1df71b9f4d21406d09716c469e902fbfa5f4132139854783c5e7ed19adf58322

Analysis

max time kernel
150s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/09/2024, 00:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f729e23d30e3cfe7ccdecec1eb9284d5_JaffaCakes118.html
Size

49KB
MD5

f729e23d30e3cfe7ccdecec1eb9284d5
SHA1

acd34dcaefaa207f4da063aa7c7a52a3fab96c4e
SHA256

1df71b9f4d21406d09716c469e902fbfa5f4132139854783c5e7ed19adf58322
SHA512

6ae128da88284696100759f3995c3c9a04afc698232d126fd737d460ac13e3f1ea5374b4ffd9cacc7392713352daa645dd7868912dfc72fdcf8dfdb4fe89f830
SSDEEP

1536:SFbNSr+fpK0RzyjO0XiOm/KiZfR7yuuOQ8Ymz0dypajT7TW64g7dnjK7+iu:SFbaOvFJmsTMXqu

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
3216	msedge.exe
3216	msedge.exe
4316	identity_helper.exe
4316	identity_helper.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 3004	3216	msedge.exe	82
PID 3216 wrote to memory of 3004	3216	msedge.exe	82
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 1924	3216	msedge.exe	83
PID 3216 wrote to memory of 2788	3216	msedge.exe	84
PID 3216 wrote to memory of 2788	3216	msedge.exe	84
PID 3216 wrote to memory of 3964	3216	msedge.exe	85
PID 3216 wrote to memory of 3964	3216	msedge.exe	85
PID 3216 wrote to memory of 3964	3216	msedge.exe	85
PID 3216 wrote to memory of 3964	3216	msedge.exe	85
PID 3216 wrote to memory of 3964	3216	msedge.exe	85
PID 3216 wrote to memory of 3964	3216	msedge.exe	85
PID 3216 wrote to memory of 3964	3216	msedge.exe	85
PID 3216 wrote to memory of 3964	3216	msedge.exe	85
PID 3216 wrote to memory of 3964	3216	msedge.exe	85
PID 3216 wrote to memory of 3964	3216	msedge.exe	85
PID 3216 wrote to memory of 3964	3216	msedge.exe	85
PID 3216 wrote to memory of 3964	3216	msedge.exe	85
PID 3216 wrote to memory of 3964	3216	msedge.exe	85
PID 3216 wrote to memory of 3964	3216	msedge.exe	85
PID 3216 wrote to memory of 3964	3216	msedge.exe	85
PID 3216 wrote to memory of 3964	3216	msedge.exe	85
PID 3216 wrote to memory of 3964	3216	msedge.exe	85
PID 3216 wrote to memory of 3964	3216	msedge.exe	85
PID 3216 wrote to memory of 3964	3216	msedge.exe	85
PID 3216 wrote to memory of 3964	3216	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f729e23d30e3cfe7ccdecec1eb9284d5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6c5646f8,0x7ffc6c564708,0x7ffc6c564718
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,15360007572927137397,3373072728940154718,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,15360007572927137397,3373072728940154718,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,15360007572927137397,3373072728940154718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15360007572927137397,3373072728940154718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15360007572927137397,3373072728940154718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,15360007572927137397,3373072728940154718,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,15360007572927137397,3373072728940154718,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15360007572927137397,3373072728940154718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15360007572927137397,3373072728940154718,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15360007572927137397,3373072728940154718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15360007572927137397,3373072728940154718,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,15360007572927137397,3373072728940154718,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2abb4aeeded87f95e302943c7afd4705

SHA1
296c75522c47d337a9e9248715444d1f9c256077

SHA256
52d2752c986d304de59b6e09fec15fe8820115ea5d1072edcccc5530cb38df8b

SHA512
05e3591f01d24f83d94d6ef53c408b572306a99acaf86e84deedbea300fef12c630eb31005b38e8d8222c4e17218f9938efdadf0377b26f0e16e5d8122b210ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2cd3ed1bdf593c82f597c36908382976

SHA1
4aa5238af27902cfd1a2fee2b68bac8d319bca8d

SHA256
b785d9c269e0ef3daed5618571789ce12502ebdea7be6555a3b3d04369107565

SHA512
f551e1f7b3589c77b73a9638f5714388c59e3be9c61c95b15ab6d4061f299f91065a314ef64fa7a6834c4eb61813232c05f03d89595a576cb340713329f87ddc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b4dfbd1a3aedab4d3fa02518c56cc4b2

SHA1
c1a7d9da17c2ce643c7e0720204bfd9cd2e66653

SHA256
0ff2a604cb22464d4343b5d998eabe1af1d565d10564a2d42901ed5c3d90d534

SHA512
d952961a4d7cee74a3a9cee47e7782727881078c09a6c6610fe3acb61675ce9653face282242ec06d1c7d1962e12ae1413f82c9f1970d23c56d15fb3e4019918

Download Submit