daa55d8c3d6272dda99c8eb9aa06fb08740128cb350732e0822a6a174e9da17c

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2024, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
35656eee773521ba5fea65e7da302c4a_JaffaCakes118.html
Size 158KB
Sample241011-sdg4eaybke
SHA256 daa55d8c3d6272dda99c8eb9aa06fb08740128cb350732e0822a6a174e9da17c
MD5 35656eee773521ba5fea65e7da302c4a
SHA1 2feff226383cc35111beff055681816c363e4e0e
SHA512 53e9a4d2baf0090895fba9a0797becaee73ce1bb9659cfcadbc915061387cd2d1a9ed1ae3f0329a126ca194b12f2e4500ffeaf0c2eff2a5d8e590ba51d2237ee
SSDEEP 1536:iRRThdRyF2CRiX/8BZm68yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09wd:inh7MZz8yfkMY+BES09JXAnyrZalI+YQ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1300	msedge.exe
1300	msedge.exe
1224	msedge.exe
1224	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
5100	identity_helper.exe
5100	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 448	1224	msedge.exe	83
PID 1224 wrote to memory of 448	1224	msedge.exe	83
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 3076	1224	msedge.exe	84
PID 1224 wrote to memory of 1300	1224	msedge.exe	85
PID 1224 wrote to memory of 1300	1224	msedge.exe	85
PID 1224 wrote to memory of 3040	1224	msedge.exe	86
PID 1224 wrote to memory of 3040	1224	msedge.exe	86
PID 1224 wrote to memory of 3040	1224	msedge.exe	86
PID 1224 wrote to memory of 3040	1224	msedge.exe	86
PID 1224 wrote to memory of 3040	1224	msedge.exe	86
PID 1224 wrote to memory of 3040	1224	msedge.exe	86
PID 1224 wrote to memory of 3040	1224	msedge.exe	86
PID 1224 wrote to memory of 3040	1224	msedge.exe	86
PID 1224 wrote to memory of 3040	1224	msedge.exe	86
PID 1224 wrote to memory of 3040	1224	msedge.exe	86
PID 1224 wrote to memory of 3040	1224	msedge.exe	86
PID 1224 wrote to memory of 3040	1224	msedge.exe	86
PID 1224 wrote to memory of 3040	1224	msedge.exe	86
PID 1224 wrote to memory of 3040	1224	msedge.exe	86
PID 1224 wrote to memory of 3040	1224	msedge.exe	86
PID 1224 wrote to memory of 3040	1224	msedge.exe	86
PID 1224 wrote to memory of 3040	1224	msedge.exe	86
PID 1224 wrote to memory of 3040	1224	msedge.exe	86
PID 1224 wrote to memory of 3040	1224	msedge.exe	86
PID 1224 wrote to memory of 3040	1224	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\35656eee773521ba5fea65e7da302c4a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb346f46f8,0x7ffb346f4708,0x7ffb346f4718
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,15971385270005607159,3954460264269487648,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,15971385270005607159,3954460264269487648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,15971385270005607159,3954460264269487648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,15971385270005607159,3954460264269487648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,15971385270005607159,3954460264269487648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,15971385270005607159,3954460264269487648,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,15971385270005607159,3954460264269487648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,15971385270005607159,3954460264269487648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,15971385270005607159,3954460264269487648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,15971385270005607159,3954460264269487648,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,15971385270005607159,3954460264269487648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,15971385270005607159,3954460264269487648,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:1160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8
MD5 99afa4934d1e3c56bbce114b356e8a99
SHA1 3f0e7a1a28d9d9c06b6663df5d83a65c84d52581
SHA512 76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9
MD5 443a627d539ca4eab732bad0cbe7332b
SHA1 86b18b906a1acd2a22f4b2c78ac3564c394a9569
SHA512 923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 54350be6ae7423f2503f6abd6f49497cb1457e011570b69bb9345df4bf91e1a6
MD5 e1ff5cfdcbc3431a3511d517f9fa8cc6
SHA1 b6fa8d8b11136f1e6412fb1722eb15c47ad01e25
SHA512 616cfb1453d4e3be012ae24955eb26d0c713cde4cbff956776f4606c155eda19bcf4ee9cffc32624dfed3528731642d36eb4534448700847a311c88e976815fc
SSDEEP 96:nkkAxm/BQYmqZ1YxWI/wpvWMoiVmdeHtuEuUWQyV+VDCziEwb:nkkxK+GxT/GWMXwro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 371c53e2c1c56740e5267a023ccb5d53d1848506914359a42ff99754ebb39cb8
MD5 8a6b8ad1bf9f48a963dc2f3aa8468ceb
SHA1 1971f59bc60f086ab96667889a6d2e005ce85111
SHA512 27dc2cfd11a14e379322199d186652826e173b8cc6e486d20d8b7eaabfcb61476dec3745532dbee496ec2351628984e73d8d9c52ed3b51593182a27b0fb6ddbe
SSDEEP 96:nkkAxm/B6mqZ1Y0WI/wpvWMoiVmdeHtuEuUWQyV+VDCAiEwb:nkkx/+G0T/GWMXwrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 36862240fa36f6e7dcad041a0bfc72731d4f23e9d3b9c06840c4903304404de8
MD5 e36f4a51e1a21789df2c085f0736dbd2
SHA1 ee6d9a279287236e3feb324a14b2b32591c6e107
SHA512 1a45d91317a8c44d4db7c51c28eba4cb4dc75bdcd71e4a11a556733d29b41d1dbf0d8fd11a54ab24c7e6e95cd5d938ba07195b486cba2e734bcadf34f86a7468
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupVhe2RUrobE6+B1EVXvu:A9iIxuERzA83h09RZxY3jYbEFvu
MD5 SHA1 SHA512 SSDEEP

Submit Download