5c01a81f0da3f65e49ac191439bf76443a11af69131ce366e7f34bb258759d2f

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9267538d281d88abc033cc39c20b34cd_JaffaCakes118.html
Size 68KB
Sample240603-tpblfadb82
SHA256 5c01a81f0da3f65e49ac191439bf76443a11af69131ce366e7f34bb258759d2f
MD5 9267538d281d88abc033cc39c20b34cd
SHA1 ea54a67c0a39ea2893a8a8a4f1b69abcfa234375
SHA512 a7e2077534f4a4a6bf62d9ffe22bdfcd15b9a9f9cd97473a619c3353b1de2921813a958c4f580b66c484b106c3a355bc020525f3da7f0afca9b804a7f6d107e7
SSDEEP 768:JiUCOgcMsSZ8tN99OIs8aG5XGfGdoT2fQCZkoTnMdtbBnfBgN8/oygcRWQFVGysl:JNwWAGNGfG6T6Pec0tbrga6crNnz8PJ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
912	msedge.exe
912	msedge.exe
3476	identity_helper.exe
3476	identity_helper.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 544	912	msedge.exe	81
PID 912 wrote to memory of 544	912	msedge.exe	81
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 1436	912	msedge.exe	82
PID 912 wrote to memory of 4412	912	msedge.exe	83
PID 912 wrote to memory of 4412	912	msedge.exe	83
PID 912 wrote to memory of 4908	912	msedge.exe	84
PID 912 wrote to memory of 4908	912	msedge.exe	84
PID 912 wrote to memory of 4908	912	msedge.exe	84
PID 912 wrote to memory of 4908	912	msedge.exe	84
PID 912 wrote to memory of 4908	912	msedge.exe	84
PID 912 wrote to memory of 4908	912	msedge.exe	84
PID 912 wrote to memory of 4908	912	msedge.exe	84
PID 912 wrote to memory of 4908	912	msedge.exe	84
PID 912 wrote to memory of 4908	912	msedge.exe	84
PID 912 wrote to memory of 4908	912	msedge.exe	84
PID 912 wrote to memory of 4908	912	msedge.exe	84
PID 912 wrote to memory of 4908	912	msedge.exe	84
PID 912 wrote to memory of 4908	912	msedge.exe	84
PID 912 wrote to memory of 4908	912	msedge.exe	84
PID 912 wrote to memory of 4908	912	msedge.exe	84
PID 912 wrote to memory of 4908	912	msedge.exe	84
PID 912 wrote to memory of 4908	912	msedge.exe	84
PID 912 wrote to memory of 4908	912	msedge.exe	84
PID 912 wrote to memory of 4908	912	msedge.exe	84
PID 912 wrote to memory of 4908	912	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9267538d281d88abc033cc39c20b34cd_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd5e2e46f8,0x7ffd5e2e4708,0x7ffd5e2e4718
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,1152070944759544273,9165735628164852763,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,1152070944759544273,9165735628164852763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,1152070944759544273,9165735628164852763,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1152070944759544273,9165735628164852763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2808 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1152070944759544273,9165735628164852763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1152070944759544273,9165735628164852763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,1152070944759544273,9165735628164852763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,1152070944759544273,9165735628164852763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1152070944759544273,9165735628164852763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1152070944759544273,9165735628164852763,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1152070944759544273,9165735628164852763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1152070944759544273,9165735628164852763,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,1152070944759544273,9165735628164852763,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
MD5 2daa93382bba07cbc40af372d30ec576
SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
MD5 ecdc2754d7d2ae862272153aa9b9ca6e
SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 2d31a3825cebbf699920666894ce90d2610db8b5ec87b26c0aa24d5b0da8c707
MD5 9b0678bb0398f4bc39aa3c8fbc04eb60
SHA1 598aadb789fe6e8e0610fe9d467d1b5aaa43f46b
SHA512 2f42a3c49d0c2445891797ae85e7003aeb9f9179ccb0cb7351a105732dbffe568f4e2b1c6785c321f7d9350b633ad9e8ec804b157005ed8f64aefef34dff7f4e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 409B
SHA256 3cb3a97f2a15c9e323204a62da6855b27d3cadc246e647a90232405be2686205
MD5 44b217fc80e1797ab2a20acb51ae5769
SHA1 f06834a0ea4c81d28ff6233c677bd6d7ca8d93c6
SHA512 90de13748df2e30199e38f69ed469fa05093ade8d85edf4bedb6b01bb21e08d47ad599991ef0ccf9bc110fdb4f4648b23dc636ae437b30478ad4e8578e3cece0
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 27e3be5d8024634ca56348557b83eaf9be6de14441df5615bf6ef3bab1872477
MD5 acdf90488601dd99416ccf585c998b12
SHA1 8e72f7bc390eb2b99c6ba947c32eeeafc42faf8c
SHA512 5d1b4c95d3ed3a2c9a313b3d12ab1b24fe968d75e95671e87d8efebec2b73287402701fa921852e6f805cb9f82264b6d0a18c452c93501620462ff634b65eac2
SSDEEP 96:nWkM61373wpvWMoiVmdeHplwtqacLlUWQyV+VDCziEwb:nWkDpjGWMXpvXpro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5d8503593b6250482cc346b837f9dee383d6e1fffdd0e5ac4461d281aeeb556f
MD5 1811ec0e9665b1fb003256067561b0aa
SHA1 9a28b5b5b1050bacf487e00eced17cdec63adcf5
SHA512 056a4bf1d020f1bbbca8c492debe438998ea4284359e0a85f71b1d6f4d6b00e5ad80acd36f6ba45b06375c8c30170347cb60ebb38ab490e2c8a19079521240d2
SSDEEP 96:nWk361373wpvWMoiVmdev2plwtqacLlUWQyV+VD7AiEwb:nWkqpjGWM/2pvXprg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 615434f90d6a31106652e71c99c170ff7d106a5ccadd75b80be97d779e314f3d
MD5 d63e016f3f057456a1592c5faeec379c
SHA1 29f0e136e4ab294f578861cf5ba68971ebda9f38
SHA512 83c22a5d3d1ea81363a6a9f8eea2db6eac4d57034888b9771fb1a7bd517641310c6b13df32879f0be79277f147bb626d118255441f50c2a738a72a0eea04f438
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup3ae2RUP/2ZZ3z2OMDCRHqi:A9iIxuERzA83h09RZxYkKGZaOMWRHqlk
MD5 SHA1 SHA512 SSDEEP

Submit Download