693ead928f9908f25b8389a9bd65a7430cedd0a97e8fd41851809e554b0e48f5

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0f0b0c4fb115b987b93cb3e3514db59c_JaffaCakes118.html
Size

9KB
MD5

0f0b0c4fb115b987b93cb3e3514db59c
SHA1

e4ca05fcc62baea2eaf1342514033fa967e29944
SHA256

693ead928f9908f25b8389a9bd65a7430cedd0a97e8fd41851809e554b0e48f5
SHA512

ddb6beceaab659dfe0738d05c4b5c4f5fc175f9aff8b1eb7e822acc15db5e3e840fa66a924c3e80c3f947a4f4710c78bbad865134a1e41568178566ce97b445d
SSDEEP

96:uzVs+ux71wXLLY1k9o84d12ef7CSTUcGT/kd6pNQlVHcEZ7ru7f:csz71oAYS/VONQPHb76f

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4028	msedge.exe
4028	msedge.exe
956	msedge.exe
956	msedge.exe
4668	identity_helper.exe
4668	identity_helper.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 4920	956	msedge.exe	82
PID 956 wrote to memory of 4920	956	msedge.exe	82
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 3364	956	msedge.exe	83
PID 956 wrote to memory of 4028	956	msedge.exe	84
PID 956 wrote to memory of 4028	956	msedge.exe	84
PID 956 wrote to memory of 2092	956	msedge.exe	85
PID 956 wrote to memory of 2092	956	msedge.exe	85
PID 956 wrote to memory of 2092	956	msedge.exe	85
PID 956 wrote to memory of 2092	956	msedge.exe	85
PID 956 wrote to memory of 2092	956	msedge.exe	85
PID 956 wrote to memory of 2092	956	msedge.exe	85
PID 956 wrote to memory of 2092	956	msedge.exe	85
PID 956 wrote to memory of 2092	956	msedge.exe	85
PID 956 wrote to memory of 2092	956	msedge.exe	85
PID 956 wrote to memory of 2092	956	msedge.exe	85
PID 956 wrote to memory of 2092	956	msedge.exe	85
PID 956 wrote to memory of 2092	956	msedge.exe	85
PID 956 wrote to memory of 2092	956	msedge.exe	85
PID 956 wrote to memory of 2092	956	msedge.exe	85
PID 956 wrote to memory of 2092	956	msedge.exe	85
PID 956 wrote to memory of 2092	956	msedge.exe	85
PID 956 wrote to memory of 2092	956	msedge.exe	85
PID 956 wrote to memory of 2092	956	msedge.exe	85
PID 956 wrote to memory of 2092	956	msedge.exe	85
PID 956 wrote to memory of 2092	956	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0f0b0c4fb115b987b93cb3e3514db59c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdef0446f8,0x7ffdef044708,0x7ffdef044718
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2895167894539149975,13993123617965850818,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,2895167894539149975,13993123617965850818,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,2895167894539149975,13993123617965850818,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2895167894539149975,13993123617965850818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2895167894539149975,13993123617965850818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,2895167894539149975,13993123617965850818,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,2895167894539149975,13993123617965850818,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2895167894539149975,13993123617965850818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2895167894539149975,13993123617965850818,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2895167894539149975,13993123617965850818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2895167894539149975,13993123617965850818,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2895167894539149975,13993123617965850818,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1256 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
af518578755b1b341f6882bc9e0fce5f

SHA1
30e830c870b6e32e510df87a444ea4d6fac5d1f3

SHA256
e873860e507958cdd6dc5f2a30af0a49eac7451dc00e999fa266c8964949a3ed

SHA512
4355ffeced4ddb0f20fb1d3ef00fabf2e08d8e57b49f26ab16d22225e11b9531ada3e54639f5a3f18918ce8d1f5e5c39e29bdfeace4a745c0d94ab1268ab5da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
73e39b06af1cc63371a94240c2f81e3e

SHA1
65d910eb2dd7a80eec1af22dac8dcc94531c5894

SHA256
c36620425d243549d50bf8cfbd453c771e0f1ebbdebf186493aa5e88ccb9d5b3

SHA512
20ff7b2d477c3080303d9e75a457173eda661003d9f208399fc60a5236cdef129112d655ec3e331330c7690a15d756135aa4b02e895c9e4346b8ce6a21bb07f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e564903f04225d1236b70e62a7d9cc9d

SHA1
aaabd3f3c0f64055dce0f6bdc91d2e9cb2f0e985

SHA256
3c99e719bbfe5d16ac69627ae008fa9556f40552a984550267bfb8ff3225d6e8

SHA512
a8a4ded1686904211fc41cb665bff19f5bd7c4de1b6e627eaab8e3a24b73d0ffa3540a3e408a8ae2d39c1d083c1f9b51fb44b3e59ec01a561b62c196cdf92317

Download Submit