1af2bdfd89dcf55fceca66af4e4d351914decae0eeef784f2ae1d5bd59517034

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 04:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d121237af8ed4c7867f9b544c7865432_JaffaCakes118.html
Size

36KB
MD5

d121237af8ed4c7867f9b544c7865432
SHA1

713f8d38617cf4bc3d60ba6933df0a951208f3e4
SHA256

1af2bdfd89dcf55fceca66af4e4d351914decae0eeef784f2ae1d5bd59517034
SHA512

5d8f945b326f92b19914add6a668fc895a4b3926655045fbc158fb7ddf9c180c26f627c650bad17f0c14813c4eb55a834fb20caf8795c0b8bc2e21faa401bced
SSDEEP

768:zwx/MDTHS088hARfZPXaE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6ThZOg6f9U56lLRm:Q/bbJxNVNufSM/P8vK

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
2960	msedge.exe
2960	msedge.exe
4356	identity_helper.exe
4356	identity_helper.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 1604	2960	msedge.exe	83
PID 2960 wrote to memory of 1604	2960	msedge.exe	83
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 1128	2960	msedge.exe	84
PID 2960 wrote to memory of 3444	2960	msedge.exe	85
PID 2960 wrote to memory of 3444	2960	msedge.exe	85
PID 2960 wrote to memory of 1564	2960	msedge.exe	86
PID 2960 wrote to memory of 1564	2960	msedge.exe	86
PID 2960 wrote to memory of 1564	2960	msedge.exe	86
PID 2960 wrote to memory of 1564	2960	msedge.exe	86
PID 2960 wrote to memory of 1564	2960	msedge.exe	86
PID 2960 wrote to memory of 1564	2960	msedge.exe	86
PID 2960 wrote to memory of 1564	2960	msedge.exe	86
PID 2960 wrote to memory of 1564	2960	msedge.exe	86
PID 2960 wrote to memory of 1564	2960	msedge.exe	86
PID 2960 wrote to memory of 1564	2960	msedge.exe	86
PID 2960 wrote to memory of 1564	2960	msedge.exe	86
PID 2960 wrote to memory of 1564	2960	msedge.exe	86
PID 2960 wrote to memory of 1564	2960	msedge.exe	86
PID 2960 wrote to memory of 1564	2960	msedge.exe	86
PID 2960 wrote to memory of 1564	2960	msedge.exe	86
PID 2960 wrote to memory of 1564	2960	msedge.exe	86
PID 2960 wrote to memory of 1564	2960	msedge.exe	86
PID 2960 wrote to memory of 1564	2960	msedge.exe	86
PID 2960 wrote to memory of 1564	2960	msedge.exe	86
PID 2960 wrote to memory of 1564	2960	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d121237af8ed4c7867f9b544c7865432_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff88fe46f8,0x7fff88fe4708,0x7fff88fe4718
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,7970686873575169099,18417192573498122302,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,7970686873575169099,18417192573498122302,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,7970686873575169099,18417192573498122302,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7970686873575169099,18417192573498122302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7970686873575169099,18417192573498122302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,7970686873575169099,18417192573498122302,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,7970686873575169099,18417192573498122302,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7970686873575169099,18417192573498122302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7970686873575169099,18417192573498122302,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7970686873575169099,18417192573498122302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7970686873575169099,18417192573498122302,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,7970686873575169099,18417192573498122302,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5428 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
614B

MD5
65fe96a53557694385244511dd0ddd77

SHA1
b48dfeb308a2654daeb9f0f1f5b3fd071edcaf5a

SHA256
0815e7fa888245e26473ee442fe58ee2a410e85c4b582889ddd7bde833288405

SHA512
9ad082c0d77c083c423e3795f008354ebd4c5831f74ddebf925fc5a899121d11f8aaa87475b3cd5ca2bcd784a63d4b01781c9d88dd27c611a811cb785ff05e6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b53d590a171e755e9d557f19712bbb89

SHA1
519aea59c6586fef39615fed70a604dac7b79014

SHA256
0581371cdd823c98035dc8d80076b55a4454fb925261015d65497bdd04cd3405

SHA512
f6708b17179fa83211cd4ea3da05fcbca78e6f6eae54f43eb1fef2fc380e35e2db1f5a71513f6487d32b67253842760d773919b9bb18141b46c6f7198f76861c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ec303e875ee4ec0a070ed2eeb4792ebf

SHA1
1cb1f97857647d7286c14caef36fd528b859aa73

SHA256
54a1578cdc2f1c44ccef43d6852d17c31198749cf2f686459f166ec6fd596724

SHA512
9c37bdf2b37c7971b0e01c9767a3ecc27360c5a8e802cec9ceef5a39f2b21085b8b11410be1c4c800501265041349618b42bc109c76ef9d4d83041856ee2fe57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d7f0b83f4d0a8aa91d71794c1bb370ae

SHA1
ea972a8e3e98b7e0d607747692b7bf43f3721e68

SHA256
8d3e5aed530b9dafc85605d94616f35ad2df74b453d4924b26d4ac5e86943f87

SHA512
c44af60a07fa593e2e279004d8106f6c784abd4cf74d286d4451d4d5e000287018d3b4f11b5a2882ea1f627fbaf65d3fcc9e011813e3a5d396593680b88ad97b

Download Submit