43e0e956004efd7448ad26d1ad90b85342cdb837dafad5353a6548d172cf3d65

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 11:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
780db8ada0bc8d01a6039d8d17495398_JaffaCakes118.html
Size 11KB
Sample240727-nmf59azfrd
SHA256 43e0e956004efd7448ad26d1ad90b85342cdb837dafad5353a6548d172cf3d65
MD5 780db8ada0bc8d01a6039d8d17495398
SHA1 2f88f318edfc02cc6dc4d005282f468b12abbe79
SHA512 2febd3efe8ffb585c6635d8a4ddfc8c3c846af75492f41c886be03da490fd0b3e3ecf523439f74431bbdf691271e251eb0d4fb329dee4603f8ed51d02dca5dc9
SSDEEP 192:swVWeaVqYhUROwGpOkooqnqWTC9QnPtSAZ8DCULj0HtX+wIYJkc+AKjNzKaSPpP5:hoR8cqFTEQEJXQRyYec78NmFR5
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
764	msedge.exe
764	msedge.exe
372	msedge.exe
372	msedge.exe
2096	identity_helper.exe
2096	identity_helper.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 372 wrote to memory of 4060	372	msedge.exe	84
PID 372 wrote to memory of 4060	372	msedge.exe	84
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 2928	372	msedge.exe	85
PID 372 wrote to memory of 764	372	msedge.exe	86
PID 372 wrote to memory of 764	372	msedge.exe	86
PID 372 wrote to memory of 2540	372	msedge.exe	87
PID 372 wrote to memory of 2540	372	msedge.exe	87
PID 372 wrote to memory of 2540	372	msedge.exe	87
PID 372 wrote to memory of 2540	372	msedge.exe	87
PID 372 wrote to memory of 2540	372	msedge.exe	87
PID 372 wrote to memory of 2540	372	msedge.exe	87
PID 372 wrote to memory of 2540	372	msedge.exe	87
PID 372 wrote to memory of 2540	372	msedge.exe	87
PID 372 wrote to memory of 2540	372	msedge.exe	87
PID 372 wrote to memory of 2540	372	msedge.exe	87
PID 372 wrote to memory of 2540	372	msedge.exe	87
PID 372 wrote to memory of 2540	372	msedge.exe	87
PID 372 wrote to memory of 2540	372	msedge.exe	87
PID 372 wrote to memory of 2540	372	msedge.exe	87
PID 372 wrote to memory of 2540	372	msedge.exe	87
PID 372 wrote to memory of 2540	372	msedge.exe	87
PID 372 wrote to memory of 2540	372	msedge.exe	87
PID 372 wrote to memory of 2540	372	msedge.exe	87
PID 372 wrote to memory of 2540	372	msedge.exe	87
PID 372 wrote to memory of 2540	372	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\780db8ada0bc8d01a6039d8d17495398_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff977db46f8,0x7ff977db4708,0x7ff977db4718
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,706697830547115575,9408125847510686955,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,706697830547115575,9408125847510686955,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,706697830547115575,9408125847510686955,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,706697830547115575,9408125847510686955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,706697830547115575,9408125847510686955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,706697830547115575,9408125847510686955,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,706697830547115575,9408125847510686955,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,706697830547115575,9408125847510686955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,706697830547115575,9408125847510686955,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,706697830547115575,9408125847510686955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,706697830547115575,9408125847510686955,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,706697830547115575,9408125847510686955,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4832 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f
MD5 75c9f57baeefeecd6c184627de951c1e
SHA1 52e0468e13cbfc9f15fc62cc27ce14367a996cff
SHA512 c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b
MD5 10fa19df148444a77ceec60cabd2ce21
SHA1 685b599c497668166ede4945d8885d204fd8d70f
SHA512 3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef
MD5 SHA1 SHA512

Submit Download

549b3c21-c63c-4c50-a090-a879b3664bb3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\549b3c21-c63c-4c50-a090-a879b3664bb3.tmp
Size 5KB
SHA256 f3d15b0bf8666b09e172cf143a534f57d9fbe80565b56c4814b3afa0f69194f1
MD5 d4176517e79776fc7b59d5b51e372e8e
SHA1 47e46cd40788943703c724043657cdc833686866
SHA512 3d809b44b77bacf0d8e97d072f58e8fdb83f126bd8c847da95bfa3c5d3044e935d7852aa00048a6ac2743a521fb72a2886e44ecddf077925bbaf82364d141880
SSDEEP 96:nXk491xjwpvWMoiVmdeHjsFKZPcVUWQyV+VDCziEwb:nXk0fjGWMXQwcVro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d419a62b073e35c4b69ff7fd4a0660a5ea242736b17a79b0c5c24fa290a060ec
MD5 6f5c91533dce2a22d2d834cd1a3b9250
SHA1 08ea946fa936c6ddf90319c353ba941dcf2a4ee4
SHA512 87a452b083bf719b75fa615e96d7c8712f436a64680721c2a1767e87312c22372b0af3a3c868ca93999a03299f1678924b273640e8aa98937fc10ecc66306c22
SSDEEP 96:nXkq91xjwpvWMoiVmdeHjsFKZPcVUWQyV+VD7AiEwb:nXkSfjGWMXQwcVrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 67852c427fe7d944ffe305051720b982f8d9e102538b0c321c7f64db884378fd
MD5 ac638ee45d45bbed2d5c944d35114f9c
SHA1 c904f79e95af88df0abb82dec9113a119c6faafb
SHA512 26711c830918b57486a61601221711d263e5ee266161eb8a05a6e18c9fad893ce5161f9a22e58ba52c39f6981ca75427860f147b68ab3b118b97412cadd31015
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuprET5lie2RUYH+9CpFXWx3F:A9iIxuERzA83h09RZxYglWggQ3HHF
MD5 SHA1 SHA512 SSDEEP

Submit Download