61a0ce0ea64267cd20ae3716c427a38b91f44d795501c33f0d687883c6ed7b32

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 08:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2c440db5558140eb8da763521618ed3_JaffaCakes118.html
Size

34KB
MD5

b2c440db5558140eb8da763521618ed3
SHA1

33d0203bf5fbbd721a671d63d2a3f4d701929c21
SHA256

61a0ce0ea64267cd20ae3716c427a38b91f44d795501c33f0d687883c6ed7b32
SHA512

3c8a82c6d2bb8aa904c50d12e60e4aa6f0ecc6f1f26b117dd59900f3565bfa441e690a3d1cb85329c5628e17520ea3f8259497248fc9c31e7484620df9cc3f86
SSDEEP

768:Muy79xwV/dH2hmVgIBSRSXI3rK8TEiHrT76hWr/r/BaMkvww26rhUg04/P3msU:k9xwV/dH2h2gIBSSXgK8TjDZaMkvww2t

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
3876	msedge.exe
3876	msedge.exe
4564	identity_helper.exe
4564	identity_helper.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 2924	3876	msedge.exe	84
PID 3876 wrote to memory of 2924	3876	msedge.exe	84
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 3088	3876	msedge.exe	85
PID 3876 wrote to memory of 5052	3876	msedge.exe	86
PID 3876 wrote to memory of 5052	3876	msedge.exe	86
PID 3876 wrote to memory of 2028	3876	msedge.exe	87
PID 3876 wrote to memory of 2028	3876	msedge.exe	87
PID 3876 wrote to memory of 2028	3876	msedge.exe	87
PID 3876 wrote to memory of 2028	3876	msedge.exe	87
PID 3876 wrote to memory of 2028	3876	msedge.exe	87
PID 3876 wrote to memory of 2028	3876	msedge.exe	87
PID 3876 wrote to memory of 2028	3876	msedge.exe	87
PID 3876 wrote to memory of 2028	3876	msedge.exe	87
PID 3876 wrote to memory of 2028	3876	msedge.exe	87
PID 3876 wrote to memory of 2028	3876	msedge.exe	87
PID 3876 wrote to memory of 2028	3876	msedge.exe	87
PID 3876 wrote to memory of 2028	3876	msedge.exe	87
PID 3876 wrote to memory of 2028	3876	msedge.exe	87
PID 3876 wrote to memory of 2028	3876	msedge.exe	87
PID 3876 wrote to memory of 2028	3876	msedge.exe	87
PID 3876 wrote to memory of 2028	3876	msedge.exe	87
PID 3876 wrote to memory of 2028	3876	msedge.exe	87
PID 3876 wrote to memory of 2028	3876	msedge.exe	87
PID 3876 wrote to memory of 2028	3876	msedge.exe	87
PID 3876 wrote to memory of 2028	3876	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b2c440db5558140eb8da763521618ed3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc603146f8,0x7ffc60314708,0x7ffc60314718
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,14133688891248831782,17683888520290620877,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,14133688891248831782,17683888520290620877,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,14133688891248831782,17683888520290620877,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14133688891248831782,17683888520290620877,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14133688891248831782,17683888520290620877,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,14133688891248831782,17683888520290620877,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,14133688891248831782,17683888520290620877,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14133688891248831782,17683888520290620877,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14133688891248831782,17683888520290620877,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14133688891248831782,17683888520290620877,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14133688891248831782,17683888520290620877,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,14133688891248831782,17683888520290620877,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2656 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\73a7611c-965d-4491-b9da-e7e7ef84fc14.tmp

Filesize
6KB

MD5
7f99d919696742e773e9800cd0879342

SHA1
52d2de46f29fcc62c73ef612c0e5c8d7463c8875

SHA256
4f81021adee92e2ebc156ea7e9f515e0369484a7dbb83f318ff16dbd47698330

SHA512
801d77d91ea2c53bf34f59169070a4c1c2622e3c011607d277824a220c249c8ac51a3e8db144e6b35dce3d130a1a1b9e64d2eb754de0c7147e0d44abb9e89aad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
303B

MD5
760a0be8f63ee2b6022601dd63926252

SHA1
3e8b56c69b3bb81d5abc5ce83d6fffd98c297546

SHA256
2a6553ff30ecba34b78fd87eacb813df294e5a55fe98b2c8a0d17c6feef02b34

SHA512
44535da33b8e04e6cb89b38567e0ace7e64ce0ab38858d802086b2ba720a4a5a5bbd51488792c2ada5d1d052641a2773c58fb674bcbc3b7943376ccf2d368d17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
497B

MD5
a898f07466783b64c270d971feda109d

SHA1
8afc12644a106e57581d5f402dae6e22a15894d5

SHA256
3b4a0f13bc1661dff9ce2f906b6806cbcc726c46400f736ea984a99bc9f9f0ad

SHA512
dc47e99659c38d8acc3ede29a888c93ac939cd816237163ba05eb8347fb99964c6a53f78df732230342d0006023231663860b260917289d613c5dcba860fd5d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
09225ff212f4d09782fdc435ef9674e6

SHA1
98770a2fe4b9edb776fa1b3659b5ee062805d3cf

SHA256
6bf727f39b5f4bf88211d306251ee4618999363ebf1d7375a801036b737dbad1

SHA512
fcc7f792ae372d6a4f4812bf4b4d1730b27dc407139cd3fcc127d145d78c75862c0f0f4cbb315232c63ac1dcb3271f3a57b6514bb4043c7c9956760d6d8b5245

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
39b10d4db8ffe28763906b429b53ff2b

SHA1
ad7592be5284c5235944ef61ff2fdd3cb8acd7d1

SHA256
6d88dee47209a9f00d1736f7f65565f88f80334811386b44b4bb5722094e97ea

SHA512
b20e102bb3d2ee6d49d005b0ab3f1fa812af19721b059b4e01e82bbeb993502e8712ebb5c530aa8b6d3edd69b5f415924b4c687f6ae6b19f1a1adaffb8d3ca04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f6d1c26e0e04ccf435183512a1b76201

SHA1
9daac4dcb5b1f30b962461b3b8137e0cae74b35e

SHA256
e973a13c37207158b295b60bbeafccfcb8620ab2dde61927bbd2e75ed9ff476a

SHA512
765ce81f90cd61ffe06ec16ff39e9943f1c89bf8299255b254ee126d3b7d3da6ccebbcd5386ca035196f91b665bd4c022ebdf4975e6ebe567e2144976a9b43da

Download Submit