8040e286d0d21875eafd4168a7b55c7217b97295ed236884258b86ce04260832

Analysis

max time kernel
145s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-08-2024 06:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

896332f9f7c40ae10a53fbf7b95ae0e7_JaffaCakes118.html
Size

26KB
MD5

896332f9f7c40ae10a53fbf7b95ae0e7
SHA1

6c205f29c9f6599a7b81189ca759cbf77219d799
SHA256

8040e286d0d21875eafd4168a7b55c7217b97295ed236884258b86ce04260832
SHA512

f467fb28babe4b411e0a33dd67663bdf990a0e09d2aaaf14a1b49687af2ed7579a4594705ab2720fc72551932bb382166e7e7dbfe2793a4d3b5b5d488305f4fc
SSDEEP

192:Nb53Hb78YvIYb53Hb78YvIYb53Hb78YvIZPN0Gfxh2UU1qtv3pSpaYp4pnbpkp2P:x53H8mf53H8mf53H8mKZfQ5kZjgPtWTZ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4468	msedge.exe
4468	msedge.exe
612	msedge.exe
612	msedge.exe
2248	identity_helper.exe
2248	identity_helper.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe
612	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 612 wrote to memory of 4296	612	msedge.exe	84
PID 612 wrote to memory of 4296	612	msedge.exe	84
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 3792	612	msedge.exe	85
PID 612 wrote to memory of 4468	612	msedge.exe	86
PID 612 wrote to memory of 4468	612	msedge.exe	86
PID 612 wrote to memory of 372	612	msedge.exe	87
PID 612 wrote to memory of 372	612	msedge.exe	87
PID 612 wrote to memory of 372	612	msedge.exe	87
PID 612 wrote to memory of 372	612	msedge.exe	87
PID 612 wrote to memory of 372	612	msedge.exe	87
PID 612 wrote to memory of 372	612	msedge.exe	87
PID 612 wrote to memory of 372	612	msedge.exe	87
PID 612 wrote to memory of 372	612	msedge.exe	87
PID 612 wrote to memory of 372	612	msedge.exe	87
PID 612 wrote to memory of 372	612	msedge.exe	87
PID 612 wrote to memory of 372	612	msedge.exe	87
PID 612 wrote to memory of 372	612	msedge.exe	87
PID 612 wrote to memory of 372	612	msedge.exe	87
PID 612 wrote to memory of 372	612	msedge.exe	87
PID 612 wrote to memory of 372	612	msedge.exe	87
PID 612 wrote to memory of 372	612	msedge.exe	87
PID 612 wrote to memory of 372	612	msedge.exe	87
PID 612 wrote to memory of 372	612	msedge.exe	87
PID 612 wrote to memory of 372	612	msedge.exe	87
PID 612 wrote to memory of 372	612	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\896332f9f7c40ae10a53fbf7b95ae0e7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3c4146f8,0x7ffe3c414708,0x7ffe3c414718
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,7036719876867891785,5493762042189774553,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,7036719876867891785,5493762042189774553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,7036719876867891785,5493762042189774553,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,7036719876867891785,5493762042189774553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,7036719876867891785,5493762042189774553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,7036719876867891785,5493762042189774553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,7036719876867891785,5493762042189774553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,7036719876867891785,5493762042189774553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,7036719876867891785,5493762042189774553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,7036719876867891785,5493762042189774553,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,7036719876867891785,5493762042189774553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,7036719876867891785,5493762042189774553,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,7036719876867891785,5493762042189774553,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3152 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ed71363edc60722e6e80fedee1982276

SHA1
33689604d78d033d312668bbcc650d744500684e

SHA256
0b4048d9a2bd7c3086907d7d02baf1a9fb81120d10df3417bcd04c3694d59dfd

SHA512
705a60455c24a7023b8ed75a8fb989a6b38f366c50ff0580eba4f956e04b1469c179ab950c418dcd66b37dc2c021f32be5a4e01586a0c89efea3196ac46faa6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fb7635397ba2fdc266db7e89fa9bfab0

SHA1
37bb6307d75a33d7856536ae8c22f6df16ad9282

SHA256
63d95733368a5a3be9e8b408f7bf7bc34431055beb8afaba268020b4db000eda

SHA512
44f70a076576b555eb933ba1a5bb027e715e442a44cb58f687b02cf8448df2fc540843dea9318853e1746d91732b0f85a0641fdbdee6eb3f1fa066d044d585fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
583847b26cd8711f7ca4881e44327963

SHA1
975fba0115154a75e3be51afee002f0ff388b0b0

SHA256
5c98973f0ac66ef6c46f90635471cb43293896d389bbf4f9a6d44cee95a55bf8

SHA512
9c7edb7e3f21445ec30c430774b5c36324ff6506225ea53cf35fb647a387e2989bedba7fa947b5b674fb68cd013953767bd125d860b633bdab174ccfd16d4684

Download Submit