da799ab6f621e6df024f93a8985b84d8e07493a7f94030c83147547df206a62b

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 02:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4f49250fb895364ea1672ca6eeb874d_JaffaCakes118.html
Size

24KB
MD5

f4f49250fb895364ea1672ca6eeb874d
SHA1

1330fb4cb3ec6c31fb45f304b3c64d47ae069a81
SHA256

da799ab6f621e6df024f93a8985b84d8e07493a7f94030c83147547df206a62b
SHA512

074374af5861143664ff865c28a65d587f9ab035ca4f9e767e5760cfedc54d9e875b72292184ba3679e64a4274a0e9caaadf7a30e947957b7d534e324476ca00
SSDEEP

192:uqN7HRb5nW7unQjxn5Q/fnQieZNnwnQOkEntFYnQTbn75nQeCJVevo7NtIFo+NzK:nIQ/7ygcnnB5

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
1668	msedge.exe
1668	msedge.exe
1536	identity_helper.exe
1536	identity_helper.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 3136	1668	msedge.exe	82
PID 1668 wrote to memory of 3136	1668	msedge.exe	82
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 3624	1668	msedge.exe	83
PID 1668 wrote to memory of 4712	1668	msedge.exe	84
PID 1668 wrote to memory of 4712	1668	msedge.exe	84
PID 1668 wrote to memory of 4628	1668	msedge.exe	85
PID 1668 wrote to memory of 4628	1668	msedge.exe	85
PID 1668 wrote to memory of 4628	1668	msedge.exe	85
PID 1668 wrote to memory of 4628	1668	msedge.exe	85
PID 1668 wrote to memory of 4628	1668	msedge.exe	85
PID 1668 wrote to memory of 4628	1668	msedge.exe	85
PID 1668 wrote to memory of 4628	1668	msedge.exe	85
PID 1668 wrote to memory of 4628	1668	msedge.exe	85
PID 1668 wrote to memory of 4628	1668	msedge.exe	85
PID 1668 wrote to memory of 4628	1668	msedge.exe	85
PID 1668 wrote to memory of 4628	1668	msedge.exe	85
PID 1668 wrote to memory of 4628	1668	msedge.exe	85
PID 1668 wrote to memory of 4628	1668	msedge.exe	85
PID 1668 wrote to memory of 4628	1668	msedge.exe	85
PID 1668 wrote to memory of 4628	1668	msedge.exe	85
PID 1668 wrote to memory of 4628	1668	msedge.exe	85
PID 1668 wrote to memory of 4628	1668	msedge.exe	85
PID 1668 wrote to memory of 4628	1668	msedge.exe	85
PID 1668 wrote to memory of 4628	1668	msedge.exe	85
PID 1668 wrote to memory of 4628	1668	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f4f49250fb895364ea1672ca6eeb874d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd139a46f8,0x7ffd139a4708,0x7ffd139a4718
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,7149079083594939492,15159078677455578254,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,7149079083594939492,15159078677455578254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,7149079083594939492,15159078677455578254,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7149079083594939492,15159078677455578254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7149079083594939492,15159078677455578254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,7149079083594939492,15159078677455578254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 /prefetch:8
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,7149079083594939492,15159078677455578254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7149079083594939492,15159078677455578254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7149079083594939492,15159078677455578254,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7149079083594939492,15159078677455578254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7149079083594939492,15159078677455578254,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,7149079083594939492,15159078677455578254,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1412 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2074233229111662c04e1cb632decc7b

SHA1
3e09abdb45cefa07a92977f3f4ac7eaf6db6ad48

SHA256
4abd13ee8e360f38f036b1caa48e2a62d79450e632c0b2e51ed6f184929e31da

SHA512
ea7734ce2f6311f06a5772f03964c94f4c00efc26c9bb61674f68e2cc66265f15ae2ae798e52d66e0eabefcc83b93b26c1c7a35aa5a874d524ea823cf97d7ba1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
56ebc37dd6392f80f258d04f8097f1ac

SHA1
d0d5307f9e9baf58eeed33e806397ca45faf6717

SHA256
92cea7ae913c9b46280ab87114e86fb72ab9dc45f88a0df8befbc53b4497b86f

SHA512
2aadadcc4ead4875416e2986aaa5c784d7a859efb800a4d9bcdaf12434cb0bad7ff420b0e2231a3f50ce93ee08775d8082be1c005c02d861ac4dcabc0936c8a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
213e535590bea383d81473f2fefeac7e

SHA1
58d1c954bb0e9f84b743c3870b2b1282c21ff58e

SHA256
300a810819185534932b9761209c7f9849687c23124d7b6ab4c113164321266a

SHA512
f4445f7b8094dfcdf10176dad8d96c01a48138710e4566434770fbf118be1c454b1d162fb9f98b2933d7604bfd1565266348e3cf828467e14c815ca4b2b7b1f8

Download Submit