a57b812ca425e0b3eafb6b0932b4d55b638bceff8f03f6e87defee4f426d7f3d

Analysis

max time kernel
145s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2024, 23:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8237a66b3cb44b00088d641054e465ae_JaffaCakes118.html
Size

41KB
MD5

8237a66b3cb44b00088d641054e465ae
SHA1

3eadbd5ac037fddf4b94b86bee1309e2f5b67dbe
SHA256

a57b812ca425e0b3eafb6b0932b4d55b638bceff8f03f6e87defee4f426d7f3d
SHA512

d8ecefff5e237db6d57d7db75a44a740c60d1f9765aad44ade04e199bcbd8d793bc3c74bf09e96b7169ef128e54e5bc9f3c2dfa17ca0aa569d34a7611b804de6
SSDEEP

768:+GKaN+2+d2zPyKhIeFZ+r+kOOHDpkFLJP4vvyc0tHLBLqqw2TS8AzGYfh9UNTS0K:hjSd79UNTSrqi

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
748	msedge.exe
748	msedge.exe
4572	msedge.exe
4572	msedge.exe
3672	identity_helper.exe
3672	identity_helper.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 2360	4572	msedge.exe	82
PID 4572 wrote to memory of 2360	4572	msedge.exe	82
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 4608	4572	msedge.exe	84
PID 4572 wrote to memory of 748	4572	msedge.exe	85
PID 4572 wrote to memory of 748	4572	msedge.exe	85
PID 4572 wrote to memory of 4808	4572	msedge.exe	86
PID 4572 wrote to memory of 4808	4572	msedge.exe	86
PID 4572 wrote to memory of 4808	4572	msedge.exe	86
PID 4572 wrote to memory of 4808	4572	msedge.exe	86
PID 4572 wrote to memory of 4808	4572	msedge.exe	86
PID 4572 wrote to memory of 4808	4572	msedge.exe	86
PID 4572 wrote to memory of 4808	4572	msedge.exe	86
PID 4572 wrote to memory of 4808	4572	msedge.exe	86
PID 4572 wrote to memory of 4808	4572	msedge.exe	86
PID 4572 wrote to memory of 4808	4572	msedge.exe	86
PID 4572 wrote to memory of 4808	4572	msedge.exe	86
PID 4572 wrote to memory of 4808	4572	msedge.exe	86
PID 4572 wrote to memory of 4808	4572	msedge.exe	86
PID 4572 wrote to memory of 4808	4572	msedge.exe	86
PID 4572 wrote to memory of 4808	4572	msedge.exe	86
PID 4572 wrote to memory of 4808	4572	msedge.exe	86
PID 4572 wrote to memory of 4808	4572	msedge.exe	86
PID 4572 wrote to memory of 4808	4572	msedge.exe	86
PID 4572 wrote to memory of 4808	4572	msedge.exe	86
PID 4572 wrote to memory of 4808	4572	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8237a66b3cb44b00088d641054e465ae_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee61c46f8,0x7ffee61c4708,0x7ffee61c4718
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,1543287436043134652,15453962984278986402,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,1543287436043134652,15453962984278986402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,1543287436043134652,15453962984278986402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1543287436043134652,15453962984278986402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1543287436043134652,15453962984278986402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,1543287436043134652,15453962984278986402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,1543287436043134652,15453962984278986402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1543287436043134652,15453962984278986402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1543287436043134652,15453962984278986402,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1543287436043134652,15453962984278986402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1543287436043134652,15453962984278986402,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,1543287436043134652,15453962984278986402,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
94eddc8c760c6582645d582b4f107cca

SHA1
01860648fbebb62eadd53d3bc58471df3b8d211e

SHA256
710d6dcbe48115aecea88b0a8c0124f5ae5f30225e59dde1bdfcc4574b5e5933

SHA512
1cf9e561257755bbf563df4f348bba14ffbce2faa7cfb96738dd2aa4b166d1ddfee114578f8b84b4d7c59f3d18cadd9ebc5b45557116bf68c2eda0867d9e5484

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
71a22f9fe81453c6c788bfe09ab8fe0c

SHA1
f4ee9368e5795c5b3f9470e0434358170e7646b6

SHA256
ca6f5b89e7361282ace0d96bba28c2a4434ccecfd0a97d925e9bc61524efd908

SHA512
a36d9a0c814d4293ae70a62a76e8a98e712ad91674a26cb3d8ffd300e22a6cba134e501b4a7e742229a66005db3b508aa821abcab1347b05457f06c712a1d724

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3b00a56a8b25f17e1ce8c6bb767b8192

SHA1
25b1851690702791ee26e98224ec44fb65737466

SHA256
9b47af6560c62a4cb6ecb74f66a0452811711678b403a1023e8313a9f8200658

SHA512
66b98926b18e716bf022b4835507ee4685700db45fbdf7049ea853ab31246f34596d470f92a60dd611c5f655d6a6e286cde16c0de877d97e5d0625d795f1b258

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5b20a4a476db6be4dd6c3aa3b14a5c34

SHA1
45125774d6276b5bae616b003802c02a85caf30a

SHA256
85b27d5e8721e30a4e0a665eebd9858ab29d2f402f78a2aa64b4f89ccd65816e

SHA512
65a73c11ab7e295047989d79eb0565ed01a052962e0dc91d5b250fefa9912a2f2976f1578829a0bd7b02fdda46ce8cb20af519e85b8f177d6e38316f55aca805

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c911cccda14a265016cf65f109f91c7f

SHA1
eeb630352fa03e63dae49e0c68d53d3840ea8c2d

SHA256
31cd5215bfd17cc46d7e8edb13805d1595cbd3e63d94b41d5df43817bbf05a8f

SHA512
274ccb2fb9382ca17acf26852f6535bec71c4762dc9e5f08da8de6145aa08f9ac91d5bf022203126c6386d9fac64cde7dd0a371c63be1e8681ebca5a726ba56b

Download Submit