1fd8bb5285dd140f26c6cc09e88bd05915e691735a6d63a86b43b9b70b58b769

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 14:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc62586de5dab0a3829f1b30b8e26182_JaffaCakes118.html
Size

18KB
MD5

dc62586de5dab0a3829f1b30b8e26182
SHA1

504c01e429aae564e203b4aecc4d4bef35999366
SHA256

1fd8bb5285dd140f26c6cc09e88bd05915e691735a6d63a86b43b9b70b58b769
SHA512

2adb313d80e7361fdfbad39feb705d12dcc23d96eebb96531f497fbf7cb5df3e19f4e5fc82d2107b0f8f7820b81ea6742618929cd77ac3512a7a1dfc0a9ceff0
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIG4QzUnjBhU+82qDB8:SIMd0I5nvHbsvUtxDB8

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
4124	msedge.exe
4124	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4124	msedge.exe
4124	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 548	4124	msedge.exe	83
PID 4124 wrote to memory of 548	4124	msedge.exe	83
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 2396	4124	msedge.exe	84
PID 4124 wrote to memory of 4180	4124	msedge.exe	85
PID 4124 wrote to memory of 4180	4124	msedge.exe	85
PID 4124 wrote to memory of 4192	4124	msedge.exe	86
PID 4124 wrote to memory of 4192	4124	msedge.exe	86
PID 4124 wrote to memory of 4192	4124	msedge.exe	86
PID 4124 wrote to memory of 4192	4124	msedge.exe	86
PID 4124 wrote to memory of 4192	4124	msedge.exe	86
PID 4124 wrote to memory of 4192	4124	msedge.exe	86
PID 4124 wrote to memory of 4192	4124	msedge.exe	86
PID 4124 wrote to memory of 4192	4124	msedge.exe	86
PID 4124 wrote to memory of 4192	4124	msedge.exe	86
PID 4124 wrote to memory of 4192	4124	msedge.exe	86
PID 4124 wrote to memory of 4192	4124	msedge.exe	86
PID 4124 wrote to memory of 4192	4124	msedge.exe	86
PID 4124 wrote to memory of 4192	4124	msedge.exe	86
PID 4124 wrote to memory of 4192	4124	msedge.exe	86
PID 4124 wrote to memory of 4192	4124	msedge.exe	86
PID 4124 wrote to memory of 4192	4124	msedge.exe	86
PID 4124 wrote to memory of 4192	4124	msedge.exe	86
PID 4124 wrote to memory of 4192	4124	msedge.exe	86
PID 4124 wrote to memory of 4192	4124	msedge.exe	86
PID 4124 wrote to memory of 4192	4124	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dc62586de5dab0a3829f1b30b8e26182_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe26cb46f8,0x7ffe26cb4708,0x7ffe26cb4718
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,192476725042948406,3333284825614032252,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,192476725042948406,3333284825614032252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,192476725042948406,3333284825614032252,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,192476725042948406,3333284825614032252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,192476725042948406,3333284825614032252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,192476725042948406,3333284825614032252,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3040 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ee05091bedb7d9896d05126ef7a588f6

SHA1
3c515b9ba703cba6a0840eac36ecae3790491c15

SHA256
3dd5c52fbd274f97cac2f3bbbef56bdf0adbdc1879ee6a0cded594b0a6ea8f5c

SHA512
f8ee523ad6182fcabd3205e5c3a4f38eebf4add2cad4d727ab1bbea1bd64b5057464e49f378cd19d86748086b70c79af46f4c2177a8596124f10e77045f9fbdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2b9a127bb1c87b89d2d0aae7265f951d

SHA1
b0b2857f909331e4be934ebd0ca7c9ff4520caf3

SHA256
db620726936a61f3cf91886ecbe5fa569500ebd20b6e8e2e321db09b2a9fada4

SHA512
acc9821ca52354cea696b55835a6465840d3e2fb5906d3478b1a4e08aed1dce8176eea94eb416d2efc849ed4563b5d30049c3a24c33aaf02357cec126b5356e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4d41f05d7f75856774893663e5e425ac

SHA1
92453c7d5fdcae5a753a6a076c866abce157fe75

SHA256
6b3bb552e0edb22871a82926b24b419089207ef7c173a2cf2ad5223943909645

SHA512
a5d5dac3953cbe276c94288fce52abbf5a85e23f96813e9381061cd709860b1c4c0ff10cfdf7c494690ded366d3948ab3892c6abaec83f0b3f037fece588b7fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
15609f65da469986d16d84127b445b7e

SHA1
4259624bda83408282e605fdbe41c8d01a4e144d

SHA256
7975896f4c9cd20a9a28727d5597d53a61aac2da0d1d070b76487913eb6e9276

SHA512
e76eb7bd63b412dac442b7182b21fa1953a9dcac47dbd1d4641f2249a3217de86e6aec0d06ff59157442ea1c7d2ba6952690471c72495852f70a9569ed0abad6

Download Submit