10309bc1dce60d2bf7c72de1f3338d8d98d437a5567421c534aa8056b23bf410

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3b95556ae2a9963899719b47493695c_JaffaCakes118.html
Size 70KB
Sample240613-ebtgrstbjg
SHA256 10309bc1dce60d2bf7c72de1f3338d8d98d437a5567421c534aa8056b23bf410
MD5 a3b95556ae2a9963899719b47493695c
SHA1 c362ee2e8f6b91a3575f165fa07f615c698e8124
SHA512 90160d006880fde530af0a22dc0e37e389bc4866ab85e6a37c4eff3d0e61f1b88859cc9445af4b0e05af2b6b547caa35b56d5286d2f3b35f22f087e3e90429d1
SSDEEP 768:JiQgcMWR3sI2PDDnd0g6ciIB/8oT2e1wCZkoTyMdtbBnfBgN8/lboiGhcRfQFVGQ:Jm1TTNen0tbrga90hc+NnhVJ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1908	msedge.exe
1908	msedge.exe
1220	msedge.exe
1220	msedge.exe
5108	identity_helper.exe
5108	identity_helper.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 1264	1220	msedge.exe	81
PID 1220 wrote to memory of 1264	1220	msedge.exe	81
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 400	1220	msedge.exe	82
PID 1220 wrote to memory of 1908	1220	msedge.exe	83
PID 1220 wrote to memory of 1908	1220	msedge.exe	83
PID 1220 wrote to memory of 2872	1220	msedge.exe	84
PID 1220 wrote to memory of 2872	1220	msedge.exe	84
PID 1220 wrote to memory of 2872	1220	msedge.exe	84
PID 1220 wrote to memory of 2872	1220	msedge.exe	84
PID 1220 wrote to memory of 2872	1220	msedge.exe	84
PID 1220 wrote to memory of 2872	1220	msedge.exe	84
PID 1220 wrote to memory of 2872	1220	msedge.exe	84
PID 1220 wrote to memory of 2872	1220	msedge.exe	84
PID 1220 wrote to memory of 2872	1220	msedge.exe	84
PID 1220 wrote to memory of 2872	1220	msedge.exe	84
PID 1220 wrote to memory of 2872	1220	msedge.exe	84
PID 1220 wrote to memory of 2872	1220	msedge.exe	84
PID 1220 wrote to memory of 2872	1220	msedge.exe	84
PID 1220 wrote to memory of 2872	1220	msedge.exe	84
PID 1220 wrote to memory of 2872	1220	msedge.exe	84
PID 1220 wrote to memory of 2872	1220	msedge.exe	84
PID 1220 wrote to memory of 2872	1220	msedge.exe	84
PID 1220 wrote to memory of 2872	1220	msedge.exe	84
PID 1220 wrote to memory of 2872	1220	msedge.exe	84
PID 1220 wrote to memory of 2872	1220	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3b95556ae2a9963899719b47493695c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff93d6e46f8,0x7ff93d6e4708,0x7ff93d6e4718
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,13959483471217092810,15658352563907443450,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,13959483471217092810,15658352563907443450,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,13959483471217092810,15658352563907443450,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,13959483471217092810,15658352563907443450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,13959483471217092810,15658352563907443450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,13959483471217092810,15658352563907443450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,13959483471217092810,15658352563907443450,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,13959483471217092810,15658352563907443450,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,13959483471217092810,15658352563907443450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,13959483471217092810,15658352563907443450,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,13959483471217092810,15658352563907443450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,13959483471217092810,15658352563907443450,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,13959483471217092810,15658352563907443450,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5588 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
MD5 dabfafd78687947a9de64dd5b776d25f
SHA1 16084c74980dbad713f9d332091985808b436dea
SHA512 dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
MD5 c39b3aa574c0c938c80eb263bb450311
SHA1 f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA512 eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 c27db29354ce48edb9d7dd34f793ed63b6163bd076d03e2d2de91bf75c5f0fd3
MD5 0458cada9949e6d0a1cf4ffee87ed283
SHA1 25247f9342d73e9b227c4c80bfaa1531b4594b36
SHA512 80449d4995c969c9771de8e00c43a6b547d7c5f3ebc73b08cbdc2c84723ebb7df83e01d88b5a841b5008db6b29f3227db3025daa585531894c4bf1bc96a98ed4
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 401B
SHA256 a31786fc60cc6548e9418ce01bc535ca51149ede1a36f1b0a79936a87868e7e5
MD5 62085e5e3567e48499a129495ff9c36d
SHA1 6b6159ce721cc42692eefd02a8140ddd71dc7d14
SHA512 9e7a8e00e11011c531fef079d9d292f2237540925e7796055ca22383b2881a971b659ad737f4a1dbbd44e0db1f9a46f6d16211b374078b567d3ba6e7eb4f7cee
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 21fd67f7febc715a21a79a8be4b2ae431ff386f74268057d0a012d02b08664d5
MD5 4bb3c5727e4190d380584c964b53c36d
SHA1 ecc85581395325bf1852c3e4e8da087eb5224340
SHA512 5a2e4f76946e60c0155e4c43c0fa0626295c95f742588a3daf07b1d8b9f8b3588828b580b3ef17658c8c04f6b4ab11f7a85fd4508ace9aeb20ef222ac9cd84a2
SSDEEP 96:n9kjoxm/DQYmq11FsGmwpvWMoiVmdeH1DfhUWQyV+VDCziEwb:n9kFIeIGmGWMX5hro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 497b0375a6925295b57a3c573f788f1650ae5a5f17f6691e0d7bce64b8b7a9a3
MD5 e87b79c14f884368193de6f37378f071
SHA1 74c7a0afa1823f8270bb0d63c67b90b0bfb81995
SHA512 1cf759cc936bb3ef8697a2db0e697160f4957a4e6f37121255347c96dd031925e3b8efb698f01bb39f4276d9b80e44653c87f7aabaa98bd2df2e8eac3041b519
SSDEEP 96:n9kVoxm/Dnmq11Fs2mwpvWMoiVmdeh21DfhUWQyV+VD7AiEwb:n9kf6eI2mGWMx25hrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 d5756506076216965a7c56366d72a82b2f80b8b29a87fe766d8c9c17300402e5
MD5 7fc9ffbf5bfdb006c5cdd3b3084513f5
SHA1 62d3c97b3ba58fcf25ce0fea8ffe782a6bc123f7
SHA512 60513898c635c5c75d9b45dc6658fa6c6f6eeb90321261669b88cfd136a323df62ab3fbf1e6cd150e81506026cf4af76c92029f3f2a4a18cbac5fcef2ad1f5e1
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup6Qe2RUvSRsTL3z2OMDCRHf:A9iIxuERzA83h09RZxYbRGTLaOMWRHq4
MD5 SHA1 SHA512 SSDEEP

Submit Download