c60ceaec3b8149dc5a57674e25e02cb6b44f3078b58e100baa776eefebf6e8bf

Analysis

max time kernel
145s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 08:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be3c6965dafd7bd06ab39044f6d16353_JaffaCakes118.html
Size

23KB
MD5

be3c6965dafd7bd06ab39044f6d16353
SHA1

510468d51fe2c0efd18a420f46c11bc5b39dcd30
SHA256

c60ceaec3b8149dc5a57674e25e02cb6b44f3078b58e100baa776eefebf6e8bf
SHA512

154cfd1d2af766704cb07968427e4b7122727848d08bc3decb4c1b035bf39e5f8e0f2be590eabba67edcd4c2af22cdd77459b49be0115591e2b02403ad5038be
SSDEEP

192:uWbIb5nGmnQjxn5Q/JnQiecNnjnQOkEntbXnQTbn5nQaCnQtGwMB8qnYnQ7tnuY1:DQ/DmOl

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2996	msedge.exe
2996	msedge.exe
436	msedge.exe
436	msedge.exe
1136	identity_helper.exe
1136	identity_helper.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 4460	436	msedge.exe	84
PID 436 wrote to memory of 4460	436	msedge.exe	84
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2380	436	msedge.exe	85
PID 436 wrote to memory of 2996	436	msedge.exe	86
PID 436 wrote to memory of 2996	436	msedge.exe	86
PID 436 wrote to memory of 4188	436	msedge.exe	87
PID 436 wrote to memory of 4188	436	msedge.exe	87
PID 436 wrote to memory of 4188	436	msedge.exe	87
PID 436 wrote to memory of 4188	436	msedge.exe	87
PID 436 wrote to memory of 4188	436	msedge.exe	87
PID 436 wrote to memory of 4188	436	msedge.exe	87
PID 436 wrote to memory of 4188	436	msedge.exe	87
PID 436 wrote to memory of 4188	436	msedge.exe	87
PID 436 wrote to memory of 4188	436	msedge.exe	87
PID 436 wrote to memory of 4188	436	msedge.exe	87
PID 436 wrote to memory of 4188	436	msedge.exe	87
PID 436 wrote to memory of 4188	436	msedge.exe	87
PID 436 wrote to memory of 4188	436	msedge.exe	87
PID 436 wrote to memory of 4188	436	msedge.exe	87
PID 436 wrote to memory of 4188	436	msedge.exe	87
PID 436 wrote to memory of 4188	436	msedge.exe	87
PID 436 wrote to memory of 4188	436	msedge.exe	87
PID 436 wrote to memory of 4188	436	msedge.exe	87
PID 436 wrote to memory of 4188	436	msedge.exe	87
PID 436 wrote to memory of 4188	436	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\be3c6965dafd7bd06ab39044f6d16353_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6a6246f8,0x7ffc6a624708,0x7ffc6a624718
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,14694568115879825686,8422207216866731793,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,14694568115879825686,8422207216866731793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,14694568115879825686,8422207216866731793,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14694568115879825686,8422207216866731793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14694568115879825686,8422207216866731793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,14694568115879825686,8422207216866731793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3580 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,14694568115879825686,8422207216866731793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3580 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14694568115879825686,8422207216866731793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14694568115879825686,8422207216866731793,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14694568115879825686,8422207216866731793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14694568115879825686,8422207216866731793,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,14694568115879825686,8422207216866731793,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4172 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
79f55277cc72b0413083d464bce7351c

SHA1
cd812176b20560141dcf3028ab99320f06471193

SHA256
e3577865db7369fa13038ca87a6385c6f50dc500c71016994122473bdbee325d

SHA512
8362a2c4905c06aff45d6c0ab67cc2fae788197a184ecefd3f0e0f03346e77b703ca6ab0a96d2f1d4b9b6c231675eb55830527d62bc77647639abfd34d993c3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
25c7116caf52fba6d58ab36729c4d3a0

SHA1
7c89413174fe0b4fc17814ed666816e2f823b06a

SHA256
10ad8dee02fe7c37a3bf4c032fdcf25dec564d27b7c92498d6a083997e670a64

SHA512
f16b403953621d7043cd18859a8163df9f8b0ff880437bf3d4ff906187be5a00c17528c4a65fd6346b5f30c6d9c27fb4aa0cab521b6c775b0e514d58c47cd43b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0c1878a1c0d821be8620779a548a9d9a

SHA1
2b1ea1ce4e33b9af1b17b2648377215fcd44d515

SHA256
3c5aaa1c59134143766003ac29f99cb898b839b2dd27ee423db5b997a11683e3

SHA512
06f11407e041765ab4aa3f52b0401f6de124349e27974409b4bc6a8f2e2346361777c0e3030c57b0c027c7dd28b777640c4a364329a17eaf7762d945a859d0af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
aa62e35e15e69e436a65e582addc081e

SHA1
454f86f018fc4c991420874f358ceef09414b351

SHA256
f7629446a7871e142d4c141334be0b8709bf1421ec0988899f011b3d1b32bc3e

SHA512
483a85fd40f2dc745225cf5f2eace4c0a85df99e018ca6eb796c1fa11540fafec77c24ed134851700ebba5615f9b6d70b3c79ec27d9300e4ddb3a581ab78b38a

Download Submit