6e696d7b4868801900eb78733a523e50044c1913e6e02673d6750eb85456a592

Analysis

max time kernel
146s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 04:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0472fc20e10dd4ff36dcc3fe36634d5d_JaffaCakes118.html
Size

3.5MB
MD5

0472fc20e10dd4ff36dcc3fe36634d5d
SHA1

d495eb72652eb4fa571befb7ebcfb5b6efc261d6
SHA256

6e696d7b4868801900eb78733a523e50044c1913e6e02673d6750eb85456a592
SHA512

bf17cdb4982dd6984cef59e733ffe9444f4997f80cd632c0e97bfe4e031cd2bf9f06ae7aa06ba15469171ed62e0884715483319b17457c81b8827ebba6abb543
SSDEEP

12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NS6:jvpjte4tT646

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3344	msedge.exe
3344	msedge.exe
2044	msedge.exe
2044	msedge.exe
2968	identity_helper.exe
2968	identity_helper.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 4888	2044	msedge.exe	82
PID 2044 wrote to memory of 4888	2044	msedge.exe	82
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 2672	2044	msedge.exe	83
PID 2044 wrote to memory of 3344	2044	msedge.exe	84
PID 2044 wrote to memory of 3344	2044	msedge.exe	84
PID 2044 wrote to memory of 1792	2044	msedge.exe	85
PID 2044 wrote to memory of 1792	2044	msedge.exe	85
PID 2044 wrote to memory of 1792	2044	msedge.exe	85
PID 2044 wrote to memory of 1792	2044	msedge.exe	85
PID 2044 wrote to memory of 1792	2044	msedge.exe	85
PID 2044 wrote to memory of 1792	2044	msedge.exe	85
PID 2044 wrote to memory of 1792	2044	msedge.exe	85
PID 2044 wrote to memory of 1792	2044	msedge.exe	85
PID 2044 wrote to memory of 1792	2044	msedge.exe	85
PID 2044 wrote to memory of 1792	2044	msedge.exe	85
PID 2044 wrote to memory of 1792	2044	msedge.exe	85
PID 2044 wrote to memory of 1792	2044	msedge.exe	85
PID 2044 wrote to memory of 1792	2044	msedge.exe	85
PID 2044 wrote to memory of 1792	2044	msedge.exe	85
PID 2044 wrote to memory of 1792	2044	msedge.exe	85
PID 2044 wrote to memory of 1792	2044	msedge.exe	85
PID 2044 wrote to memory of 1792	2044	msedge.exe	85
PID 2044 wrote to memory of 1792	2044	msedge.exe	85
PID 2044 wrote to memory of 1792	2044	msedge.exe	85
PID 2044 wrote to memory of 1792	2044	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0472fc20e10dd4ff36dcc3fe36634d5d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83a3746f8,0x7ff83a374708,0x7ff83a374718
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,3030446060544348040,709408117981958554,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,3030446060544348040,709408117981958554,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,3030446060544348040,709408117981958554,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3030446060544348040,709408117981958554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3030446060544348040,709408117981958554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,3030446060544348040,709408117981958554,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,3030446060544348040,709408117981958554,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3030446060544348040,709408117981958554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3030446060544348040,709408117981958554,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3030446060544348040,709408117981958554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3030446060544348040,709408117981958554,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,3030446060544348040,709408117981958554,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1376 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
981B

MD5
04e87a6dc6c50ea1f769e00fca5f3039

SHA1
1d7543fde5dce83a7763494759ef107e73dbb296

SHA256
bf015854eeb654de7ebcba904be4b5c3b5dccb5dc436b8aa99332f35250b11bb

SHA512
0a8c3ecc01bc9e050435852977e0e2c066fce9b4aeee6a485d9ebcdcdb13fc02a8e20c04f9fd190b01527fe59b8d0d999773e2e764f3e0350a97c3bb12b450bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
21515621f9b560528d359cf61b5373bb

SHA1
01b152ec20d95b63495a1b4ae13f58b999b1ea94

SHA256
70c2f8ae8db6ca6fc963961ba3728c07e7c5e86d001c3774191e2fec281bd8ce

SHA512
8804b05b5b885fdd0760084e2cbabf480dabb5ca0b16340b6d2ea0b41ce14ffaae44a845106d62293ef3f7c223b66cae80c04730c8e6d2dae9b7690003f3cb73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4ebe898e681c2a58b72bf647e97dd5c9

SHA1
7dc9b9ac23a066dcac4f92f4044cfbb74baff14a

SHA256
0beb2c758cdafd0cd5aa7ee27175095b8a32f11d0ae57700c44d01648e306a00

SHA512
2419c095e44477ae66f8b1087616ef255575eb03da4db4f0d7071e81fec255593198defddeaf79d5db9a650626332e06897a42d3c4a52b4c166820902232bbf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
87b620d54263a6a8622fd4f6b47a2f82

SHA1
1e888cbefb1fd3406215930826f939b9a604410a

SHA256
f5d5ed3922128e08cced0dc5d449c8a2ae0476066519738b096020167410cb4d

SHA512
a8aaeb7099430794465a8f5d0cc9315a3c85b7035c5d8ed201b7be1c29172007654fe43a8d554a8bf70a4bae04d6e2071b5c7fee38fedb5af0264f96aa18a628

Download Submit