9b54b73c468771ab5be9959eade2a07501de7ccc6389ffded3ae7fcb02d50531

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26-07-2024 12:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

740709d40b585be140e7fbffcb8c94c8_JaffaCakes118.html
Size

140KB
MD5

740709d40b585be140e7fbffcb8c94c8
SHA1

0d62389bdd177417fcf5fe6939513fcb6f17defe
SHA256

9b54b73c468771ab5be9959eade2a07501de7ccc6389ffded3ae7fcb02d50531
SHA512

4dc8e946688088b64ed70389338ef0ea8289a9be6308eac4c367dc5e7b9e987d6391ef3a5472efe6e1c20084f6421345a04610a8231525f39d17233938f6d848
SSDEEP

1536:pbMjw2fMk1D3O9Pj2fcHPGHAkviLSugccZZAcuop:sJ9KLL4

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1452	msedge.exe
1452	msedge.exe
3564	msedge.exe
3564	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3564	msedge.exe
3564	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 5060	3564	msedge.exe	84
PID 3564 wrote to memory of 5060	3564	msedge.exe	84
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 3116	3564	msedge.exe	85
PID 3564 wrote to memory of 1452	3564	msedge.exe	86
PID 3564 wrote to memory of 1452	3564	msedge.exe	86
PID 3564 wrote to memory of 3224	3564	msedge.exe	87
PID 3564 wrote to memory of 3224	3564	msedge.exe	87
PID 3564 wrote to memory of 3224	3564	msedge.exe	87
PID 3564 wrote to memory of 3224	3564	msedge.exe	87
PID 3564 wrote to memory of 3224	3564	msedge.exe	87
PID 3564 wrote to memory of 3224	3564	msedge.exe	87
PID 3564 wrote to memory of 3224	3564	msedge.exe	87
PID 3564 wrote to memory of 3224	3564	msedge.exe	87
PID 3564 wrote to memory of 3224	3564	msedge.exe	87
PID 3564 wrote to memory of 3224	3564	msedge.exe	87
PID 3564 wrote to memory of 3224	3564	msedge.exe	87
PID 3564 wrote to memory of 3224	3564	msedge.exe	87
PID 3564 wrote to memory of 3224	3564	msedge.exe	87
PID 3564 wrote to memory of 3224	3564	msedge.exe	87
PID 3564 wrote to memory of 3224	3564	msedge.exe	87
PID 3564 wrote to memory of 3224	3564	msedge.exe	87
PID 3564 wrote to memory of 3224	3564	msedge.exe	87
PID 3564 wrote to memory of 3224	3564	msedge.exe	87
PID 3564 wrote to memory of 3224	3564	msedge.exe	87
PID 3564 wrote to memory of 3224	3564	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\740709d40b585be140e7fbffcb8c94c8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8791446f8,0x7ff879144708,0x7ff879144718
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17793340827374170237,11497310692845879197,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,17793340827374170237,11497310692845879197,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,17793340827374170237,11497310692845879197,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17793340827374170237,11497310692845879197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17793340827374170237,11497310692845879197,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17793340827374170237,11497310692845879197,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d8311bffda6ec1fa92df125543ef9de4

SHA1
7eb10864e0772dd763ea492563acbf80e5d76be3

SHA256
38af8f28ab348b89aa7b99a84dece42ae37000841f88e60aedd3aec4d31b3856

SHA512
ff3a6577ebd142e019a9fb65a6cb47842f57e797ce88352e66a827bc14f327eaf430a694ccd534f3670f867e89b665127881283adc6e892bfe86b2899a4c1328

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
87a77baecc74cef28514f648e79332ad

SHA1
648f7cebd9d19b5aa51f84a6835ca6bfec1c79fa

SHA256
e28560cfb8e381d3d51bc236ffad76affe8d2b40a8462949e5fb216b5cc6b3c6

SHA512
6a2bc943b3ef526076659964bfb2eb44938569f63a0fcec82b4bd863831a04ac8afea6ba36b693d070e0eeaf3d9d818d7368704d61591bd3b0db4292b6623cd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1425cf5cc8aa6f696188b4bca0e54a11

SHA1
60b48e3b3f2f5b34edb1dfe13acba41a076672ec

SHA256
b246357427023d45db6ec35fb9003b25fb6d447d5d60794d748f45d068f0fa58

SHA512
2d9eedd9aaae0313da05fc449a343585fb7d145f2fd0f5f0804e1bddc8466b799c068172f2552971a8470f163d822140d212e7eeb827dee4be6276616392a321

Download Submit