0ba8eca1a90c52749deb73717d88cfbd2e94325f91cbd84312dfefe012ca6acf

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17596931dc7e8fe668d1ccfc87152a6b_JaffaCakes118.html
Size

36KB
MD5

17596931dc7e8fe668d1ccfc87152a6b
SHA1

f6de9be6ae30cffdcbf688672df8a5ee4a7eafcd
SHA256

0ba8eca1a90c52749deb73717d88cfbd2e94325f91cbd84312dfefe012ca6acf
SHA512

513a836c5b3c6a8aef6e6cc9bd8d22ade91a6a0a36d72095fd1c5ade17254da2aae2ffda2236b45beba9de94189be756bc5aa59be837a7ccb3beb30d3cbf6d48
SSDEEP

384:xonBCvu6od+Nc6T1RBCqzyxoWFLba+RD6wLvbgwtVtpHwT3g02rwf4H0rwsfprw5:UCvzer6xmqeXFLb63/A7APhP54T

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3272	msedge.exe
3272	msedge.exe
3208	msedge.exe
3208	msedge.exe
1020	identity_helper.exe
1020	identity_helper.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 4968	3208	msedge.exe	82
PID 3208 wrote to memory of 4968	3208	msedge.exe	82
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 1380	3208	msedge.exe	83
PID 3208 wrote to memory of 3272	3208	msedge.exe	84
PID 3208 wrote to memory of 3272	3208	msedge.exe	84
PID 3208 wrote to memory of 3928	3208	msedge.exe	85
PID 3208 wrote to memory of 3928	3208	msedge.exe	85
PID 3208 wrote to memory of 3928	3208	msedge.exe	85
PID 3208 wrote to memory of 3928	3208	msedge.exe	85
PID 3208 wrote to memory of 3928	3208	msedge.exe	85
PID 3208 wrote to memory of 3928	3208	msedge.exe	85
PID 3208 wrote to memory of 3928	3208	msedge.exe	85
PID 3208 wrote to memory of 3928	3208	msedge.exe	85
PID 3208 wrote to memory of 3928	3208	msedge.exe	85
PID 3208 wrote to memory of 3928	3208	msedge.exe	85
PID 3208 wrote to memory of 3928	3208	msedge.exe	85
PID 3208 wrote to memory of 3928	3208	msedge.exe	85
PID 3208 wrote to memory of 3928	3208	msedge.exe	85
PID 3208 wrote to memory of 3928	3208	msedge.exe	85
PID 3208 wrote to memory of 3928	3208	msedge.exe	85
PID 3208 wrote to memory of 3928	3208	msedge.exe	85
PID 3208 wrote to memory of 3928	3208	msedge.exe	85
PID 3208 wrote to memory of 3928	3208	msedge.exe	85
PID 3208 wrote to memory of 3928	3208	msedge.exe	85
PID 3208 wrote to memory of 3928	3208	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\17596931dc7e8fe668d1ccfc87152a6b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe9f4046f8,0x7ffe9f404708,0x7ffe9f404718
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,11042951040160215027,4361198437492727754,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,11042951040160215027,4361198437492727754,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1968,11042951040160215027,4361198437492727754,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,11042951040160215027,4361198437492727754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,11042951040160215027,4361198437492727754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,11042951040160215027,4361198437492727754,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,11042951040160215027,4361198437492727754,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,11042951040160215027,4361198437492727754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,11042951040160215027,4361198437492727754,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,11042951040160215027,4361198437492727754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,11042951040160215027,4361198437492727754,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,11042951040160215027,4361198437492727754,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3776 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\219cd345-4b65-4475-ab1a-5e3c5cf23855.tmp

Filesize
5KB

MD5
20f8fe57f08ee4c212b749571691183e

SHA1
fc65ae0b3f41165cc3d534cff41d8fcd7f13853a

SHA256
854feba6af0414760bf25c9a00d553cbdda2fbe8a20c5dd208b1efce2170f77b

SHA512
bcada6f3fb25106fa827da57776fc79f83781761f0e0c9d077f700ba9f88909e94f88370053e108c58329cc4c950adbcc180e82f1b3a426318ae6160011b5552

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
308B

MD5
405cf5b29def2e8ded041a68e90d79cb

SHA1
8062fa11ac075991528e5ea709ae05ce54d79b2a

SHA256
dc73693657b7c4fdbb2a49fdca36d8e216670a3802dff295a34f8cf168128585

SHA512
99367ab878a67a7096bc71300cadc14d35e595c1f54de7930aa57e7ebecb1db3726dfe79c224b8ad7feefae57419c4977a22f81af6dd63749caed23176c1017d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f7b6aef901f4efb07cd54e39fae8fd95

SHA1
b68acc2150f23e8e7621700d15ae2f601557b140

SHA256
520f87fd60d4ba6916c9045c5944244dd32315d897070c2cfa39bf68242a3d8d

SHA512
45d8b681451fc2a275c5a0ef313661dece129641a38d3cdef40efb4b54bf18ab6b612907340defddde5363031bf5072eb9f74ed0a5cd7131ba9d9b0e5bf5e280

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
73b970a6f1f7130f040dc312ea6c16ae

SHA1
aad4bed21d95849887ccbfdad7f4cd3d8f0c242c

SHA256
7abad2acbfa455634b99283d670e3dd32068cf821e6fc12101673528136b1d89

SHA512
b6c1597067c4afccd4985ed5821688627d8620cb0f8cd41ec88d05eaaa1eb2fd5374e25e3fc6dc25b94cb475d7df92e47e3d8fd23d6e738c587d5d4493e55579

Download Submit