04f41ba8b491c2307a5d2b19f80080d89a24a8f3e09233c6701869e33f090c39

Analysis

max time kernel
145s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 16:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6bb25325c46732f73a4cfd4fecb180f_JaffaCakes118.html
Size

42KB
MD5

d6bb25325c46732f73a4cfd4fecb180f
SHA1

39e11312cc5187addc344fefd25656e1754cf199
SHA256

04f41ba8b491c2307a5d2b19f80080d89a24a8f3e09233c6701869e33f090c39
SHA512

460a3dd450697e9c23641b072ab8f5857fb0dbff765c60b5df589a0615a06ff064fd5b0f4dc4df2860b622d662e91ea708f57c7dd16ef57a5c9d68101ac50ef4
SSDEEP

768:N0b8658W/ciJ26DiIOi1uYuocxvc3lpabdZCHtgGUf69NcUMfSG3howw55FbQiwy:N0b8658W/HJ2XYRcxvcrabdYHtufiC9y

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2716	msedge.exe
2716	msedge.exe
4396	msedge.exe
4396	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 4012	4396	msedge.exe	83
PID 4396 wrote to memory of 4012	4396	msedge.exe	83
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 448	4396	msedge.exe	86
PID 4396 wrote to memory of 2716	4396	msedge.exe	87
PID 4396 wrote to memory of 2716	4396	msedge.exe	87
PID 4396 wrote to memory of 2824	4396	msedge.exe	88
PID 4396 wrote to memory of 2824	4396	msedge.exe	88
PID 4396 wrote to memory of 2824	4396	msedge.exe	88
PID 4396 wrote to memory of 2824	4396	msedge.exe	88
PID 4396 wrote to memory of 2824	4396	msedge.exe	88
PID 4396 wrote to memory of 2824	4396	msedge.exe	88
PID 4396 wrote to memory of 2824	4396	msedge.exe	88
PID 4396 wrote to memory of 2824	4396	msedge.exe	88
PID 4396 wrote to memory of 2824	4396	msedge.exe	88
PID 4396 wrote to memory of 2824	4396	msedge.exe	88
PID 4396 wrote to memory of 2824	4396	msedge.exe	88
PID 4396 wrote to memory of 2824	4396	msedge.exe	88
PID 4396 wrote to memory of 2824	4396	msedge.exe	88
PID 4396 wrote to memory of 2824	4396	msedge.exe	88
PID 4396 wrote to memory of 2824	4396	msedge.exe	88
PID 4396 wrote to memory of 2824	4396	msedge.exe	88
PID 4396 wrote to memory of 2824	4396	msedge.exe	88
PID 4396 wrote to memory of 2824	4396	msedge.exe	88
PID 4396 wrote to memory of 2824	4396	msedge.exe	88
PID 4396 wrote to memory of 2824	4396	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d6bb25325c46732f73a4cfd4fecb180f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd8f546f8,0x7ffdd8f54708,0x7ffdd8f54718
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2284,15465480466427656989,14089327700680390997,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2284,15465480466427656989,14089327700680390997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2284,15465480466427656989,14089327700680390997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,15465480466427656989,14089327700680390997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,15465480466427656989,14089327700680390997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2284,15465480466427656989,14089327700680390997,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\195cca20-10c3-403a-af73-29581f510f29.tmp

Filesize
5KB

MD5
a2798b836464faa0411c8ec5eb3e510d

SHA1
bfe557c87ced307277983e3a1c733e528ad08746

SHA256
f05699cc7d860e7cd0921b0d726bb6c90fd6850972cb201f3e5a27705df7099d

SHA512
d7c70e722d2011f63301152d6e0d39800fd5f2e01b5f48cea750a31329e5878824fd37fd3e7984b5afd6f6c095e2ebdfd92bd57a63307a03ab2bc2c199a314e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
984B

MD5
28a32680b00b4f9b71ef5c95ba42bccb

SHA1
db1752e1811e424f55e24b2d1c7847994e4c26f1

SHA256
2fc8bf7596c0aabe76f3f61dd892fef96fd917f40eed18fda5608ccd1fd2d435

SHA512
9436b34e61cadc753062eff5daaa62cd5e0cd39b1e2769910971635a6044386388db868bb515b211b2e1b2903a67c9b4ae1efae41cbbcf6295ffcd8e30a34247

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1bb5431254efded7baf49f08aa596469

SHA1
3c71c9d061d01d9b0d20c79a8276eb7d50bf9408

SHA256
c0a5c9780d0ca5f3622cea7bba85815d92b52016e8cce6be29f917399b6c690b

SHA512
79d5f8b42bc89b2960f555671edc3c2d349ed824570a8aa347e126caff141539904ca4f570de71e2f230e4ac904d557586e2032a0e6cbb28f38d17efaaf44c4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
98714e78a8aebb9235b198e00996c17e

SHA1
e287970f50d84e23bab71fbc504cdac57638312c

SHA256
32b1bb4f4d8f57c7b09d6a33c5cfdd0ab5da911ea88d0c69cdb4a9848982727f

SHA512
0c6a5025e38123dea0b4facbedf279a72bcf84e9cd48aa6376b611ee7a6516172ac59b4ac84cc4b8c186742051ffac6ba94c6d02f91467725f107b4f8b9c8cae

Download Submit