532c6c34a6a64b628839db32172e64c03e2940a9b88049cf09bfefc9e21b3256

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 17:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70921ee0f79fc88a131dff430f80a43f_JaffaCakes118.html
Size

120KB
MD5

70921ee0f79fc88a131dff430f80a43f
SHA1

8a861ad466bd9150721318406b6255d3b0f45a8c
SHA256

532c6c34a6a64b628839db32172e64c03e2940a9b88049cf09bfefc9e21b3256
SHA512

8f65ede0ade7922fcd8c4e8f357c95c1178c858c1cebd1c3b4421bc004bce22d21c355fe5c2580c75276b43138fc7cc13a341941d6db332918e2a71d35121cc1
SSDEEP

768:Kx/HMSpWWSYCvt9vJj5BAwG7QQfgXvUzXk9xO3RFE0fsCB8cR4XidnxL4o2B3bi8:KB/WfPkZS5xOwC72kGxWaVzjB02

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2872	msedge.exe
2872	msedge.exe
4820	msedge.exe
4820	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 464	4820	msedge.exe	84
PID 4820 wrote to memory of 464	4820	msedge.exe	84
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 724	4820	msedge.exe	85
PID 4820 wrote to memory of 2872	4820	msedge.exe	86
PID 4820 wrote to memory of 2872	4820	msedge.exe	86
PID 4820 wrote to memory of 932	4820	msedge.exe	87
PID 4820 wrote to memory of 932	4820	msedge.exe	87
PID 4820 wrote to memory of 932	4820	msedge.exe	87
PID 4820 wrote to memory of 932	4820	msedge.exe	87
PID 4820 wrote to memory of 932	4820	msedge.exe	87
PID 4820 wrote to memory of 932	4820	msedge.exe	87
PID 4820 wrote to memory of 932	4820	msedge.exe	87
PID 4820 wrote to memory of 932	4820	msedge.exe	87
PID 4820 wrote to memory of 932	4820	msedge.exe	87
PID 4820 wrote to memory of 932	4820	msedge.exe	87
PID 4820 wrote to memory of 932	4820	msedge.exe	87
PID 4820 wrote to memory of 932	4820	msedge.exe	87
PID 4820 wrote to memory of 932	4820	msedge.exe	87
PID 4820 wrote to memory of 932	4820	msedge.exe	87
PID 4820 wrote to memory of 932	4820	msedge.exe	87
PID 4820 wrote to memory of 932	4820	msedge.exe	87
PID 4820 wrote to memory of 932	4820	msedge.exe	87
PID 4820 wrote to memory of 932	4820	msedge.exe	87
PID 4820 wrote to memory of 932	4820	msedge.exe	87
PID 4820 wrote to memory of 932	4820	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\70921ee0f79fc88a131dff430f80a43f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1d1946f8,0x7ffa1d194708,0x7ffa1d194718
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,10630487004325977204,6720473951138892946,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,10630487004325977204,6720473951138892946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,10630487004325977204,6720473951138892946,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10630487004325977204,6720473951138892946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10630487004325977204,6720473951138892946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10630487004325977204,6720473951138892946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10630487004325977204,6720473951138892946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10630487004325977204,6720473951138892946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,10630487004325977204,6720473951138892946,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1f9d180c0bcf71b48e7bc8302f85c28f

SHA1
ade94a8e51c446383dc0a45edf5aad5fa20edf3c

SHA256
a17d56c41d524453a78e3f06e0d0b0081e79d090a4b75d0b693ddbc39f6f7fdc

SHA512
282863df0e51288049587886ed37ad1cf5b6bfeed86454ea3b9f2bb7f0a1c591f3540c62712ebfcd6f1095e1977446dd5b13b904bb52b6d5c910a1efc208c785

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
60ead4145eb78b972baf6c6270ae6d72

SHA1
e71f4507bea5b518d9ee9fb2d523c5a11adea842

SHA256
b9e99e7387a915275e8fe4ac0b0c0cd330b4632814d5c9c446beb2755f1309a7

SHA512
8cdbafd2783048f5f54f22e13f6ef890936d5b986b0bb3fa86d2420a5bfecf7bedc56f46e6d5f126eae79f492315843c134c441084b912296e269f384a73ccde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b698b3bdd09278f84335baf8cb8e0e5b

SHA1
66630d2017cf4c8fd422c21d7045b27a310f4688

SHA256
ccda36963e927db074f9fb0731ea5e3240fd7455d007fae754b9a7e1cb03a6c1

SHA512
c2ad33fb77faa508d03b78b3be55b7281788d55129500624d4d3afa98ab9684a93a4edc5809bc9584ed9bd16dadd44579928f530caa931c8ef13091376cf53b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
003d7b8bda779552456c28cad43fb568

SHA1
42b346613a228bd39909cee30bbf8bcb2cf4c9f8

SHA256
ad7bb46255c62e8eca9ddcbc746b84b9ad7ba023968ecba8ef3d12dafd341601

SHA512
6da556e46d24a782cfa21d256c9d6ab4fcc2e580d58e9b7f999ca859bbb37ac3b9ea8ca0f57ecee2fd641d603db7835326d319fa89132bdba3b3f97e80a72ecc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
342bfbabcab7d500f558d18ffe835575

SHA1
7f24c5cdbb4b0d7a4d7e4431c39485c7d6a8dc69

SHA256
158f11293e24681d1a928caf4eaa2d473fc8bf6b9ebb05d86c6d9f63a075f00d

SHA512
fd5cb2bd9fa122d66268cc5b73fb435072f2cb6ceed032dd5fffd19bee9eb57680bbc4fe44368b2a8b91185190bc4b04117d22e5aed1bd022c367ad1cba4ac23

Download Submit