e37f2f11700ea0d327faf66101d2df9f757cb4488656a472b4d3bdc6e2ead568

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
37e039138465e7ca534d339ae60ed7a4_JaffaCakes118.html
Size 341KB
Sample241012-caal6a1bjp
SHA256 e37f2f11700ea0d327faf66101d2df9f757cb4488656a472b4d3bdc6e2ead568
MD5 37e039138465e7ca534d339ae60ed7a4
SHA1 a482c78bc9d29c54c922add323163a90aff0fa79
SHA512 673082f5e4237a282642da80903e51fa5bbe7c1fa656d6ea9ff1439fdee3bb77e0cc3a2f10cd93a95761f95d14cb7e5281bcafb89a17835841e0449905184de4
SSDEEP 1536:SG66B+KECONAyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrus2:SuABNAyfkMY+BES09JXAnyrZalI+Yk
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3988	msedge.exe
3988	msedge.exe
1720	msedge.exe
1720	msedge.exe
4632	identity_helper.exe
4632	identity_helper.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2360	1720	msedge.exe	83
PID 1720 wrote to memory of 2360	1720	msedge.exe	83
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 392	1720	msedge.exe	84
PID 1720 wrote to memory of 3988	1720	msedge.exe	85
PID 1720 wrote to memory of 3988	1720	msedge.exe	85
PID 1720 wrote to memory of 2788	1720	msedge.exe	86
PID 1720 wrote to memory of 2788	1720	msedge.exe	86
PID 1720 wrote to memory of 2788	1720	msedge.exe	86
PID 1720 wrote to memory of 2788	1720	msedge.exe	86
PID 1720 wrote to memory of 2788	1720	msedge.exe	86
PID 1720 wrote to memory of 2788	1720	msedge.exe	86
PID 1720 wrote to memory of 2788	1720	msedge.exe	86
PID 1720 wrote to memory of 2788	1720	msedge.exe	86
PID 1720 wrote to memory of 2788	1720	msedge.exe	86
PID 1720 wrote to memory of 2788	1720	msedge.exe	86
PID 1720 wrote to memory of 2788	1720	msedge.exe	86
PID 1720 wrote to memory of 2788	1720	msedge.exe	86
PID 1720 wrote to memory of 2788	1720	msedge.exe	86
PID 1720 wrote to memory of 2788	1720	msedge.exe	86
PID 1720 wrote to memory of 2788	1720	msedge.exe	86
PID 1720 wrote to memory of 2788	1720	msedge.exe	86
PID 1720 wrote to memory of 2788	1720	msedge.exe	86
PID 1720 wrote to memory of 2788	1720	msedge.exe	86
PID 1720 wrote to memory of 2788	1720	msedge.exe	86
PID 1720 wrote to memory of 2788	1720	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\37e039138465e7ca534d339ae60ed7a4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb938846f8,0x7ffb93884708,0x7ffb93884718
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,14785371097823498128,10869278808774866867,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,14785371097823498128,10869278808774866867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,14785371097823498128,10869278808774866867,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14785371097823498128,10869278808774866867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14785371097823498128,10869278808774866867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14785371097823498128,10869278808774866867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,14785371097823498128,10869278808774866867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,14785371097823498128,10869278808774866867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14785371097823498128,10869278808774866867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14785371097823498128,10869278808774866867,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14785371097823498128,10869278808774866867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14785371097823498128,10869278808774866867,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,14785371097823498128,10869278808774866867,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4896 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32
MD5 6960857d16aadfa79d36df8ebbf0e423
SHA1 e1db43bd478274366621a8c6497e270d46c6ed4f
SHA512 6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841
MD5 f426165d1e5f7df1b7a3758c306cd4ae
SHA1 59ef728fbbb5c4197600f61daec48556fec651c1
SHA512 8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 be10f1787e6a5f1145b266dcff04b6df8955ed76dfca5541114377260457a654
MD5 4e6d4a096c470aa47435db3382c9d321
SHA1 fa719b465e1e62634be8891d950d0ccffbc737df
SHA512 38305702701656afd51da2ace2bfca432c3e4bfa4a7dc6ab2883a18222fbc8a46a81479652ad960206358b321d10a953e06f137b997843dd9d3260636b391739
SSDEEP 96:njkMxm/B6mqt1dk1SnwpvWMoiVmdeHdwVUWQyV+VD7AiEwb:njkV/S3uaGWMX6rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 aa23694f7c1c65df29723ce5cb6cee3049b42e6c048ad8458e2c29126720dc28
MD5 2a4407e194d34612c70e8b4a9be2b3c0
SHA1 e37e34aa454c9b91809157e6cf961696c3c0cdc8
SHA512 81cde40ecbf15f54e6c1acbb759b2d8c6d42a305faceb1cf7b20f7812c5b46e950ae94e060a4d6f705e0ac3f8a40b2ca575c8ea0b7c9125f67793d30c1c1281a
SSDEEP 96:njkMxm/BQYmqt1dd1SnwpvWMoiVmdeHdwVUWQyV+VDCziEwb:njkVKS33aGWMX6ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f90e8574db9a0ce406640bfbbe5426fe6de375006b9a4ea7fd33f40265993487
MD5 d14bd1034ca72da70b1f1aa01dfa2415
SHA1 d6d00028cc75cb92a0899a123977a6d5fa6bb1ff
SHA512 885b6036cf12add5ca8ef46b162317e208f07e9a660188070896c488018a8167f0a4d3ca14c61afd7a9fd80ec12337b92ecf7d5735330c50642aae8a776de8ec
SSDEEP 96:njkMxm/B6mqt1dd1SnwpvWMoiVmdeHdwVUWQyV+VDCAiEwb:njkV/S33aGWMX6rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

b20ce5be-4018-4b00-9c89-bce66e68ee25.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b20ce5be-4018-4b00-9c89-bce66e68ee25.tmp
Size 10KB
SHA256 fd1b45b2dd15932260bd632fe661281c151ed46becc3975ffbf5f2c44021f928
MD5 4002f4fb3464070c5cdea72aa329f7b9
SHA1 4cbfa267932cabfbefcc13bb5c64172eee32c5c2
SHA512 299f05be1ee847ecce28bf61fca23080073a7e703ad5d61ae9e0ef4b1c2998d2bef28c42d3a75c8fd9d699814b0b3e35bda3bfab77cfccd250a15c7f5f306089
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupl23e2RUYRHC6+B1EhCcu:A9iIxuERzA83h09RZxYgvCbEwcu
MD5 SHA1 SHA512 SSDEEP

Submit Download