11ab9ce99545dca09f361f60f6247b630dc2613982f6f2fd99472b7fb58fe2ca

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09-09-2024 12:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d65a611652fcbea77cf96bb22cf0b099_JaffaCakes118.html
Size

68KB
MD5

d65a611652fcbea77cf96bb22cf0b099
SHA1

7d751de23d40cf4eec15d776f20ca4c52660c9f9
SHA256

11ab9ce99545dca09f361f60f6247b630dc2613982f6f2fd99472b7fb58fe2ca
SHA512

9dab5649289098854d3dcadb20f30c977d4b9f8246f4d52bfbf2178227b0bafb8ca8658a17f5ffe352eaab8e232015722923f8e4f0078e95c080746e8e232ab2
SSDEEP

1536:NCC+yfE+7fvvRZYlqXAOBxHQGE0FGZnD9hJmFbJxaQBaLt7x94cd2F9abh2Nqbdm:7viFUJ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3940	msedge.exe
3940	msedge.exe
4792	msedge.exe
4792	msedge.exe
1112	identity_helper.exe
1112	identity_helper.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 3144	4792	msedge.exe	85
PID 4792 wrote to memory of 3144	4792	msedge.exe	85
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 4828	4792	msedge.exe	86
PID 4792 wrote to memory of 3940	4792	msedge.exe	87
PID 4792 wrote to memory of 3940	4792	msedge.exe	87
PID 4792 wrote to memory of 3816	4792	msedge.exe	88
PID 4792 wrote to memory of 3816	4792	msedge.exe	88
PID 4792 wrote to memory of 3816	4792	msedge.exe	88
PID 4792 wrote to memory of 3816	4792	msedge.exe	88
PID 4792 wrote to memory of 3816	4792	msedge.exe	88
PID 4792 wrote to memory of 3816	4792	msedge.exe	88
PID 4792 wrote to memory of 3816	4792	msedge.exe	88
PID 4792 wrote to memory of 3816	4792	msedge.exe	88
PID 4792 wrote to memory of 3816	4792	msedge.exe	88
PID 4792 wrote to memory of 3816	4792	msedge.exe	88
PID 4792 wrote to memory of 3816	4792	msedge.exe	88
PID 4792 wrote to memory of 3816	4792	msedge.exe	88
PID 4792 wrote to memory of 3816	4792	msedge.exe	88
PID 4792 wrote to memory of 3816	4792	msedge.exe	88
PID 4792 wrote to memory of 3816	4792	msedge.exe	88
PID 4792 wrote to memory of 3816	4792	msedge.exe	88
PID 4792 wrote to memory of 3816	4792	msedge.exe	88
PID 4792 wrote to memory of 3816	4792	msedge.exe	88
PID 4792 wrote to memory of 3816	4792	msedge.exe	88
PID 4792 wrote to memory of 3816	4792	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d65a611652fcbea77cf96bb22cf0b099_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9ada746f8,0x7ff9ada74708,0x7ff9ada74718
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,14318963439536477906,3868013446821443301,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,14318963439536477906,3868013446821443301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,14318963439536477906,3868013446821443301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14318963439536477906,3868013446821443301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14318963439536477906,3868013446821443301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14318963439536477906,3868013446821443301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,14318963439536477906,3868013446821443301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,14318963439536477906,3868013446821443301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14318963439536477906,3868013446821443301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14318963439536477906,3868013446821443301,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14318963439536477906,3868013446821443301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14318963439536477906,3868013446821443301,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,14318963439536477906,3868013446821443301,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
914B

MD5
8a04cae19f5c16acaa6106c69bd488e2

SHA1
695b37d76084b475ad16be2e92b57a90ddce76f8

SHA256
e260bb01da9d4cf1e2fbe5d5527ca0f4c2e49fd494235c96b1e7260a64320bf4

SHA512
f5aaed566d00f4799b254026eb88b40329511fa82a2936203b1022a7c4039e9a6c73470d1cf1f3db967db0399b88284a90704ac5fe7c4570270c9b4ed89e070c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c7b5a93cd1b87ef7938465f3ce240ce9

SHA1
d240383f5b94a6c74280af28f56c8f73cd92ca57

SHA256
28611e5f04cab14cb3da019c6f20961c9468763f27db71caebcaac9d6dfaa385

SHA512
6d7441fd58f627b3eafcf1ba4dc7027eaabe12a3a437d2d0eb0dee193c3925700eb9006009476fe083f3dba806bfad8c2899945fdc0eb2b7be2d8f0df27e4930

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7c0d6483075d3da9055b4d19eb9e8c64

SHA1
de278d9f7f00bda16dc593bfd780cb2d0a99df90

SHA256
234927faf0b831bb0fd7894645c290f8cc16f9d86a0d3c0d999365004bce8be1

SHA512
906e2d7364329f41581173c9db2250af6aa8ea7c0d3e9ab4c4e6392c959b9676c9891f96fe2a5a662b103554766add9e4ad9a719946e3589e8b3b6172e7ec59f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1002f1a6694a40804435d1008241f789

SHA1
cef0803f1c987f1088f79fa572731de312be3ff1

SHA256
bcc5533c92f00df2003a05ac39907bec1ee4f53bfa12ebfa06e64c80274a0e7f

SHA512
c8849795b9edfed805582fb1f95973a3a13847e4d6a3a8d5dc738ec6cbc172e2fa81b4d47ca423b162690676e7ca38ea99cec3b3a48b6b95ec0568570551cafc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
47e9f4b7e5d623ae535fd71123c7e798

SHA1
7d6be7d60c1c2e79ea29da3464a508a7c1d941eb

SHA256
150d40d90b6c7f9c88de0a41633f1304ed1aea1b79af5b843cfc0a2aa5ceeef8

SHA512
002836e86e7a26898bf12d53f2355f46a8e9cda26e6c5ebe4b11c1aa8ce92699450c2dee1a5d8f208fcd2199568ffc3b0496e557e861036c459f544e3f99d60e

Download Submit