313130a925d176d07fd4e7355ee19764a63b4f11f8000e3a91f2233e4a50114c

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 11:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c0aa9df0b97bc162834d8f1aa841f671_JaffaCakes118.html
Size 103KB
Sample240825-nsxp7asdph
SHA256 313130a925d176d07fd4e7355ee19764a63b4f11f8000e3a91f2233e4a50114c
MD5 c0aa9df0b97bc162834d8f1aa841f671
SHA1 284a45d9a4ff8b3d864ed18442e7f18ccf2dab4e
SHA512 daa835f394193234b05068c4394d31198e05acced5aa6b371e45a2c58aa0fe10582b62f1a07880d9f70748f4d2b5647e7855dc25d27116edb967004779df486b
SSDEEP 1536:YzJfP+eT+eX+eu+ed+eB+et+ecPeeei5eu0ieeeRfA6ielleee8seneee8TeoeeL:eJXhpwfbXTAjbPzXQ9STnndMCp8
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4872	msedge.exe
4872	msedge.exe
4700	identity_helper.exe
4700	identity_helper.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 3856	4872	msedge.exe	84
PID 4872 wrote to memory of 3856	4872	msedge.exe	84
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 516	4872	msedge.exe	85
PID 4872 wrote to memory of 4972	4872	msedge.exe	86
PID 4872 wrote to memory of 4972	4872	msedge.exe	86
PID 4872 wrote to memory of 4852	4872	msedge.exe	87
PID 4872 wrote to memory of 4852	4872	msedge.exe	87
PID 4872 wrote to memory of 4852	4872	msedge.exe	87
PID 4872 wrote to memory of 4852	4872	msedge.exe	87
PID 4872 wrote to memory of 4852	4872	msedge.exe	87
PID 4872 wrote to memory of 4852	4872	msedge.exe	87
PID 4872 wrote to memory of 4852	4872	msedge.exe	87
PID 4872 wrote to memory of 4852	4872	msedge.exe	87
PID 4872 wrote to memory of 4852	4872	msedge.exe	87
PID 4872 wrote to memory of 4852	4872	msedge.exe	87
PID 4872 wrote to memory of 4852	4872	msedge.exe	87
PID 4872 wrote to memory of 4852	4872	msedge.exe	87
PID 4872 wrote to memory of 4852	4872	msedge.exe	87
PID 4872 wrote to memory of 4852	4872	msedge.exe	87
PID 4872 wrote to memory of 4852	4872	msedge.exe	87
PID 4872 wrote to memory of 4852	4872	msedge.exe	87
PID 4872 wrote to memory of 4852	4872	msedge.exe	87
PID 4872 wrote to memory of 4852	4872	msedge.exe	87
PID 4872 wrote to memory of 4852	4872	msedge.exe	87
PID 4872 wrote to memory of 4852	4872	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c0aa9df0b97bc162834d8f1aa841f671_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffe074446f8,0x7ffe07444708,0x7ffe07444718
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,3304698693432619525,5664477823529700799,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,3304698693432619525,5664477823529700799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,3304698693432619525,5664477823529700799,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2992 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,3304698693432619525,5664477823529700799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,3304698693432619525,5664477823529700799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,3304698693432619525,5664477823529700799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,3304698693432619525,5664477823529700799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,3304698693432619525,5664477823529700799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,3304698693432619525,5664477823529700799,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,3304698693432619525,5664477823529700799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,3304698693432619525,5664477823529700799,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,3304698693432619525,5664477823529700799,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6044 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4
MD5 9e3fc58a8fb86c93d19e1500b873ef6f
SHA1 c6aae5f4e26f5570db5e14bba8d5061867a33b56
SHA512 e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de
MD5 27304926d60324abe74d7a4b571c35ea
SHA1 78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1
SHA512 f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 471B
SHA256 1cb9a88c9db16130479b8fe68dba32585982f8795c853d6b3c8fc6738640cabe
MD5 5f7a68d0dc5d0eeb83f4295ed761f02c
SHA1 d7256cd688ee823edc83d23a25e8a95b5cdfb99d
SHA512 108749b2f621f0d6b094648619bfb3d0c8bb7aa3e8f5ce2e085b44dfaced439e60715749de387cdb5f10239f83e296338179134a21217cb88c667b8b49c1ee01
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 f1fe7bbede5c75390dccd0c762aca524d34bcb46db66313db936cccd03672e80
MD5 cbb797d8bd4f6cb4d1c737b4d390f46b
SHA1 b220cacb31463af00234a098718f7bfb42195f74
SHA512 b264091812801eee010780d5f396fdc06844766397372dbdc3c99e7327ed8184bfa788a9ca617af3abe734822835fd65745f6488084dcb2f88f4d8097cbf572a
SSDEEP 96:n1k/FwY1b5wpvWMoiVmdeH4piN6rUWQyV+VDCziEwb:n1k/FZ5GWMX4kErro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 02a1bb79900523e7908953a6665118bf96b6000f289d411a9ced416d748d3695
MD5 14f098f898ff873cd303d7a4da5c7830
SHA1 f3f53a92feb127ac850ea04597597f848bf2b98f
SHA512 7d92a70727f79d111136e9cfa66ce5d21c822f2a03351e2c06f8e6cd1fbcfc1cb5f622c76c4489e848f3887c11933ea7e3441dd05f2aed96b156496574b63873
SSDEEP 96:n1k/FwY1bNwpvWMoiVmdeH4piN6rUWQyV+VD7AiEwb:n1k/FZNGWMX4kErrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 05d8001a4a2a5f69f953c17220c9a6c3ded6b151d81606a55bb789e7fe8ecf33
MD5 529568747817156bf60319675a58db35
SHA1 7feaac62aab059b8eeb8bc9b5f2284ca1fd7cd85
SHA512 12b0b26f5bf21609ef3dc0ea811fdca8cce1b377f3b565f0c83add5dbb931e9007326f7005c78e81f5d49f481ece4d1758d8adb25fac1ff39c6a17aa65348a22
SSDEEP 96:n1k/FwY1b5wpvWMoiVmdeH4piN6rUWQyV+VDCAiEwb:n1k/FZ5GWMX4kErrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 489bbef8c9e110c327f2a05b9bf4efdbb7fcceb4ad9d96395e7786dbe6784195
MD5 12a763a809a686173a39857cd635133d
SHA1 ada8b3e68741562b671f3ed7d29aed2daf3986c4
SHA512 2452ae7679140976ec8318d31d17492a3bdd2ade56f9bc445bbc37ec7f0216cd08567badcb31be08cc1e2bd1ae7f4b126bb046e2167b9a10af94c42074a25fb7
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupHBe2RU/c8WRw5Ytj9ZklqQ:A9iIxuERzA83h09RZxYHV6JkLsgBt8
MD5 SHA1 SHA512 SSDEEP

Submit Download