4ee484792c541831461f2da1b4176da564598e941930a811c91b2b605f7b0b1a

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
30-09-2024 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

019b5ff0724508ac820dae97a6cfec5d_JaffaCakes118.html
Size

924B
MD5

019b5ff0724508ac820dae97a6cfec5d
SHA1

a6362a56bf863c068142ee150c0153a1720dd95f
SHA256

4ee484792c541831461f2da1b4176da564598e941930a811c91b2b605f7b0b1a
SHA512

c7331f1f59bdb613dc931bfe43b04891458a348598f3b21504ddd56d5cd453b1e78586736b761cb14451f27052ec729d2cada8643baa174c8a15bc3a75552376

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2212	msedge.exe
2212	msedge.exe
1176	msedge.exe
1176	msedge.exe
3976	identity_helper.exe
3976	identity_helper.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 2588	1176	msedge.exe	84
PID 1176 wrote to memory of 2588	1176	msedge.exe	84
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 3580	1176	msedge.exe	85
PID 1176 wrote to memory of 2212	1176	msedge.exe	86
PID 1176 wrote to memory of 2212	1176	msedge.exe	86
PID 1176 wrote to memory of 2976	1176	msedge.exe	87
PID 1176 wrote to memory of 2976	1176	msedge.exe	87
PID 1176 wrote to memory of 2976	1176	msedge.exe	87
PID 1176 wrote to memory of 2976	1176	msedge.exe	87
PID 1176 wrote to memory of 2976	1176	msedge.exe	87
PID 1176 wrote to memory of 2976	1176	msedge.exe	87
PID 1176 wrote to memory of 2976	1176	msedge.exe	87
PID 1176 wrote to memory of 2976	1176	msedge.exe	87
PID 1176 wrote to memory of 2976	1176	msedge.exe	87
PID 1176 wrote to memory of 2976	1176	msedge.exe	87
PID 1176 wrote to memory of 2976	1176	msedge.exe	87
PID 1176 wrote to memory of 2976	1176	msedge.exe	87
PID 1176 wrote to memory of 2976	1176	msedge.exe	87
PID 1176 wrote to memory of 2976	1176	msedge.exe	87
PID 1176 wrote to memory of 2976	1176	msedge.exe	87
PID 1176 wrote to memory of 2976	1176	msedge.exe	87
PID 1176 wrote to memory of 2976	1176	msedge.exe	87
PID 1176 wrote to memory of 2976	1176	msedge.exe	87
PID 1176 wrote to memory of 2976	1176	msedge.exe	87
PID 1176 wrote to memory of 2976	1176	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\019b5ff0724508ac820dae97a6cfec5d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb0f4946f8,0x7ffb0f494708,0x7ffb0f494718
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2312,17175568273421198403,273213757277175413,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2312,17175568273421198403,273213757277175413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2312,17175568273421198403,273213757277175413,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2400 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2312,17175568273421198403,273213757277175413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2312,17175568273421198403,273213757277175413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2312,17175568273421198403,273213757277175413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2312,17175568273421198403,273213757277175413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2312,17175568273421198403,273213757277175413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2312,17175568273421198403,273213757277175413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2312,17175568273421198403,273213757277175413,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2312,17175568273421198403,273213757277175413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2312,17175568273421198403,273213757277175413,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2312,17175568273421198403,273213757277175413,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7006aacd11b992cd29fca21e619e86ea

SHA1
f224b726a114d4c73d7379236739d5fbb8e7f7b7

SHA256
3c434b96841d5a0fa0a04a6b503c3c4d46f1c4e3a1be77853175e5680e182814

SHA512
6de169882c0e01217c4ca01f6ead8e5ebb316a77558e51cd862532dbf9147d9e267f8db667ff6e9fa33164243724f5e437cb882392382f3cae1072dadb762c1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b80cf20d9e8cf6a579981bfaab1bdce2

SHA1
171a886be3a882bd04206295ce7f1db5b8b7035e

SHA256
10d995b136b604440ac4033b2222543975779068a321d7bddf675d0cb2a4c2b1

SHA512
0233b34866be1afd214a1c8a9dcf8328d16246b3a5ef142295333547b4cfdc787c8627439a2ca03c20cb49107f7428d39696143b71f56b7f1f05029b3a14376a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
257ffecb7ba1094f512281eb69a84a38

SHA1
a7232751d162d7131cf05544e5842aa2318b2b95

SHA256
2242a22d806bf3ea4a9b12638afb9036422f4c335fd351b865089997a002c893

SHA512
e79fb5eddf15bead1d537385625b5a590def95bc444b826229efbf7e339a2ade3f7d4f8afc804ebc85a7e7c702b6a45d76b449a91b10524168beabb295b08094

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6009633b211ff2b0c82120f2e75dd98a

SHA1
f3e2981d34d18280999b15d894d21f7bdb5acd4d

SHA256
90e221b850e8ec080b998e5e1ddeaa29dd2549b19d315506844f20d40dca4519

SHA512
e89f5bc707ea8e4e8a4cebe6b654fe7f78934650e464811a16ea0c5bb83db9737fadb282736f0c0cde890c64184fb792a3dadaa6851124dadd992bf5fbb269b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2b530c17cd4c13b5229786a396198764

SHA1
d2bf999ff49989c0a6b6aabcf602779fdf934cf0

SHA256
f38caba2f7eb3dbe497d355933999e5bd312f95ba49b8ae715ae905b490cb12d

SHA512
5281d8a75d466ba5c2a6fcf9e93c7b12a8e5ea86d465b150c0bfdcde8e8bf280375876d3920942caa6d619e83f8c8ddd9b863833cbc7b08d1cf20287b4438fb8

Download Submit