4c8668ac4a477e3fda1c18e2b088107546f51e8f031ded0373d776c8aedcf951

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 17:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8b4d8da714faad1daea223fc217837a2_JaffaCakes118.html
Size

51KB
MD5

8b4d8da714faad1daea223fc217837a2
SHA1

30478f3a5aee4ab4f2e35d5e119db1d3c6c4ec78
SHA256

4c8668ac4a477e3fda1c18e2b088107546f51e8f031ded0373d776c8aedcf951
SHA512

ed4bea89ae040242a3a0a74b57b6df86eb409972f884239396ad80b0ed27bb3cbc65e5d573df59d61cf9f34f450387373a4482bb3dbaae5a3e311b0229b0479a
SSDEEP

1536:SZY7hotdcx0YpEdhFRKX5/Y/IQ/1/1/1/1/P/1/1/1/1/3kfFfTFa:SZY7hvyIqppppnpppp3k9fg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
4408	msedge.exe
4408	msedge.exe
3984	identity_helper.exe
3984	identity_helper.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 3244	4408	msedge.exe	84
PID 4408 wrote to memory of 3244	4408	msedge.exe	84
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3640	4408	msedge.exe	85
PID 4408 wrote to memory of 3152	4408	msedge.exe	86
PID 4408 wrote to memory of 3152	4408	msedge.exe	86
PID 4408 wrote to memory of 4344	4408	msedge.exe	87
PID 4408 wrote to memory of 4344	4408	msedge.exe	87
PID 4408 wrote to memory of 4344	4408	msedge.exe	87
PID 4408 wrote to memory of 4344	4408	msedge.exe	87
PID 4408 wrote to memory of 4344	4408	msedge.exe	87
PID 4408 wrote to memory of 4344	4408	msedge.exe	87
PID 4408 wrote to memory of 4344	4408	msedge.exe	87
PID 4408 wrote to memory of 4344	4408	msedge.exe	87
PID 4408 wrote to memory of 4344	4408	msedge.exe	87
PID 4408 wrote to memory of 4344	4408	msedge.exe	87
PID 4408 wrote to memory of 4344	4408	msedge.exe	87
PID 4408 wrote to memory of 4344	4408	msedge.exe	87
PID 4408 wrote to memory of 4344	4408	msedge.exe	87
PID 4408 wrote to memory of 4344	4408	msedge.exe	87
PID 4408 wrote to memory of 4344	4408	msedge.exe	87
PID 4408 wrote to memory of 4344	4408	msedge.exe	87
PID 4408 wrote to memory of 4344	4408	msedge.exe	87
PID 4408 wrote to memory of 4344	4408	msedge.exe	87
PID 4408 wrote to memory of 4344	4408	msedge.exe	87
PID 4408 wrote to memory of 4344	4408	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8b4d8da714faad1daea223fc217837a2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8540646f8,0x7ff854064708,0x7ff854064718
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,15460164277784315043,17463140565986825471,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,15460164277784315043,17463140565986825471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,15460164277784315043,17463140565986825471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,15460164277784315043,17463140565986825471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,15460164277784315043,17463140565986825471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,15460164277784315043,17463140565986825471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,15460164277784315043,17463140565986825471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,15460164277784315043,17463140565986825471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,15460164277784315043,17463140565986825471,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,15460164277784315043,17463140565986825471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,15460164277784315043,17463140565986825471,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,15460164277784315043,17463140565986825471,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3080 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
469B

MD5
fa3ba7ac07973627d0892e67428ce2fb

SHA1
f61bc1ea88e52baa91f01b5060b684c4d2262e6f

SHA256
b31d2ed68a215ac87afcb22e2e4813d35a72ea94706e481fa91477ef798064ea

SHA512
7b082c77aaae0c9e877d1a92b11dd8263b713e865aa61c3111457a773727e01c4aa812b6459d2897d3c134d5557828eba9edc6de5881ab974b743dc95bb10db1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
98db0bb7e04c0231666be1ed85cd388f

SHA1
c9edc978a66104b7ea4a21977425d2a2e2a22c67

SHA256
ebac57a7b0ca7306728c5327617ba10c454c7d8f714dcee5e9e98c2253e7f88a

SHA512
f7aa939dd13ae2fd11a893355e9c436fef0aa07599d93f14261f04a10b6c1b928ab2ae16137ff670c1cd66ba10822d6c20e7aa549c5a95dc5af1feaeec982de4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f96ff8d81ba90516bf547d2355b7b682

SHA1
05c022f4c2dbb5adc0beab7a4a0f9e9936797942

SHA256
381d1363de8c96049b4614abedc100909b73b6525c34ef9aa9712906c4d9db0f

SHA512
332155514259d7b100448249cf4dd65111fb0c25d1b06b1f8c0b9f57e267bdf1d684a9c51bffa0833402c57fd4eab20c9e58c515b5006caa37c2a1ce2438c9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fb9ce74c8aed91cb0b261188766bbf99

SHA1
e39b7e79da91e88722131efc5599c74ffd52735a

SHA256
acb436c890edf8f05fad4c16641d054d346414b66f231430f59a6915c5ec8122

SHA512
8b22f327fe3b989fe578c83606684e0b5ac9e30a78456599c03ad189b74ab6b5e370d2ff6cdf09c7f94562be0a19e7260177e122907c11ed13155cb7ed07b3c3

Download Submit