9381dd7b71797e66119fd11ca9fff5152f36ad65dba814641c503247ac0c08fc

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 13:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d47ad4f64846ddb289978cf326d5b7ec_JaffaCakes118.html
Size 136KB
Sample240908-qvphps1dke
SHA256 9381dd7b71797e66119fd11ca9fff5152f36ad65dba814641c503247ac0c08fc
MD5 d47ad4f64846ddb289978cf326d5b7ec
SHA1 6c796202ed46f8082cbd7559fe0f8b55f448d45a
SHA512 b926348deeb33954fe96c355d2e1877e44c0fbe0e5560fe34f0b165a8d9e0ff22be51db1d4a4aae6718a9ca2413d8f0a3ea6138d8b780a44407bd2c0be2ab7dd
SSDEEP 3072:pMzZ9+mxsRsDuVxI1XGZeIglD/54jn2Rd68I4LYX9:Hn2Rd68IsYX9
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3992	msedge.exe
3992	msedge.exe
3736	msedge.exe
3736	msedge.exe
1080	identity_helper.exe
1080	identity_helper.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 3216	3736	msedge.exe	83
PID 3736 wrote to memory of 3216	3736	msedge.exe	83
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 1232	3736	msedge.exe	84
PID 3736 wrote to memory of 3992	3736	msedge.exe	85
PID 3736 wrote to memory of 3992	3736	msedge.exe	85
PID 3736 wrote to memory of 1120	3736	msedge.exe	86
PID 3736 wrote to memory of 1120	3736	msedge.exe	86
PID 3736 wrote to memory of 1120	3736	msedge.exe	86
PID 3736 wrote to memory of 1120	3736	msedge.exe	86
PID 3736 wrote to memory of 1120	3736	msedge.exe	86
PID 3736 wrote to memory of 1120	3736	msedge.exe	86
PID 3736 wrote to memory of 1120	3736	msedge.exe	86
PID 3736 wrote to memory of 1120	3736	msedge.exe	86
PID 3736 wrote to memory of 1120	3736	msedge.exe	86
PID 3736 wrote to memory of 1120	3736	msedge.exe	86
PID 3736 wrote to memory of 1120	3736	msedge.exe	86
PID 3736 wrote to memory of 1120	3736	msedge.exe	86
PID 3736 wrote to memory of 1120	3736	msedge.exe	86
PID 3736 wrote to memory of 1120	3736	msedge.exe	86
PID 3736 wrote to memory of 1120	3736	msedge.exe	86
PID 3736 wrote to memory of 1120	3736	msedge.exe	86
PID 3736 wrote to memory of 1120	3736	msedge.exe	86
PID 3736 wrote to memory of 1120	3736	msedge.exe	86
PID 3736 wrote to memory of 1120	3736	msedge.exe	86
PID 3736 wrote to memory of 1120	3736	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d47ad4f64846ddb289978cf326d5b7ec_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc1a4646f8,0x7ffc1a464708,0x7ffc1a464718
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,5123808881237506231,11783857577314042583,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,5123808881237506231,11783857577314042583,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,5123808881237506231,11783857577314042583,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5123808881237506231,11783857577314042583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5123808881237506231,11783857577314042583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,5123808881237506231,11783857577314042583,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,5123808881237506231,11783857577314042583,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5123808881237506231,11783857577314042583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5123808881237506231,11783857577314042583,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5123808881237506231,11783857577314042583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5123808881237506231,11783857577314042583,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,5123808881237506231,11783857577314042583,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5276 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
MD5 d7114a6cd851f9bf56cf771c37d664a2
SHA1 769c5d04fd83e583f15ab1ef659de8f883ecab8a
SHA512 33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
MD5 719923124ee00fb57378e0ebcbe894f7
SHA1 cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
SHA512 a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 461B
SHA256 cd6378fb919497076b23b29339a06056151d00f8929e3f2bd588a5dc01cf2b4b
MD5 1e5af78754fd932a21cd1f621bae2eec
SHA1 5ec1adbf8c4c11e08f63a1f4d687b379eff8d70a
SHA512 430264f67a7d6629b697143cb846490d45473cac96541f02893bb54436816ef793c97c3215efee9e99c817fa0929130808d86dfd1787c80cc7aa8e4d4e010c4a
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c2f7671a263e3eafac87d5a7b6e153dcd99196fb2d5096b6e6d9a7f917fda91f
MD5 09cfe6e798cb804d0a305b333440a655
SHA1 51b7d6c52875c07fb701850434a0447d8f019e52
SHA512 ebdac8e043f9a2a431652468cc7c80c899e656877df32e3b80d5206a9fe47920b956c1a8ac128850dfb29e17107146f375b05f1f11feffad7263de6f63ec3bfb
SSDEEP 96:ngkdKtY1ZILSFhPwpvWMoiVmdeH/GacUWQyV+VD7AiEwb:ngkdNvJFhPGWMXMrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 f8388488b9edb78f6437fa3a570c23d13884a442a44b8e94d32a880234eea035
MD5 641fadf0075d703643f175089a515cdb
SHA1 57bf7821b75438bad61c122d539d6e54934df579
SHA512 09add1e51761582a524af6b2648e0f513adb668e4e6639b8eb13e025371029d7f2c5446825242a4edd060cafa52856b10a8c64cb0e632e032008d00edfc660dd
SSDEEP 96:ngkdXtY1ZYLSFhPwpvWMoiVmdeH/bacUWQyV+VDCziEwb:ngkdCv5FhPGWMXvro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5523929979c90d4eafd0dc61e4aeb2a964b2c6d5b9e6c862f2c8c339655bd08d
MD5 82f086fe206bf445e6f3bb5e3f32984f
SHA1 ad4bb0f075ffe0b28d838087589539565b49804d
SHA512 7169d4b3c267b5131e22a79a73f5b5750bfe04c3e9313a6fadbd1d8ff61df43a951c3af1c839bcf6abe75cd763a8e639fb18431fde56bd7e3d4fa814af88e9fc
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupvFe2RUnhxNLN:A9iIxuERzA83h09RZxYvh4NLN
MD5 SHA1 SHA512 SSDEEP

Submit Download