0e441dc83dd786930573327471eff3f94368e4d30ba7683d418a365f9e44428e

Analysis

max time kernel
145s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 09:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c074382038c12fa62cb208cb08134113_JaffaCakes118.html
Size 27KB
Sample240825-lldmmaygpr
SHA256 0e441dc83dd786930573327471eff3f94368e4d30ba7683d418a365f9e44428e
MD5 c074382038c12fa62cb208cb08134113
SHA1 1d5f4d9e0fa6d1c2a9b459b7e9624cfa87cbe49b
SHA512 23384255e2e0f5074bd0f6530440ab67e98c8acb24692748ff40e809f85291c9d66948c9f35d6619acaf6061b2d9235d6c386196564c2d0ccd5d3595e4121c8f
SSDEEP 192:uwzcb5no+nQjxn5Q/LnQieyNnxnQOkEntRNnQTbn5nQ9eYCm6u5mgQl7MBSqnYnO:tQ/DBqQmDSUXw
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3508	msedge.exe
3508	msedge.exe
2636	msedge.exe
2636	msedge.exe
3040	identity_helper.exe
3040	identity_helper.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2796	2636	msedge.exe	84
PID 2636 wrote to memory of 2796	2636	msedge.exe	84
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3984	2636	msedge.exe	85
PID 2636 wrote to memory of 3508	2636	msedge.exe	86
PID 2636 wrote to memory of 3508	2636	msedge.exe	86
PID 2636 wrote to memory of 2652	2636	msedge.exe	87
PID 2636 wrote to memory of 2652	2636	msedge.exe	87
PID 2636 wrote to memory of 2652	2636	msedge.exe	87
PID 2636 wrote to memory of 2652	2636	msedge.exe	87
PID 2636 wrote to memory of 2652	2636	msedge.exe	87
PID 2636 wrote to memory of 2652	2636	msedge.exe	87
PID 2636 wrote to memory of 2652	2636	msedge.exe	87
PID 2636 wrote to memory of 2652	2636	msedge.exe	87
PID 2636 wrote to memory of 2652	2636	msedge.exe	87
PID 2636 wrote to memory of 2652	2636	msedge.exe	87
PID 2636 wrote to memory of 2652	2636	msedge.exe	87
PID 2636 wrote to memory of 2652	2636	msedge.exe	87
PID 2636 wrote to memory of 2652	2636	msedge.exe	87
PID 2636 wrote to memory of 2652	2636	msedge.exe	87
PID 2636 wrote to memory of 2652	2636	msedge.exe	87
PID 2636 wrote to memory of 2652	2636	msedge.exe	87
PID 2636 wrote to memory of 2652	2636	msedge.exe	87
PID 2636 wrote to memory of 2652	2636	msedge.exe	87
PID 2636 wrote to memory of 2652	2636	msedge.exe	87
PID 2636 wrote to memory of 2652	2636	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c074382038c12fa62cb208cb08134113_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcdd6546f8,0x7ffcdd654708,0x7ffcdd654718
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,7373808821206036097,14880217172669264809,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,7373808821206036097,14880217172669264809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,7373808821206036097,14880217172669264809,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7373808821206036097,14880217172669264809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7373808821206036097,14880217172669264809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,7373808821206036097,14880217172669264809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,7373808821206036097,14880217172669264809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7373808821206036097,14880217172669264809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7373808821206036097,14880217172669264809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7373808821206036097,14880217172669264809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7373808821206036097,14880217172669264809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,7373808821206036097,14880217172669264809,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3304 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

080eb96b-aaa0-4910-b114-78ceaed15ca2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\080eb96b-aaa0-4910-b114-78ceaed15ca2.tmp
Size 10KB
SHA256 b88535aaf5b3b15b0fb3391d69cef3f2b7e5a2381e75e2518e5d8374f38c1417
MD5 aaa16345c257d2b602c32b12fb9d2156
SHA1 6e6b7a3c6be6396d986eb36508f3bf43fa1f6fcf
SHA512 d3beb0385dcefd207a6a108d7b1e37304cc918cc0592b5358dcfe46b81ab84957f4851fc040e5c5119310dc4ab73ab49bbd8fd347566c3d30a9d0828f2405fc6
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupqe2RUA/lYOlRw5Ytj9ZklP:A9iIxuERzA83h09RZxYk5VmkLsQ2d
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff
MD5 ab8ce148cb7d44f709fb1c460d03e1b0
SHA1 44d15744015155f3e74580c93317e12d2cc0f859
SHA512 f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b
MD5 38f59a47b777f2fc52088e96ffb2baaf
SHA1 267224482588b41a96d813f6d9e9d924867062db
SHA512 4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 51168e0a2e6e7aec79905c504363a30cef67fd2f8346f53185eaee9fc1e02235
MD5 ef2f12fea3a5c2399e203641fb031d4d
SHA1 d6bc4a80a60269bdb16c9c600ea02726497c9089
SHA512 217e538da2d63148073c20894b5e9bb531a9d63df0719c4f7ba18e4b9792dfc11be37a5d3c81ac12ee2797d1c12427be6a3ace029fa221a5f0331822e6587744
SSDEEP 96:nskzF51jRwpvWMoiVmdeHm9YUWQyV+VDCAiEwb:nskzPtRGWMX/rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 906072ecbc2005eef716446021ace86503cb4c4d9fbbb3a5ccc509c19c3e300b
MD5 8ee4408cfce4869458d7f920d2002a8a
SHA1 f4aa1c3d2c74a5131bb10810570a9fdd568f1da7
SHA512 cbdd7b147e397c1ffb6eb8b76997a620ca70483949ae4e0e63227e4fb5a01300411782d11b73c60eb8a8cd2c2da1330a74d9691e74582519a539770be352d335
SSDEEP 96:nskzF51jRwpvWMoiVmdeHm9YUWQyV+VDCziEwb:nskzPtRGWMX/ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f0fd76048a327430485fa12c64a262d0db8624a1bd227caa2a24f67d54023be2
MD5 896012ef6fdc4fc8ff3274254339fef7
SHA1 034676612f38da6ff53776d8c73c101bf5c8eb7a
SHA512 3779ab700060c2535b270081a6d9296b6e0db243422373aa3a8569a0f3e202cc4ba6f2f9ab1b6a06fb4b8edaad3c0923c1846c7398d9024674d73b1051520eaf
SSDEEP 96:nskzF51jnwpvWMoiVmdeHm9YUWQyV+VDCAiEwb:nskzPtnGWMX/rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download