d0518ed8fab192c58d5289761f63f54b65a2b8d47cff93dcef33693d71becc03

Analysis

max time kernel
145s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 13:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbf4225e57c7623475491f64ce21622e_JaffaCakes118.html
Size

53KB
MD5

bbf4225e57c7623475491f64ce21622e
SHA1

c0f0dadc5aa414a8fc8d0483d17471cc5e1c7a33
SHA256

d0518ed8fab192c58d5289761f63f54b65a2b8d47cff93dcef33693d71becc03
SHA512

7084d0cdb10f5e879b49d7349973c55348ed705b164fa0b061ae4b39d104853081ddae31edb0ff1a34cbf915e5a760db245a79468c521ad2a1f92143bce11d21
SSDEEP

1536:CkgUiIakTqGivi+PyU0runlYG63Nj+q5VyvR0w2AzTICbbHoP/t9M/dNwIUTDmDw:CkgUiIakTqGivi+PyU0runlYG63Nj+qX

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
3008	msedge.exe
3008	msedge.exe
5056	identity_helper.exe
5056	identity_helper.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2584	3008	msedge.exe	84
PID 3008 wrote to memory of 2584	3008	msedge.exe	84
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 1740	3008	msedge.exe	85
PID 3008 wrote to memory of 2776	3008	msedge.exe	86
PID 3008 wrote to memory of 2776	3008	msedge.exe	86
PID 3008 wrote to memory of 3996	3008	msedge.exe	87
PID 3008 wrote to memory of 3996	3008	msedge.exe	87
PID 3008 wrote to memory of 3996	3008	msedge.exe	87
PID 3008 wrote to memory of 3996	3008	msedge.exe	87
PID 3008 wrote to memory of 3996	3008	msedge.exe	87
PID 3008 wrote to memory of 3996	3008	msedge.exe	87
PID 3008 wrote to memory of 3996	3008	msedge.exe	87
PID 3008 wrote to memory of 3996	3008	msedge.exe	87
PID 3008 wrote to memory of 3996	3008	msedge.exe	87
PID 3008 wrote to memory of 3996	3008	msedge.exe	87
PID 3008 wrote to memory of 3996	3008	msedge.exe	87
PID 3008 wrote to memory of 3996	3008	msedge.exe	87
PID 3008 wrote to memory of 3996	3008	msedge.exe	87
PID 3008 wrote to memory of 3996	3008	msedge.exe	87
PID 3008 wrote to memory of 3996	3008	msedge.exe	87
PID 3008 wrote to memory of 3996	3008	msedge.exe	87
PID 3008 wrote to memory of 3996	3008	msedge.exe	87
PID 3008 wrote to memory of 3996	3008	msedge.exe	87
PID 3008 wrote to memory of 3996	3008	msedge.exe	87
PID 3008 wrote to memory of 3996	3008	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bbf4225e57c7623475491f64ce21622e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84c9246f8,0x7ff84c924708,0x7ff84c924718
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,16425794980831780017,458533078528471335,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2240,16425794980831780017,458533078528471335,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2240,16425794980831780017,458533078528471335,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,16425794980831780017,458533078528471335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,16425794980831780017,458533078528471335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,16425794980831780017,458533078528471335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,16425794980831780017,458533078528471335,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,16425794980831780017,458533078528471335,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,16425794980831780017,458533078528471335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,16425794980831780017,458533078528471335,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,16425794980831780017,458533078528471335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,16425794980831780017,458533078528471335,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,16425794980831780017,458533078528471335,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5032 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\97e24756-e8e9-451b-a651-0d7bc9d33553.tmp

Filesize
6KB

MD5
5f9bbf1405555316de1007bd390d3717

SHA1
a71da18ffaad9920895d5fecf68eccf7094d0685

SHA256
319ec7c8e0098da1f41d7347265fea5229a0adce4478c98ef22a89ad57494dbb

SHA512
a1ddd31205cd71a4c33862b3421e665645c802c368dfb612b908adc31e71996a3195c7afec0521f752d103869459a2fea2ca0535dbd1f2ca390d902f99516e5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2a554da5075fb036f9bf788ee4b0d0fa

SHA1
2214d390cfecd171e17dc5e7064870b81dd40aac

SHA256
0ab8a6320ef5a4c78e828a027234530603d74698df1dfd71615b2732fcc42057

SHA512
2c817e2fd0bf84312f172315aa0a8945a3ffa3e9474cc24d4543d9f0dabd53466d72b35673c2c61c5e55093536761b0c84019abcfbc98b0d8f424f6cb1edfc7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
45c6b0d321b2d1746eb9f9d19c1d1242

SHA1
a44c97d7fcb0ff2b83eb516b47b4fe72ef2a0de4

SHA256
b08cc257be75b23062addf4df179cad0c1e7c0bb161865712fbcd882915b8c1c

SHA512
ed92946513c4e392398f01b839600924249055c5c63829deb6190c748c72c651ecd9ab8d16ea6e60eaaedd5f45a12e31553aabcdd71b4e81a29c80f0cf56c264

Download Submit