b8794bf58f72da9ad3ac09b0f51491aca2486676ec87dc7b16e6d19eb8d474c4

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 15:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b657df12ee95217bb2b3b76db62b081_JaffaCakes118.html
Size

40KB
MD5

0b657df12ee95217bb2b3b76db62b081
SHA1

7b52a8f984c7b60ff3c28c6b066ea459f026ed58
SHA256

b8794bf58f72da9ad3ac09b0f51491aca2486676ec87dc7b16e6d19eb8d474c4
SHA512

62c5e2ab47284a3295356fe28877f15495dba13ea7c3f08e0d67aaa2352696dbbe4d5cd6b1eaaeb49bf197c3e1cb765c08948fe027b5e5a447b458dfb1a8455e
SSDEEP

768:3uzg4xmA2CvUVLEBCgbzX/IrFKhC8avqJCFwzAO9AoyTwqT28DM:3XumA2CvUVLEBCgbzQrg7AFwzAO9AoyS

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3184	msedge.exe
3184	msedge.exe
3028	msedge.exe
3028	msedge.exe
1972	identity_helper.exe
1972	identity_helper.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2948	3028	msedge.exe	82
PID 3028 wrote to memory of 2948	3028	msedge.exe	82
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 944	3028	msedge.exe	83
PID 3028 wrote to memory of 3184	3028	msedge.exe	84
PID 3028 wrote to memory of 3184	3028	msedge.exe	84
PID 3028 wrote to memory of 4556	3028	msedge.exe	85
PID 3028 wrote to memory of 4556	3028	msedge.exe	85
PID 3028 wrote to memory of 4556	3028	msedge.exe	85
PID 3028 wrote to memory of 4556	3028	msedge.exe	85
PID 3028 wrote to memory of 4556	3028	msedge.exe	85
PID 3028 wrote to memory of 4556	3028	msedge.exe	85
PID 3028 wrote to memory of 4556	3028	msedge.exe	85
PID 3028 wrote to memory of 4556	3028	msedge.exe	85
PID 3028 wrote to memory of 4556	3028	msedge.exe	85
PID 3028 wrote to memory of 4556	3028	msedge.exe	85
PID 3028 wrote to memory of 4556	3028	msedge.exe	85
PID 3028 wrote to memory of 4556	3028	msedge.exe	85
PID 3028 wrote to memory of 4556	3028	msedge.exe	85
PID 3028 wrote to memory of 4556	3028	msedge.exe	85
PID 3028 wrote to memory of 4556	3028	msedge.exe	85
PID 3028 wrote to memory of 4556	3028	msedge.exe	85
PID 3028 wrote to memory of 4556	3028	msedge.exe	85
PID 3028 wrote to memory of 4556	3028	msedge.exe	85
PID 3028 wrote to memory of 4556	3028	msedge.exe	85
PID 3028 wrote to memory of 4556	3028	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0b657df12ee95217bb2b3b76db62b081_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac07e46f8,0x7ffac07e4708,0x7ffac07e4718
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,7243699200117105014,1832768945186289698,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,7243699200117105014,1832768945186289698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,7243699200117105014,1832768945186289698,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7243699200117105014,1832768945186289698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7243699200117105014,1832768945186289698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7243699200117105014,1832768945186289698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7243699200117105014,1832768945186289698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7243699200117105014,1832768945186289698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7243699200117105014,1832768945186289698,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,7243699200117105014,1832768945186289698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,7243699200117105014,1832768945186289698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7243699200117105014,1832768945186289698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7243699200117105014,1832768945186289698,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,7243699200117105014,1832768945186289698,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3028 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
abd2ca000f2cae44f3d42c89bf95f662

SHA1
03261992c0d448d2597b31cff912ad956145e78d

SHA256
59bf308b2068c29ce79b2c624a8832a53cf8bdb8a6a27b65f87fe3b6ed12fa3e

SHA512
0ab222a0f89a3499d7983648d3c322985fd0ca160aeb15cb7ccb040dcc8188ab370806368d4c7db704976236d367defbf67604daeaae97a8a290e9f9038ca231

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
632594cdfaed5cadaff40d2d42d871fb

SHA1
70bbe7d0dcb6aa723621f26bbe87ad98df3e9849

SHA256
7f2258b763e89eec3cceb4d6985a502e23f3f7bdf527a9022f3ec0a34c9395f2

SHA512
b0ef439e531a7b892731c0ada43831de4612e679710ae626cd7199c98e6d00b627275ca9e4a6f88d0907effd6c68961590a4035f7725e72af36124796d536730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d53688a6c3196f8152580ac5141371d4

SHA1
fc712d0897298f12d2d2f83dc6de691a1169bfa8

SHA256
a6b70d85d266f1e6f8de526a1327efdd0e0df9f187d8a7f500f929dd6722b2d0

SHA512
6d164b225c518d45ef6c7fc98eccf591e34324afaa7e0ab7337f16a186c6c2b8b5a903a48652c6f32cb836f21e61951f8fd817b39bc5047a4258bd7bbbd758de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
699623930ae9f08ee199dc27794efca7

SHA1
ea63470f328bf8468d4b57faf975b327fde58265

SHA256
fec3e98f16026bb49920b5a8ae5d922031e3e1b5dfd9fc512d0b4b1ddec18a0b

SHA512
a7c4b14e9ad48fe288f10702034a892bc3190419e6c4a8d7faf1e515e1e5d5190d9ed550e2fdacbe21ba1393896786c4a2c058088f3bfd2d1dbd767ebb038ac7

Download Submit