34a92063c50895f46d64e0dc4400894ac3f0666a053e20ea70884f92dc257439

Analysis

max time kernel
145s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 11:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e01a299b403334d88d6f7a5bb9c387a8_JaffaCakes118.html
Size

131KB
MD5

e01a299b403334d88d6f7a5bb9c387a8
SHA1

5a19792f1836f52980cad8b65c5b6d48e94f48c4
SHA256

34a92063c50895f46d64e0dc4400894ac3f0666a053e20ea70884f92dc257439
SHA512

3f66daea6488b5fa993b84f6dd0d0c0f05560cb34bb1e17790936eb6619cb78d8c881872ede9961bd98cbf0714604a30bad251df6c1905311a6b347cd0292821
SSDEEP

1536:BDinItjyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9w:BDMIFyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
2888	msedge.exe
2888	msedge.exe
4980	identity_helper.exe
4980	identity_helper.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe
2888	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 1244	2888	msedge.exe	83
PID 2888 wrote to memory of 1244	2888	msedge.exe	83
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 3704	2888	msedge.exe	84
PID 2888 wrote to memory of 388	2888	msedge.exe	85
PID 2888 wrote to memory of 388	2888	msedge.exe	85
PID 2888 wrote to memory of 2568	2888	msedge.exe	86
PID 2888 wrote to memory of 2568	2888	msedge.exe	86
PID 2888 wrote to memory of 2568	2888	msedge.exe	86
PID 2888 wrote to memory of 2568	2888	msedge.exe	86
PID 2888 wrote to memory of 2568	2888	msedge.exe	86
PID 2888 wrote to memory of 2568	2888	msedge.exe	86
PID 2888 wrote to memory of 2568	2888	msedge.exe	86
PID 2888 wrote to memory of 2568	2888	msedge.exe	86
PID 2888 wrote to memory of 2568	2888	msedge.exe	86
PID 2888 wrote to memory of 2568	2888	msedge.exe	86
PID 2888 wrote to memory of 2568	2888	msedge.exe	86
PID 2888 wrote to memory of 2568	2888	msedge.exe	86
PID 2888 wrote to memory of 2568	2888	msedge.exe	86
PID 2888 wrote to memory of 2568	2888	msedge.exe	86
PID 2888 wrote to memory of 2568	2888	msedge.exe	86
PID 2888 wrote to memory of 2568	2888	msedge.exe	86
PID 2888 wrote to memory of 2568	2888	msedge.exe	86
PID 2888 wrote to memory of 2568	2888	msedge.exe	86
PID 2888 wrote to memory of 2568	2888	msedge.exe	86
PID 2888 wrote to memory of 2568	2888	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e01a299b403334d88d6f7a5bb9c387a8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffe5c8c46f8,0x7ffe5c8c4708,0x7ffe5c8c4718
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,13210144843126577587,17485197868915517259,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1864,13210144843126577587,17485197868915517259,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1864,13210144843126577587,17485197868915517259,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13210144843126577587,17485197868915517259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13210144843126577587,17485197868915517259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1864,13210144843126577587,17485197868915517259,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1864,13210144843126577587,17485197868915517259,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13210144843126577587,17485197868915517259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13210144843126577587,17485197868915517259,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13210144843126577587,17485197868915517259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13210144843126577587,17485197868915517259,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,13210144843126577587,17485197868915517259,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2756 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a4753a38ea0499792737e7a08f3adbb1

SHA1
66d83118a0ff1210069746b9f3c9079274209534

SHA256
f66e328485ba9bba8e4d1321f614414fc97c8caf783a03dc9a9541a7681165a9

SHA512
356cae983678156784f7f5254b21717ead8b3a8b1b91f2957d4587e6ea2a3edb618fabefae3fe87dc25f2473ec0a17010fa7d4e27c86303798e09e832b6a986b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
90e9fd34d1a7fa3993b6a9f03b8f02f6

SHA1
1685f3a3032b31726b8276ce1fdf6529fd463dbc

SHA256
41af04d28da1fca13c91c2a7fde172d456741a47c7f02e93d3e8a168a7cc8868

SHA512
761ba45fc449d5efe58d57e2d54a9c214bf2cb8abf6e2c772c5b8feb5ad0996199822216dd8b7cd46604bae8a8b322a475437c7e41065d3dfe59079dd917f15f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3b3c2129b14e32e3e16cd99ae437cf00

SHA1
c588b47e1cb85fce5b058f6322f1e23099e1d1d8

SHA256
9469328720db580dda0fd4297c0c69d0cdc4cb52a64adf480dc51bfd5d4af59d

SHA512
0e283e73033e41b46985ba775b6d931b8ee8ec86246e246122c103184c920747ffeab22dbf85f126b58ac4b0006cdfd2dcd945785f3d912dc3622ac555f333e0

Download Submit