c0203c26d15fa3453d3b441661441b99c699aaf0c04c0fca864abe441f676086

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 16:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

96c747d1113294e76b2ee1103f6b94e8_JaffaCakes118.html
Size

271KB
MD5

96c747d1113294e76b2ee1103f6b94e8
SHA1

1bcb47f3bd271f89fb2707bd35511842916c94d5
SHA256

c0203c26d15fa3453d3b441661441b99c699aaf0c04c0fca864abe441f676086
SHA512

e6bfa1e981856166a9737a8223d2067847a86f64d0fe43da3601b00731fc4c8c4595842a8e8bdc7ae4fb5a5e5847564898e5b0dff05a8d6e0d6fe2af9f4830ab
SSDEEP

6144:zVGejtPUeUwIVGejtPUeUwM1iLZGDAMJJlzLA0ZLhq8gMPhJzyjgvqtLnyX8:zV5jtPUe3IV5jtPUe36iLZGDAMJJlzL0

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1164	msedge.exe
1164	msedge.exe
1316	msedge.exe
1316	msedge.exe
4820	identity_helper.exe
4820	identity_helper.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 3840	1316	msedge.exe	84
PID 1316 wrote to memory of 3840	1316	msedge.exe	84
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 2644	1316	msedge.exe	85
PID 1316 wrote to memory of 1164	1316	msedge.exe	86
PID 1316 wrote to memory of 1164	1316	msedge.exe	86
PID 1316 wrote to memory of 2640	1316	msedge.exe	87
PID 1316 wrote to memory of 2640	1316	msedge.exe	87
PID 1316 wrote to memory of 2640	1316	msedge.exe	87
PID 1316 wrote to memory of 2640	1316	msedge.exe	87
PID 1316 wrote to memory of 2640	1316	msedge.exe	87
PID 1316 wrote to memory of 2640	1316	msedge.exe	87
PID 1316 wrote to memory of 2640	1316	msedge.exe	87
PID 1316 wrote to memory of 2640	1316	msedge.exe	87
PID 1316 wrote to memory of 2640	1316	msedge.exe	87
PID 1316 wrote to memory of 2640	1316	msedge.exe	87
PID 1316 wrote to memory of 2640	1316	msedge.exe	87
PID 1316 wrote to memory of 2640	1316	msedge.exe	87
PID 1316 wrote to memory of 2640	1316	msedge.exe	87
PID 1316 wrote to memory of 2640	1316	msedge.exe	87
PID 1316 wrote to memory of 2640	1316	msedge.exe	87
PID 1316 wrote to memory of 2640	1316	msedge.exe	87
PID 1316 wrote to memory of 2640	1316	msedge.exe	87
PID 1316 wrote to memory of 2640	1316	msedge.exe	87
PID 1316 wrote to memory of 2640	1316	msedge.exe	87
PID 1316 wrote to memory of 2640	1316	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\96c747d1113294e76b2ee1103f6b94e8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa23db46f8,0x7ffa23db4708,0x7ffa23db4718
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,15496123049876322082,3681182512015668644,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,15496123049876322082,3681182512015668644,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,15496123049876322082,3681182512015668644,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15496123049876322082,3681182512015668644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15496123049876322082,3681182512015668644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15496123049876322082,3681182512015668644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15496123049876322082,3681182512015668644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,15496123049876322082,3681182512015668644,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,15496123049876322082,3681182512015668644,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15496123049876322082,3681182512015668644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15496123049876322082,3681182512015668644,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15496123049876322082,3681182512015668644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15496123049876322082,3681182512015668644,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,15496123049876322082,3681182512015668644,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
595B

MD5
4cc6c0a7a81bea3c4fce51445fd180c5

SHA1
f3da6d7d2b1389f4945b2ee7eda360294917f760

SHA256
76018c74d71bdb6ff9862eccf9fad8ceec8a56fb0cae3acc2e0304b674e2c510

SHA512
aa60320f8950a7f147bbf0478ae42413504a6fd59a6e7fbd56cdc7831d570e9d8c6488614b154ddfe02e360791b73edbdf50694bccfa7abeece311527c5d3294

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d287e7b135f686cbdd630a6040d70837

SHA1
e0191d89154727ff319fd91b270aab2d60539533

SHA256
6a270094d77acbbb5b9159e59f024056b107f88a737f89db87766d9e5a4b5c27

SHA512
8212dd0da007fc493a827e5e43596c5fe05cb76c61a12da8f5a82b971829cb4dfa80193636be152aabae5ed2e54851f5fe6c915fb91d917cc2129bba5e13bc79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
03d49fa1e41b8f18e17f213ab3e528b8

SHA1
5df24c49f69b8e8cf8e229b608940f2e20ac2404

SHA256
0a3a7c93cceecc8f9a4dc856d750e018643397d69043de9c39b22f70341ebd17

SHA512
b658598bb8bbf1288b0c817dc3dacab1a113b0119c64a0ae3214d64dfeb7d9c945a48e16637acc5962559807198f33b3adccad75983a1ad7c6801efbaa55a374

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
64f6eb807fb2c4b19d44f4dcaa4a4fd0

SHA1
328528ac3a73df95dd2ee0e85e48a0f7a6d0daa3

SHA256
7296b710aa7b4eff6c104bd9f9916940a4ad0b511f9024053beb5feefbaff682

SHA512
0b8aa4e7830173480fb2d14c8e289677cd801fa3ce58ff1edaf4c034df15c19dd77da9a1ae9b4928f36d065ccfaf0cd6c98f7000961179d7cacacc5919b20d15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
773ab71813ea613c97469721066f7dca

SHA1
26d4a614cc77d0039d6137a4e0ded24296715df6

SHA256
3a8b19fce9e270f4597741fcf405bab581f3d13d7825e30032e4e96940d950fc

SHA512
4484092e70a4dea0603c980eca4c04db048ce001e19b66df2890431b3ba319c30999d39a8920fd91f4ec3eba5fea06204e44f9d6d71d688be12ccb4e0f08c9ee

Download Submit