369e317861f407371231dec479db38186c865606a9a06836415a1496ca2059fb

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-08-2024 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c793b90c3c5c785f7a38c8c0255f9c3d_JaffaCakes118.html
Size

16KB
MD5

c793b90c3c5c785f7a38c8c0255f9c3d
SHA1

956666ce127787ea9d88ec58aba38078a8da3baf
SHA256

369e317861f407371231dec479db38186c865606a9a06836415a1496ca2059fb
SHA512

fad63910b3c473bf15176f1fdaadce48c7a755baaf55c5bd0a85530c435731051da51816a73fc88b052f4fc4adf308aa0385b981bb24ce23377d8a3b9372c02d
SSDEEP

384:FalPrmyjZSERzuNd4K3nxrJjsVL4ouN8tC:aqAxvSxtjlZ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
4764	msedge.exe
4764	msedge.exe
536	identity_helper.exe
536	identity_helper.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 5088	4764	msedge.exe	86
PID 4764 wrote to memory of 5088	4764	msedge.exe	86
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 1812	4764	msedge.exe	87
PID 4764 wrote to memory of 3544	4764	msedge.exe	88
PID 4764 wrote to memory of 3544	4764	msedge.exe	88
PID 4764 wrote to memory of 4044	4764	msedge.exe	89
PID 4764 wrote to memory of 4044	4764	msedge.exe	89
PID 4764 wrote to memory of 4044	4764	msedge.exe	89
PID 4764 wrote to memory of 4044	4764	msedge.exe	89
PID 4764 wrote to memory of 4044	4764	msedge.exe	89
PID 4764 wrote to memory of 4044	4764	msedge.exe	89
PID 4764 wrote to memory of 4044	4764	msedge.exe	89
PID 4764 wrote to memory of 4044	4764	msedge.exe	89
PID 4764 wrote to memory of 4044	4764	msedge.exe	89
PID 4764 wrote to memory of 4044	4764	msedge.exe	89
PID 4764 wrote to memory of 4044	4764	msedge.exe	89
PID 4764 wrote to memory of 4044	4764	msedge.exe	89
PID 4764 wrote to memory of 4044	4764	msedge.exe	89
PID 4764 wrote to memory of 4044	4764	msedge.exe	89
PID 4764 wrote to memory of 4044	4764	msedge.exe	89
PID 4764 wrote to memory of 4044	4764	msedge.exe	89
PID 4764 wrote to memory of 4044	4764	msedge.exe	89
PID 4764 wrote to memory of 4044	4764	msedge.exe	89
PID 4764 wrote to memory of 4044	4764	msedge.exe	89
PID 4764 wrote to memory of 4044	4764	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c793b90c3c5c785f7a38c8c0255f9c3d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad63c46f8,0x7ffad63c4708,0x7ffad63c4718
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,2537314601452353171,11217614772368544683,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,2537314601452353171,11217614772368544683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,2537314601452353171,11217614772368544683,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2537314601452353171,11217614772368544683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2537314601452353171,11217614772368544683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2537314601452353171,11217614772368544683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2537314601452353171,11217614772368544683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4460 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,2537314601452353171,11217614772368544683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,2537314601452353171,11217614772368544683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2537314601452353171,11217614772368544683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2537314601452353171,11217614772368544683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2537314601452353171,11217614772368544683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2537314601452353171,11217614772368544683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,2537314601452353171,11217614772368544683,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
fbe5fb783ff1204dc09bf1e9d68d4856

SHA1
e47af8f2ff397696c3eef6feac837d818f9af0a1

SHA256
9cf98c9a2cb6add79660412c6c228d9174581cf7985b1810553bbdeea6a1b987

SHA512
4aefed5704f2405e7fe6c3c2e74da031b51a6d01ee5413a089803f579e8fe44548c139afce33b139e2491740086c89579dcc95f9aed12153751bd7c5ce707059

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9f70d3365d12112ffcbb553dbdb07e82

SHA1
708763ccd577c326d32814ed181b42e853c78617

SHA256
838f21d2c22f6be06fe8137315c0680beadfe02e2388cc9cda68b715a853d724

SHA512
683d4aec7d5daddcbf4deb9b05104b54e923f1baf68cf9f4b0aba034bda7af4525ae1385ccaf85fdddd4cb6a91f4706df9821d2a4d0e511e1bd482cbd46b9c1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fa933d5dd1aa362b5c516726737b0239

SHA1
f1c08b496185a9f31aa691d304762e8fbbd7ff5c

SHA256
211d1bf1a812dc3c996e7efe94cce394b037ecf9d2dec516bce7d793535b9512

SHA512
9ddadc6d33530a6d3006d8eba3bc4f629abf34b0e74ae2e3a11f7ee053cc1b2841b74a9b8e55ad06a3ffea4bc74ed26c6d965ead052f404ce08a4eadd405f70d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6071c7a597b8088941f9b086ed12c184

SHA1
8535049bbf961fad0523b72f84393291bb8b7ecc

SHA256
86b550e4134b1be46ba008371bab6e489068431ecb84d317f2a823b087720bbe

SHA512
be62e335d393482a75f9b670f4685cd63b3512d9ead50ae111e4f3b0bdaa5613a7aa7c5f1ddf94992ddd4bd6a4f3ae9ede4ba7c44fe931d83e1286480824cd1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9448981aa7babc57c58c4f0ea8896156

SHA1
e7e7b2def6b0655c0a5f170cdc44e645cb36c364

SHA256
2c0ccd4dd291ee58d475d9dbf70c9c9bd93e5366601f758bf8a4039a6408d513

SHA512
2290067962084f3e77f9456a778e0cc2f1cf526d4efc0d70728a82af79ebd87ea424c6c2f74a81cf2a004c0373a93720ef7e1abd20af7640a62e4cc4eb037123

Download Submit