cbca11c3da47fe51b37d04c863f281d2c002270cb5e32e021a3a0a4c954425f3

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 05:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1219d950d8a9efa941e01d3cfd84da24_JaffaCakes118.html
Size

62KB
MD5

1219d950d8a9efa941e01d3cfd84da24
SHA1

196f60cfc25ede5d0df456fdb93ba82b65dbef53
SHA256

cbca11c3da47fe51b37d04c863f281d2c002270cb5e32e021a3a0a4c954425f3
SHA512

9aeb447a0ba5b852442bf5fe86b894f8ceafbec24a2cbc673f792cb95ceb14fbdb15c87a0b4da99d4d1b1322b385caf52156be3114c91e7ad563da9fa7ecbf3a
SSDEEP

384:KsN2OZ82wSeg4e92Leu2Je/2ked2teE2cRpwes2XeQ2sep2kMeD2eeF2vae62D3b:K+2OZKSvapuV3WD98uEwbWN8O7Tw5UWQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2848	msedge.exe
2848	msedge.exe
3540	msedge.exe
3540	msedge.exe
2388	identity_helper.exe
2388	identity_helper.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 1748	3540	msedge.exe	82
PID 3540 wrote to memory of 1748	3540	msedge.exe	82
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 4316	3540	msedge.exe	83
PID 3540 wrote to memory of 2848	3540	msedge.exe	84
PID 3540 wrote to memory of 2848	3540	msedge.exe	84
PID 3540 wrote to memory of 1860	3540	msedge.exe	85
PID 3540 wrote to memory of 1860	3540	msedge.exe	85
PID 3540 wrote to memory of 1860	3540	msedge.exe	85
PID 3540 wrote to memory of 1860	3540	msedge.exe	85
PID 3540 wrote to memory of 1860	3540	msedge.exe	85
PID 3540 wrote to memory of 1860	3540	msedge.exe	85
PID 3540 wrote to memory of 1860	3540	msedge.exe	85
PID 3540 wrote to memory of 1860	3540	msedge.exe	85
PID 3540 wrote to memory of 1860	3540	msedge.exe	85
PID 3540 wrote to memory of 1860	3540	msedge.exe	85
PID 3540 wrote to memory of 1860	3540	msedge.exe	85
PID 3540 wrote to memory of 1860	3540	msedge.exe	85
PID 3540 wrote to memory of 1860	3540	msedge.exe	85
PID 3540 wrote to memory of 1860	3540	msedge.exe	85
PID 3540 wrote to memory of 1860	3540	msedge.exe	85
PID 3540 wrote to memory of 1860	3540	msedge.exe	85
PID 3540 wrote to memory of 1860	3540	msedge.exe	85
PID 3540 wrote to memory of 1860	3540	msedge.exe	85
PID 3540 wrote to memory of 1860	3540	msedge.exe	85
PID 3540 wrote to memory of 1860	3540	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1219d950d8a9efa941e01d3cfd84da24_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc437c46f8,0x7ffc437c4708,0x7ffc437c4718
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,14811606903525705240,3530004443306996291,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,14811606903525705240,3530004443306996291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,14811606903525705240,3530004443306996291,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14811606903525705240,3530004443306996291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14811606903525705240,3530004443306996291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,14811606903525705240,3530004443306996291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,14811606903525705240,3530004443306996291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14811606903525705240,3530004443306996291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14811606903525705240,3530004443306996291,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14811606903525705240,3530004443306996291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14811606903525705240,3530004443306996291,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,14811606903525705240,3530004443306996291,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4596 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
715b39494ebecba0540025b84bb28628

SHA1
5c8f77c190da3f79245b2714780506bf3a368adb

SHA256
6de5d0430b57d30f8c4cc293f3bc8d4c40138488d5f5cdfd285a99bf18318b1f

SHA512
00e9c1f9a2f0c33eb5031ad553f1bcb3a04957e014ec82ce13b40f6fef614a0c97dd122c7c6497468886014cd4ee0d8b7c8dc4aa86c1e30babaccb346dc3b8e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c7b42b07817b9ce31eb606ba8f8a33c6

SHA1
bbe3fb5a90ff99760eb2c7098724633144f6205e

SHA256
1338cdca89b66079cd7ac9ec76a05e279dff2864b862eaef6cf487589823577e

SHA512
b4fdc4047f97cae2d07e35488326125b914db832983f832fe5dddcdf1b9ca48a6ad907d660f0490fcbf58210bc542054685b2f65f9ba58779c096c0ea7f8b538

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
69f9856d65e5ef0c5e13e5d31a8adc29

SHA1
7b7e18be9f4b9bd924df98974c0e389356ca5c35

SHA256
518fbe6d4638471a73ad32fc5f83b3a1f0e23c1d997323555a950e1ab48b8d3c

SHA512
49d8dab9668e771efb17987a32f556e1d14d017b81d4685bb84c75d908ed76604c6f1bc66d8207f5f01e1fc095d6add741f3e95445d8c29a6b50d9272917fab9

Download Submit