8d799cbdef4082fa48003bfa7a56585609f5d4597683b06c047acc93e52103cb

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d3814c811000158d76db34e0b187d842_JaffaCakes118.html
Size 39KB
Sample240908-eqr79avgrk
SHA256 8d799cbdef4082fa48003bfa7a56585609f5d4597683b06c047acc93e52103cb
MD5 d3814c811000158d76db34e0b187d842
SHA1 2c6c74871a944c1a51308003bcbb32cd14ff7da6
SHA512 7ba7bb50fa9d643dae4eb36fc3957be249590f6ed6f36bc546e8878678d080a88a898287eb44a2f3bc6b646f429cf460744491c86fc4c0842d3b13bfa7efc09a
SSDEEP 768:zwx/MDTH5h88hARmZPXZE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6Tx3KD6Nx9/6jLRk:Q/zbJxNVbutASF/k8uK
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe
2328	msedge.exe
2328	msedge.exe
4716	identity_helper.exe
4716	identity_helper.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 1256	2328	msedge.exe	83
PID 2328 wrote to memory of 1256	2328	msedge.exe	83
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4248	2328	msedge.exe	84
PID 2328 wrote to memory of 4460	2328	msedge.exe	85
PID 2328 wrote to memory of 4460	2328	msedge.exe	85
PID 2328 wrote to memory of 1008	2328	msedge.exe	86
PID 2328 wrote to memory of 1008	2328	msedge.exe	86
PID 2328 wrote to memory of 1008	2328	msedge.exe	86
PID 2328 wrote to memory of 1008	2328	msedge.exe	86
PID 2328 wrote to memory of 1008	2328	msedge.exe	86
PID 2328 wrote to memory of 1008	2328	msedge.exe	86
PID 2328 wrote to memory of 1008	2328	msedge.exe	86
PID 2328 wrote to memory of 1008	2328	msedge.exe	86
PID 2328 wrote to memory of 1008	2328	msedge.exe	86
PID 2328 wrote to memory of 1008	2328	msedge.exe	86
PID 2328 wrote to memory of 1008	2328	msedge.exe	86
PID 2328 wrote to memory of 1008	2328	msedge.exe	86
PID 2328 wrote to memory of 1008	2328	msedge.exe	86
PID 2328 wrote to memory of 1008	2328	msedge.exe	86
PID 2328 wrote to memory of 1008	2328	msedge.exe	86
PID 2328 wrote to memory of 1008	2328	msedge.exe	86
PID 2328 wrote to memory of 1008	2328	msedge.exe	86
PID 2328 wrote to memory of 1008	2328	msedge.exe	86
PID 2328 wrote to memory of 1008	2328	msedge.exe	86
PID 2328 wrote to memory of 1008	2328	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d3814c811000158d76db34e0b187d842_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e84246f8,0x7ff8e8424708,0x7ff8e8424718
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,2481520444115765787,8770145751791963091,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,2481520444115765787,8770145751791963091,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,2481520444115765787,8770145751791963091,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2481520444115765787,8770145751791963091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2481520444115765787,8770145751791963091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,2481520444115765787,8770145751791963091,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,2481520444115765787,8770145751791963091,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2481520444115765787,8770145751791963091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2481520444115765787,8770145751791963091,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2481520444115765787,8770145751791963091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2481520444115765787,8770145751791963091,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,2481520444115765787,8770145751791963091,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2356 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
MD5 eeaa8087eba2f63f31e599f6a7b46ef4
SHA1 f639519deee0766a39cfe258d2ac48e3a9d5ac03
SHA512 eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
MD5 b9569e123772ae290f9bac07e0d31748
SHA1 5806ed9b301d4178a959b26d7b7ccf2c0abc6741
SHA512 cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 614B
SHA256 b8d7da702014158e8b2fd9704dd82c5896c98509415163a1a3550096b0aaded6
MD5 d2fbfed9a13a4367d17e8a41e518089b
SHA1 620e1507bf450f67550a4a5da7bd70baadb5a244
SHA512 5fab9ac57211e8ea7b5c998e858ae0b1489a162ddfdd9cb7c2cc22849cdc55020ea9e08f4aa4b718940ac3e6e09d807ac444d888b148b19ff13c2cb84fff9029
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 0849f1cf34007b5d5daa0f0c42d595c5cd9aac7e5410431efd486582a5513847
MD5 a1647ec3105399188a209c35fd900688
SHA1 19043b661017483d8ce4769feda7c6f874c964e4
SHA512 2027e3a87455cad3e0284b9c51625800e82500927a5923f8ad89126ff1e57ff5ca1aa2d33582e4a8e7ae84b5cf1161ae90ff820c3c4855056ecd94aff788ddff
SSDEEP 96:ng0ok/X21DGwpvWMoiVmdeHk8R+UWQyV+VDCziEwb:ng0ok/GtGGWMXX+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e79f6789afb6ae61aca922e8a7306b29ada5954e8bc844d6a71b689d29c1820e
MD5 8cf6b15b423b960e6239231db272b4cd
SHA1 606c2007c81ba2eb60c6663aff89cf951740465a
SHA512 4e0d92cba49cd7770e83a925b9046fc03d2861ba482617eb7ab11d905a7b2d26b789518431cf64c1d02f27cdcd628614dc93383b362d9f05feed90ab3b97314b
SSDEEP 96:ng0ok/P21D+wpvWMoiVmdeEbV32k8R+UWQyV+VD7AiEwb:ng0ok/+t+GWMkV32X+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 03d59212dbfc5b485552599251a271921e594c6c6afb9373214c3d7ec0fa23cc
MD5 8eed64f9b88b9a3e99b06457bdac53da
SHA1 ddfc26b6801df1b0fcaf677b5fe1396355cc9b33
SHA512 88b6516165ef6209fccdd41a221c8e51ed411846d8fd1335921d12689f73b8dbb5a158ec4874e9649c7e48f00e5327350c58aeda7b1cb272585c147a831a4f7c
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupfde2RUcgxn9LQOl6feAOn:A9iIxuERzA83h09RZxYf569S+
MD5 SHA1 SHA512 SSDEEP

Submit Download