9376719abda96f8dad03c66151502062ee50402a1f4aba7e8128338ae55039c1

Analysis

max time kernel
145s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2024 09:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c072ee7b97b8c1a1b9194cd4f7c0bea2_JaffaCakes118.html
Size

22KB
MD5

c072ee7b97b8c1a1b9194cd4f7c0bea2
SHA1

94ca894f0497ee2685008443badef84cdb86c3b6
SHA256

9376719abda96f8dad03c66151502062ee50402a1f4aba7e8128338ae55039c1
SHA512

999742def42636c9799f67e0c065256b24d0aeba335adcef765c1d3da0a0dfa9aa0f17cb706b756feb1002b3e108b3473360ff77675f7fea63bb228417948be2
SSDEEP

384:6FHOiOiqU/a13pxsbAANeybQ/lMVpGS41NW4Z7wIreI3EW:6FHOiOiqU/a13pxsbAANeyWMVpGS41Nl

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
756	msedge.exe
756	msedge.exe
3384	msedge.exe
3384	msedge.exe
2484	identity_helper.exe
2484	identity_helper.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 4488	3384	msedge.exe	84
PID 3384 wrote to memory of 4488	3384	msedge.exe	84
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 3688	3384	msedge.exe	85
PID 3384 wrote to memory of 756	3384	msedge.exe	86
PID 3384 wrote to memory of 756	3384	msedge.exe	86
PID 3384 wrote to memory of 1768	3384	msedge.exe	87
PID 3384 wrote to memory of 1768	3384	msedge.exe	87
PID 3384 wrote to memory of 1768	3384	msedge.exe	87
PID 3384 wrote to memory of 1768	3384	msedge.exe	87
PID 3384 wrote to memory of 1768	3384	msedge.exe	87
PID 3384 wrote to memory of 1768	3384	msedge.exe	87
PID 3384 wrote to memory of 1768	3384	msedge.exe	87
PID 3384 wrote to memory of 1768	3384	msedge.exe	87
PID 3384 wrote to memory of 1768	3384	msedge.exe	87
PID 3384 wrote to memory of 1768	3384	msedge.exe	87
PID 3384 wrote to memory of 1768	3384	msedge.exe	87
PID 3384 wrote to memory of 1768	3384	msedge.exe	87
PID 3384 wrote to memory of 1768	3384	msedge.exe	87
PID 3384 wrote to memory of 1768	3384	msedge.exe	87
PID 3384 wrote to memory of 1768	3384	msedge.exe	87
PID 3384 wrote to memory of 1768	3384	msedge.exe	87
PID 3384 wrote to memory of 1768	3384	msedge.exe	87
PID 3384 wrote to memory of 1768	3384	msedge.exe	87
PID 3384 wrote to memory of 1768	3384	msedge.exe	87
PID 3384 wrote to memory of 1768	3384	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c072ee7b97b8c1a1b9194cd4f7c0bea2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb53e546f8,0x7ffb53e54708,0x7ffb53e54718
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,15187565754012227945,2207432332757878791,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,15187565754012227945,2207432332757878791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,15187565754012227945,2207432332757878791,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15187565754012227945,2207432332757878791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15187565754012227945,2207432332757878791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2144 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,15187565754012227945,2207432332757878791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1732 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,15187565754012227945,2207432332757878791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15187565754012227945,2207432332757878791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15187565754012227945,2207432332757878791,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15187565754012227945,2207432332757878791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15187565754012227945,2207432332757878791,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,15187565754012227945,2207432332757878791,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4200 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0f232e3c361c3ed8958a2d9789a79561

SHA1
09f787100af110f7ab3943458d521b5df3495cf0

SHA256
502a463bb01c877a73152e92845d4d23603cc64e6d6d1db84e1497a2a99cb75f

SHA512
cf2d52d7c6236f531d0db9efa3117d517dddddd94b5dc8a216b226cab37286e6985d40403079855380ac11e34a8e61dda9463fe3283132d2229820f054d3c392

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
97f2950951c9f3147b43ca8df1e6f34f

SHA1
b355b3e0c94aebe001a1d3c875bdf991a0597705

SHA256
c96a7104ba07ed9f3a59ae3e9ee4d95c1373026f9b2ea9e35cd55a543405e390

SHA512
6412d0153d8e33b090acc328d75ef1a24223f5394f3845c054941ec80630d8e4d9a9efa03b2847209e441b2101d5e38dcdda495991be18ac718b5a2443bfbded

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3564d732d274579432a00991eb5987a6

SHA1
64c2a5fb8f3d66adbf8a43a6b60105f6d40e8b94

SHA256
b78a46ff17e74886f0d3ca0ac69fafc13c07af5911f7a8c33c7ee1556de390d7

SHA512
b76099da140d2cf0c1cd4baf22e07f8641be7409a2e1debb69317a1b505c1fc7d58cbe89f180658776b3dd08d51aae5204c23decd2240856995c79e15a17a54a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cb4f6b6539c139d05ae8e2c2a1479b7a

SHA1
314e641a342bd0123eba52bb892e0fe5c7cdf72a

SHA256
e84f97963d9befed23f94b9eeedabd7e8de2f0b7db21e62d8656a76c6ad0f1ec

SHA512
ff00d1f431ddff15a048e8dce9f10332654155e79195e2c5e7998406359a27bd1734d861c050e16f7fae05f26a208fe9e0389906e4cb91b537316d04054b340c

Download Submit