80f535411d40b66205823a926b870734005f5eb08a3dd12c7c0094ed0d1a8af3

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

892dbbff823cfd4f3a97f852410e3f3a_JaffaCakes118.html
Size

27KB
MD5

892dbbff823cfd4f3a97f852410e3f3a
SHA1

7ddf7c7024e14b00ba5b46009792deb0153d8b6d
SHA256

80f535411d40b66205823a926b870734005f5eb08a3dd12c7c0094ed0d1a8af3
SHA512

587182f55d3143bcf3b7f74138f94506590f8fbd7ca517137ed2b181f0a1d26cb1cccd9ada2316b9e59208c1789e07e132312670129ce90195919e610bb24b77
SSDEEP

768:ShyJ7yR7qChieQQyNX0R+e3ZyStceZsvU:ShX7qCUeQQyNX0R+e3ZyStceZsvU

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
3840	msedge.exe
3840	msedge.exe
4692	identity_helper.exe
4692	identity_helper.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 4708	3840	msedge.exe	84
PID 3840 wrote to memory of 4708	3840	msedge.exe	84
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4912	3840	msedge.exe	85
PID 3840 wrote to memory of 4980	3840	msedge.exe	86
PID 3840 wrote to memory of 4980	3840	msedge.exe	86
PID 3840 wrote to memory of 5012	3840	msedge.exe	87
PID 3840 wrote to memory of 5012	3840	msedge.exe	87
PID 3840 wrote to memory of 5012	3840	msedge.exe	87
PID 3840 wrote to memory of 5012	3840	msedge.exe	87
PID 3840 wrote to memory of 5012	3840	msedge.exe	87
PID 3840 wrote to memory of 5012	3840	msedge.exe	87
PID 3840 wrote to memory of 5012	3840	msedge.exe	87
PID 3840 wrote to memory of 5012	3840	msedge.exe	87
PID 3840 wrote to memory of 5012	3840	msedge.exe	87
PID 3840 wrote to memory of 5012	3840	msedge.exe	87
PID 3840 wrote to memory of 5012	3840	msedge.exe	87
PID 3840 wrote to memory of 5012	3840	msedge.exe	87
PID 3840 wrote to memory of 5012	3840	msedge.exe	87
PID 3840 wrote to memory of 5012	3840	msedge.exe	87
PID 3840 wrote to memory of 5012	3840	msedge.exe	87
PID 3840 wrote to memory of 5012	3840	msedge.exe	87
PID 3840 wrote to memory of 5012	3840	msedge.exe	87
PID 3840 wrote to memory of 5012	3840	msedge.exe	87
PID 3840 wrote to memory of 5012	3840	msedge.exe	87
PID 3840 wrote to memory of 5012	3840	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\892dbbff823cfd4f3a97f852410e3f3a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc0da46f8,0x7ffcc0da4708,0x7ffcc0da4718
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,7214638535239452426,5856966490827525015,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,7214638535239452426,5856966490827525015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,7214638535239452426,5856966490827525015,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7214638535239452426,5856966490827525015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7214638535239452426,5856966490827525015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,7214638535239452426,5856966490827525015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4192 /prefetch:8
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,7214638535239452426,5856966490827525015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7214638535239452426,5856966490827525015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7214638535239452426,5856966490827525015,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7214638535239452426,5856966490827525015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7214638535239452426,5856966490827525015,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,7214638535239452426,5856966490827525015,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2772 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
475B

MD5
3ea6945bb26d069af94a7db5d2224536

SHA1
a58bb551a5d7c4df93e4277e12d81fd99a74b094

SHA256
275d6bc1677d3c2c75a2dece8ee7fec267bcd244c470b4dcd82738ba25003271

SHA512
29f00f724cc4abfb67500d84064fa5ce91dca3859adcc1c562db22e8f2761db3c88c701cbd00cbf5f5f536c5e4b59a61cac78943690bccc05a1871d8e285805a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
75343f992a321e81d2e33153766edebe

SHA1
9bb7acb4cb1230d0049d93fb67bb0fe9b3fcb5b5

SHA256
47d4c8f3cbcd07814cb4c32d0dce22eba51b338d234645760e443f6c98d4a18b

SHA512
35c256e3dccaa168993cac96cc398ab7a27f334441d19e372326b84c4a320ddedd8ad3d8c4eac39c80cb8416fe3cac5c09283e16b32015a94ea3e4985fa732c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
83bb91ca55b407b934fed96dde9cb422

SHA1
3a3ecbc46523e96169f28306665254f6031b9118

SHA256
0c4b715b8c1a810527b81b536772bb6151de43c297d064dd0033143d3ea2f19c

SHA512
5cf80fc3e8663b7112571d27757821bb19b7ecd486f7a7f7300d20bd22232a8f5321320fd0f738604583495147bcf20934dbcd389bbf7191ed58e3a093f1d0fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6f2be1998d0e534e87ca76346aaccb98

SHA1
b5006ba0bedcace172e7d03e4aa58d2d6125f871

SHA256
66004167e5e70a0828bf5fe25c12d604b902ef7ef38491f0922f0bf11b585ccb

SHA512
5594795e1a6482cfa03060d9518326bceb532e7f7955b36eed7276a73d8b8dc4ba47dcf26c0daac68c5768be68b3135f837db02f77529ac9148e6c9f1701668c

Download Submit