3f267360017050e048d96493633d6f6924d463ad4a112e1e39c501fd271c960a

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 18:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dea8fc7b62084e9c2c81264a57d048f9_JaffaCakes118.html
Size

36KB
MD5

dea8fc7b62084e9c2c81264a57d048f9
SHA1

34bd55b3d04cb33cdfa5243a6e4ca57bd8150917
SHA256

3f267360017050e048d96493633d6f6924d463ad4a112e1e39c501fd271c960a
SHA512

2312118546b7289924507fedaa4b96bb930d3cf0a6a9bbf60d1efbd0edf18578377860a0b42bdf9d1f6f7bdb44ccb2e13596af4631731ed3795d8a7321ef1da7
SSDEEP

768:zwx/MDTHWI88hARNZPXYE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TbiD6eGx6OxJy6z:Q/7bJxNVdu6SQ/C8/K

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3932	msedge.exe
3932	msedge.exe
2784	msedge.exe
2784	msedge.exe
1284	identity_helper.exe
1284	identity_helper.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 628	2784	msedge.exe	83
PID 2784 wrote to memory of 628	2784	msedge.exe	83
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 3932	2784	msedge.exe	85
PID 2784 wrote to memory of 3932	2784	msedge.exe	85
PID 2784 wrote to memory of 1088	2784	msedge.exe	86
PID 2784 wrote to memory of 1088	2784	msedge.exe	86
PID 2784 wrote to memory of 1088	2784	msedge.exe	86
PID 2784 wrote to memory of 1088	2784	msedge.exe	86
PID 2784 wrote to memory of 1088	2784	msedge.exe	86
PID 2784 wrote to memory of 1088	2784	msedge.exe	86
PID 2784 wrote to memory of 1088	2784	msedge.exe	86
PID 2784 wrote to memory of 1088	2784	msedge.exe	86
PID 2784 wrote to memory of 1088	2784	msedge.exe	86
PID 2784 wrote to memory of 1088	2784	msedge.exe	86
PID 2784 wrote to memory of 1088	2784	msedge.exe	86
PID 2784 wrote to memory of 1088	2784	msedge.exe	86
PID 2784 wrote to memory of 1088	2784	msedge.exe	86
PID 2784 wrote to memory of 1088	2784	msedge.exe	86
PID 2784 wrote to memory of 1088	2784	msedge.exe	86
PID 2784 wrote to memory of 1088	2784	msedge.exe	86
PID 2784 wrote to memory of 1088	2784	msedge.exe	86
PID 2784 wrote to memory of 1088	2784	msedge.exe	86
PID 2784 wrote to memory of 1088	2784	msedge.exe	86
PID 2784 wrote to memory of 1088	2784	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dea8fc7b62084e9c2c81264a57d048f9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc457746f8,0x7ffc45774708,0x7ffc45774718
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,17609182298146599706,9287999558395710770,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,17609182298146599706,9287999558395710770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,17609182298146599706,9287999558395710770,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,17609182298146599706,9287999558395710770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,17609182298146599706,9287999558395710770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,17609182298146599706,9287999558395710770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,17609182298146599706,9287999558395710770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,17609182298146599706,9287999558395710770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,17609182298146599706,9287999558395710770,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,17609182298146599706,9287999558395710770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,17609182298146599706,9287999558395710770,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,17609182298146599706,9287999558395710770,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2740 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
613B

MD5
848e75537573849cb6520980ba17395f

SHA1
dd897131fae675a3ea88ee30f4d01876f92c15a7

SHA256
d9d7dabd98327a93856e20e936810e37ef5afd71dbd160fbfd29dd03a40a3e0f

SHA512
066e33aa8a781758c6db499e5f203455eab58e9737516292a83a3050c325e5f7c07cb83e58ddc02bad57171fe8bab066c142503531bef3419fecd5e9c17a07cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ba35b2a5c9308c9747a59c67344b9487

SHA1
9797513a9e81477fec6c18bb8dd19726df163936

SHA256
d356d1380b33631341f08c869f87a05299ccaaf1fd6ea20205f64ad37164eb69

SHA512
3486c6c5a71ada19764700b51d882619f9adef2c33db8aa6b503c8162eccf6f83de41d2105ef051b0b35ae3b70724e80e8b18344dfef4bbd3b609251389e6b6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5d9d8bfd0a86a0df88a5290041cd4b93

SHA1
b906d9f57dffcc5e7ef164a1b9d2a63968d7dacc

SHA256
8ac2efeb3b72b7d506908763c9e5ac5a2e0dece12b7102a2b25a5a28080ecb26

SHA512
71d95d6bf0e66a1a30c9fcf345f1a33ee1788cbc8c64882fefcdf5b7789cfc1b913e9c8cb68b984a394111a759c81dcadb8d1e056940505f91c35cba432ce2cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6cf4b80cbc3b15932fe5335367d61df3

SHA1
d02044460b86ea6034596657eaf97da8d84b8a96

SHA256
696fd3bc6678d5613ba206fc0c5c9eaacb8dd076a4430e37a445b319e6c62a33

SHA512
814916eb7d161ce0a6a246c0b07e2583a5ee0776d229daf0b859ce3002c038b88f53af61b3a31452b7774d0012b284fcc435c01cf3a7359194b1cb294bc708f2

Download Submit