da7bcdf276bb6426c4952bbd4e2514b601e927308f1ffb5877dd5aad84a485f7

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0141e12ead9be2c428f8741aecef7f6_JaffaCakes118.html
Size

31KB
MD5

e0141e12ead9be2c428f8741aecef7f6
SHA1

a376587f04ee4f10c70cac03ad6463386d86f9e6
SHA256

da7bcdf276bb6426c4952bbd4e2514b601e927308f1ffb5877dd5aad84a485f7
SHA512

8c813d2da548a71937f319f0187d3ee11ab805a71390de4695c5a5ac2025bdd8a66bae092b2c888e883ef9ae418e049e7ad2b51f75d7d35be2e63f6092d3f647
SSDEEP

192:uWHlb5naFnQjxn5Q/BnQieENn1nQOkEntfHnQTbnJnQDMCoAlbLU/IfyINcsitOZ:pQ/xCuLuxVP2ZIAlkHOD

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
784	msedge.exe
784	msedge.exe
3680	msedge.exe
3680	msedge.exe
5052	identity_helper.exe
5052	identity_helper.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 1952	3680	msedge.exe	83
PID 3680 wrote to memory of 1952	3680	msedge.exe	83
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 3968	3680	msedge.exe	84
PID 3680 wrote to memory of 784	3680	msedge.exe	85
PID 3680 wrote to memory of 784	3680	msedge.exe	85
PID 3680 wrote to memory of 3684	3680	msedge.exe	86
PID 3680 wrote to memory of 3684	3680	msedge.exe	86
PID 3680 wrote to memory of 3684	3680	msedge.exe	86
PID 3680 wrote to memory of 3684	3680	msedge.exe	86
PID 3680 wrote to memory of 3684	3680	msedge.exe	86
PID 3680 wrote to memory of 3684	3680	msedge.exe	86
PID 3680 wrote to memory of 3684	3680	msedge.exe	86
PID 3680 wrote to memory of 3684	3680	msedge.exe	86
PID 3680 wrote to memory of 3684	3680	msedge.exe	86
PID 3680 wrote to memory of 3684	3680	msedge.exe	86
PID 3680 wrote to memory of 3684	3680	msedge.exe	86
PID 3680 wrote to memory of 3684	3680	msedge.exe	86
PID 3680 wrote to memory of 3684	3680	msedge.exe	86
PID 3680 wrote to memory of 3684	3680	msedge.exe	86
PID 3680 wrote to memory of 3684	3680	msedge.exe	86
PID 3680 wrote to memory of 3684	3680	msedge.exe	86
PID 3680 wrote to memory of 3684	3680	msedge.exe	86
PID 3680 wrote to memory of 3684	3680	msedge.exe	86
PID 3680 wrote to memory of 3684	3680	msedge.exe	86
PID 3680 wrote to memory of 3684	3680	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e0141e12ead9be2c428f8741aecef7f6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e39c46f8,0x7ff9e39c4708,0x7ff9e39c4718
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2284,3219040808487427015,4397235106170655457,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2284,3219040808487427015,4397235106170655457,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2284,3219040808487427015,4397235106170655457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,3219040808487427015,4397235106170655457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,3219040808487427015,4397235106170655457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2284,3219040808487427015,4397235106170655457,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2284,3219040808487427015,4397235106170655457,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,3219040808487427015,4397235106170655457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,3219040808487427015,4397235106170655457,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,3219040808487427015,4397235106170655457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,3219040808487427015,4397235106170655457,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2284,3219040808487427015,4397235106170655457,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3640 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
94e118170a2bda40f548ea3b93759c06

SHA1
ec77f21b12bc20d299e9df7a13cfb47652395df5

SHA256
bf0edd82f533b2016539373eef976ae5a5da6eba93bf7d43cd600fbc7534be6b

SHA512
5e0826a09935c3ae5fe480a5ab2eadbe0125ccfa79436b0dabb60e727975d9bbbf2cd09533bfe5cb24e4263aa0a0f4cb621a9434a3e10380e84b1ad967588659

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb3aba82e6bc59e944ff85ca1dc06b60

SHA1
e7914d06c5091aea72574b0565b081a70d138e05

SHA256
c0b93ce10c15e48a4273e93f83a3db42717c6ecabc7a3ef7ba12486be6b34be7

SHA512
d103894aad1641ef4a337bfa975fc46550adac733db8566bca12a8fcabfa31ca71508277fac9424979d588bad97fb84a0c1e01b7b99ef99ffd0a3e16a8489084

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c7cea374caec638a6ecfdf2a47f98b0b

SHA1
90ac4171a8e0a3e89135b6d62ae7ba325bb9f1f6

SHA256
79179b5e34987a240f97c204697a90638de48e235343ac911931b79990d416da

SHA512
1a1a702fc6b577929eb7907a699efa584b01bd24b675a61e7d93f7694b6febfd33e39e5ceb47360bfb16431f46f9cb03568866053de6049a690fe3da2b8d10e5

Download Submit