6639e6e3a7b2d36505a671021e58b5269a46e26f3b2e320d546f75e3cefd76fd

Analysis

max time kernel
139s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-10-2024 21:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2592a4722d393c80c478250b41076224_JaffaCakes118.html
Size

155KB
MD5

2592a4722d393c80c478250b41076224
SHA1

f804d34b73f232d3b90ae56aa476f653a29550ef
SHA256

6639e6e3a7b2d36505a671021e58b5269a46e26f3b2e320d546f75e3cefd76fd
SHA512

10cba321a19ffac4f655f61177a0d7df8ba0079c54acebfeb5ec89b4e4359ca471778334d6f66dca631b6cdc33162b34bbeb19c01fd3655a7d83da0106d76943
SSDEEP

1536:ifRTCnzUB0L3W1z3nyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3p:ixdB46nyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3160	msedge.exe
3160	msedge.exe
4852	msedge.exe
4852	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
4328	identity_helper.exe
4328	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 4052	4852	msedge.exe	83
PID 4852 wrote to memory of 4052	4852	msedge.exe	83
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 1108	4852	msedge.exe	85
PID 4852 wrote to memory of 3160	4852	msedge.exe	86
PID 4852 wrote to memory of 3160	4852	msedge.exe	86
PID 4852 wrote to memory of 4832	4852	msedge.exe	87
PID 4852 wrote to memory of 4832	4852	msedge.exe	87
PID 4852 wrote to memory of 4832	4852	msedge.exe	87
PID 4852 wrote to memory of 4832	4852	msedge.exe	87
PID 4852 wrote to memory of 4832	4852	msedge.exe	87
PID 4852 wrote to memory of 4832	4852	msedge.exe	87
PID 4852 wrote to memory of 4832	4852	msedge.exe	87
PID 4852 wrote to memory of 4832	4852	msedge.exe	87
PID 4852 wrote to memory of 4832	4852	msedge.exe	87
PID 4852 wrote to memory of 4832	4852	msedge.exe	87
PID 4852 wrote to memory of 4832	4852	msedge.exe	87
PID 4852 wrote to memory of 4832	4852	msedge.exe	87
PID 4852 wrote to memory of 4832	4852	msedge.exe	87
PID 4852 wrote to memory of 4832	4852	msedge.exe	87
PID 4852 wrote to memory of 4832	4852	msedge.exe	87
PID 4852 wrote to memory of 4832	4852	msedge.exe	87
PID 4852 wrote to memory of 4832	4852	msedge.exe	87
PID 4852 wrote to memory of 4832	4852	msedge.exe	87
PID 4852 wrote to memory of 4832	4852	msedge.exe	87
PID 4852 wrote to memory of 4832	4852	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2592a4722d393c80c478250b41076224_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffc0a8746f8,0x7ffc0a874708,0x7ffc0a874718
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,3365468027193527290,16098288214642387205,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,3365468027193527290,16098288214642387205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,3365468027193527290,16098288214642387205,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3365468027193527290,16098288214642387205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3365468027193527290,16098288214642387205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,3365468027193527290,16098288214642387205,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2952 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,3365468027193527290,16098288214642387205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,3365468027193527290,16098288214642387205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3365468027193527290,16098288214642387205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3365468027193527290,16098288214642387205,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3365468027193527290,16098288214642387205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3365468027193527290,16098288214642387205,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:1
  2⤵
  PID:2524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5e1b45a3cf8041a4a6fbd162f0b82f8f

SHA1
dd643af81879df30e0e94a82e43066f4713d0662

SHA256
0927e5ee46b831056f04e751e303448faf054fa694f5a9374755a091d166f541

SHA512
6daa543fe23ecfdfc00dc9f3571a831e173ce4d2f16bdf2579a36652714010270e9c2c0d67d16713e004489cbae1d4f93602620d3770201fe68e5beb42bc3a65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
04d701f0056de37ec18e3ef0c0e7728b

SHA1
3f53f701b47999901370c127ba9cb2e3d2c0da7a

SHA256
750c35d3249f621730185ba4a978f0fb4fd695626dc749e211b6efa0e296ed37

SHA512
812f03a7d6bd0145af1a3af7b53de723f4ae10aaac485014e52f0e3c10f3152b83661fb31b5de84a6b23c878056ae60397496072c0706d311da192ccefe7cb91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
31fbb51beb192567c3627fa013e1ea10

SHA1
2fdecda2dfb5636178aaaebb6159eb3a537909ca

SHA256
df160ba87350b6be4cc881011635ab4df6ffa4831203bbe7a4c676e0b90ecddd

SHA512
80eeccb6e0d50596732b9ec2d2e844691f029accc3fabfd9b3d7f2919cf42a8baf3b2e8c096cf2c6651a613383aa9607d95ca2a3a4fd9b3b10e9d7f5f9021da4

Download Submit