84
PID 692 wrote to memory of 2648	692	msedge.exe	84
PID 692 wrote to memory of 444	692	msedge.exe	85
PID 692 wrote to memory of 444	692	msedge.exe	85
PID 692 wrote to memory of 444	692	msedge.exe	85
PID 692 wrote to memory of 444	692	msedge.exe	85
PID 692 wrote to memory of 444	692	msedge.exe	85
PID 692 wrote to memory of 444	692	msedge.exe	85
PID 692 wrote to memory of 444	692	msedge.exe	85
PID 692 wrote to memory of 444	692	msedge.exe	85
PID 692 wrote to memory of 444	692	msedge.exe	85
PID 692 wrote to memory of 444	692	msedge.exe	85
PID 692 wrote to memory of 444	692	msedge.exe	85
PID 692 wrote to memory of 444	692	msedge.exe	85
PID 692 wrote to memory of 444	692	msedge.exe	85
PID 692 wrote to memory of 444	692	msedge.exe	85
PID 692 wrote to memory of 444	692	msedge.exe	85
PID 692 wrote to memory of 444	692	msedge.exe	85
PID 692 wrote to memory of 444	692	msedge.exe	85
PID 692 wrote to memory of 444	692	msedge.exe	85
PID 692 wrote to memory of 444	692	msedge.exe	85
PID 692 wrote to memory of 444	692	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91abc15f87cbd808ee17b21098b030ab_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff968ca46f8,0x7ff968ca4708,0x7ff968ca4718
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,848435648259111346,5448611970046380181,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,848435648259111346,5448611970046380181,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,848435648259111346,5448611970046380181,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,848435648259111346,5448611970046380181,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,848435648259111346,5448611970046380181,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,848435648259111346,5448611970046380181,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,848435648259111346,5448611970046380181,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,848435648259111346,5448611970046380181,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,848435648259111346,5448611970046380181,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,848435648259111346,5448611970046380181,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,848435648259111346,5448611970046380181,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,848435648259111346,5448611970046380181,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,848435648259111346,5448611970046380181,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3608 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
MD5 4f7152bc5a1a715ef481e37d1c791959
SHA1 c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA512 2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
MD5 ea98e583ad99df195d29aa066204ab56
SHA1 f89398664af0179641aa0138b337097b617cb2db
SHA512 e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 b3c448061a1f32de98622e1a92bae34abbaa3b2e65f311bcb19aa44465e83fc8
MD5 ed0470e030d96fa87704bff8fd85f98e
SHA1 8d77d1c7c4184545092cc73416e0a9ddad85d972
SHA512 628017948c51fd3c7c9833d09e8441576ae8ca38fc7aecebc628d2b2f551fa82c9ef60e72d8ff23199b8cb956fb67a9ab81d4e8c415bf855f714938df24ef69b
SSDEEP 96:nTks11gIH3XwpvWMoiVmdeHp1kVejUWQyV+VDCziEwb:nTkEyIXXGWMXp4ejro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 7f420c519ccf9752233372ba5514e94022b8457ac7fe8c3678fb70714859b0d6
MD5 14da0b5d856752919285486eaee9eb4b
SHA1 d9c9fb0f62c94bf51b838875bdc25f5640fb4688
SHA512 a054c8694be1d424b80580a53e356f29a086577ff2e3088c9d4cf82069c35e5c960f3913b035df407da56d66d7ec60d1bd5c507ac85c7df0439744a95c082a64
SSDEEP 96:nTkX11gIH3XwpvWMoiVmdeHp1kVejUWQyV+VD7AiEwb:nTklyIXXGWMXp4ejrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

a4097a54-d06f-44d6-a4bd-2ffad34b076d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a4097a54-d06f-44d6-a4bd-2ffad34b076d.tmp
Size 10KB
SHA256 a79045fccc752e2b45bbbd26a26600a1b6ce98599712a43051979a84263e3b1b
MD5 e9c01569ccd5c48003cb0c63d6fbeefc
SHA1 510f65b37be40a997cc7ceefb34d553b99495515
SHA512 9e26e557e7eb6e363960ed67510e1befab950438bc1b1f5d2506894c42b8baf90bd3c1c1e4cbf608450b15d7069e6c1630954bb2dbd9d26c70505091e3b409cd
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupZ7ge2RUJUj/o50L3z2OMDq:A9iIxuERzA83h09RZxYZScUjw0LaOMWR
MD5 SHA1 SHA512 SSDEEP

Submit Download