6092b59104b545acb22737075372bd8243204bce5669229a20efe9fc6c7808fc

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abfa0c1ccb29c417c1e0e03c4eb1c78d_JaffaCakes118.html
Size

122KB
MD5

abfa0c1ccb29c417c1e0e03c4eb1c78d
SHA1

c08728a86d696ca096677af3e63c76948d897c34
SHA256

6092b59104b545acb22737075372bd8243204bce5669229a20efe9fc6c7808fc
SHA512

650158f0bdc053c87efeaf9e75a263298abe1704e1e35ec4ff1d5e0e5752c12f3a7c80b068cb945b3c1c045e5564ebcee35e7754adede79210ec5ad4b20a9de6
SSDEEP

1536:l4Fg4ZGZ9u3UHa4iDqt25c2ec2PuIWsN8/HTn:l4T3UHa4iDqt25c2ec2PYHTn

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
608	msedge.exe
608	msedge.exe
2296	msedge.exe
2296	msedge.exe
3124	identity_helper.exe
3124	identity_helper.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 3904	2296	msedge.exe	85
PID 2296 wrote to memory of 3904	2296	msedge.exe	85
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 4888	2296	msedge.exe	86
PID 2296 wrote to memory of 608	2296	msedge.exe	87
PID 2296 wrote to memory of 608	2296	msedge.exe	87
PID 2296 wrote to memory of 4956	2296	msedge.exe	88
PID 2296 wrote to memory of 4956	2296	msedge.exe	88
PID 2296 wrote to memory of 4956	2296	msedge.exe	88
PID 2296 wrote to memory of 4956	2296	msedge.exe	88
PID 2296 wrote to memory of 4956	2296	msedge.exe	88
PID 2296 wrote to memory of 4956	2296	msedge.exe	88
PID 2296 wrote to memory of 4956	2296	msedge.exe	88
PID 2296 wrote to memory of 4956	2296	msedge.exe	88
PID 2296 wrote to memory of 4956	2296	msedge.exe	88
PID 2296 wrote to memory of 4956	2296	msedge.exe	88
PID 2296 wrote to memory of 4956	2296	msedge.exe	88
PID 2296 wrote to memory of 4956	2296	msedge.exe	88
PID 2296 wrote to memory of 4956	2296	msedge.exe	88
PID 2296 wrote to memory of 4956	2296	msedge.exe	88
PID 2296 wrote to memory of 4956	2296	msedge.exe	88
PID 2296 wrote to memory of 4956	2296	msedge.exe	88
PID 2296 wrote to memory of 4956	2296	msedge.exe	88
PID 2296 wrote to memory of 4956	2296	msedge.exe	88
PID 2296 wrote to memory of 4956	2296	msedge.exe	88
PID 2296 wrote to memory of 4956	2296	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\abfa0c1ccb29c417c1e0e03c4eb1c78d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b75546f8,0x7ff9b7554708,0x7ff9b7554718
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,15991803387721537638,16398727322476283149,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,15991803387721537638,16398727322476283149,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,15991803387721537638,16398727322476283149,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15991803387721537638,16398727322476283149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15991803387721537638,16398727322476283149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15991803387721537638,16398727322476283149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15991803387721537638,16398727322476283149,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,15991803387721537638,16398727322476283149,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,15991803387721537638,16398727322476283149,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15991803387721537638,16398727322476283149,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15991803387721537638,16398727322476283149,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,15991803387721537638,16398727322476283149,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5472 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
272B

MD5
d21420231747a480c6d70bf3c5ad758a

SHA1
62b3f5b9634afd93b7d851f240932cb6259220f2

SHA256
a84aaf5bae87793ba87a61851cdaae04b394d9b1a008350388e1f44017873f5b

SHA512
a31bc12c43fddb95b22f35ff238f08d8e82409b6965c5e91810611bbae92f4bea9c52299ce32e084e1dd85fd34d86e873667961b0cecbbe5faeebdad2dafda7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c259726ffc8ec39e9701d0a620499155

SHA1
28e00ceb30f4efc0c665de6853eec37f9d949e62

SHA256
deba0c453fd6071ad2634e88cf8918fce67286bb08cec143998f38d8a7739df8

SHA512
98d166089d0ee7adc981e532a149a1665e7571b2ccc8050773fdc3592c876b28ac1c8e40ff025ec6cd592c2d5dcfc970163f6fdc22172c5d43853c5ce257fc84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
07560c6053ce5e4e77ce7703c251fbb0

SHA1
533994bdc71e200affd821ba5999eaa6829f5196

SHA256
567d522c7dbda8d4b732a6ca652d8e1eb1d3ae542ac05741c752baaa1064c44a

SHA512
dcb6f820947873138e342e917f6c8d66cf79594fab70012dc83cd0525716cd7d6f0718d55af7de3756342546fcccf51afc9c53bff2a848c10a5d120a1cfdfc53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
4e1fce7ea69efb7875585b23993b4a90

SHA1
824cd895abb3fe38cc3ace377853f6696c0dc4c7

SHA256
acef195d8bccdc6648e25f8456415481e52a82483ac32589797894fd0d68b08b

SHA512
b279c57015757f600c30ef418c152216fa56da410b8cfabf7f3a80918a13366369c525e572309c6bf37679e4aa094fa78bf05df348cbfd76f06046d22650c088

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58179a.TMP

Filesize
204B

MD5
abc3f013230dec96f60eab9d74eec26b

SHA1
1f17a6bc3b9637012d11ac5d71326e0aea627654

SHA256
7cc72930932e028ecba2abce2be27b6049391ffae4be62055359df15a3537e2c

SHA512
d25d8bb44f5b3173ac7622e48974a2dbe9a3d943e6556b3ef45421714efefa0d097ce4b16e52ecea8b7cc439042bd5d54f37d46ff71df0d76f9b958be49ce5af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e8cd6f9a-aeae-47f1-88db-fd671c949916.tmp

Filesize
5KB

MD5
018e9d78056307d0c220b996b3a2a05d

SHA1
0b607a3a8d17ccdab9083f947a123b3e7f7fb81e

SHA256
f72e6ad89d9ff7813d777b66fcb67158f4d29d3f2151678dfd793aad9f303ffc

SHA512
7de8dca3d2dbb742d2e35154cc8df4090c2a289961b1dd2994b039aa058ed6e637f74b39754955e790d3e7559cffa9c15435f0a2a7cf6f6994b99b038ec688f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cbd64202c9b52a383043964cd40f4db7

SHA1
14da10e3c4924457cdee6c3a2101f37d54e36960

SHA256
53d9dec7c8bf15374894a0259a5eb242be043cda3b279766ece6458291841bcd

SHA512
772e3efc607bd0f329f7b9a6793c6c678f4446df2a398d1e111681fde666cb93596b38d39edcdbd89740236ec6eac209094c3cb982c5eca11c93ce5aeb0bc8fb

Download Submit