34fe9386611664161ca394ba93d6e4b5f33660c576883b19455a353a3e15c077

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

40fa8411df5151e595c1af4d8b54446e_JaffaCakes118.html
Size

26KB
MD5

40fa8411df5151e595c1af4d8b54446e
SHA1

f38ef23e171e0fcd984d53caa22df8e52a8d0a9a
SHA256

34fe9386611664161ca394ba93d6e4b5f33660c576883b19455a353a3e15c077
SHA512

75a6d37a3c23707822a12235047a2546610818b68fa78db449e371e156e859d9c38595a8cb5afd1ddbb094a97f4c1417d5d0f66933bc25767d21de2dc349d101
SSDEEP

768:/F1TpKVAqnd+qi9q7B2SWX43+HcFG2Sixvs:/F1FKVhnd+LABNWX43+8FK

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1592	msedge.exe
1592	msedge.exe
5068	msedge.exe
5068	msedge.exe
4088	identity_helper.exe
4088	identity_helper.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 808	5068	msedge.exe	83
PID 5068 wrote to memory of 808	5068	msedge.exe	83
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 3192	5068	msedge.exe	84
PID 5068 wrote to memory of 1592	5068	msedge.exe	85
PID 5068 wrote to memory of 1592	5068	msedge.exe	85
PID 5068 wrote to memory of 1488	5068	msedge.exe	86
PID 5068 wrote to memory of 1488	5068	msedge.exe	86
PID 5068 wrote to memory of 1488	5068	msedge.exe	86
PID 5068 wrote to memory of 1488	5068	msedge.exe	86
PID 5068 wrote to memory of 1488	5068	msedge.exe	86
PID 5068 wrote to memory of 1488	5068	msedge.exe	86
PID 5068 wrote to memory of 1488	5068	msedge.exe	86
PID 5068 wrote to memory of 1488	5068	msedge.exe	86
PID 5068 wrote to memory of 1488	5068	msedge.exe	86
PID 5068 wrote to memory of 1488	5068	msedge.exe	86
PID 5068 wrote to memory of 1488	5068	msedge.exe	86
PID 5068 wrote to memory of 1488	5068	msedge.exe	86
PID 5068 wrote to memory of 1488	5068	msedge.exe	86
PID 5068 wrote to memory of 1488	5068	msedge.exe	86
PID 5068 wrote to memory of 1488	5068	msedge.exe	86
PID 5068 wrote to memory of 1488	5068	msedge.exe	86
PID 5068 wrote to memory of 1488	5068	msedge.exe	86
PID 5068 wrote to memory of 1488	5068	msedge.exe	86
PID 5068 wrote to memory of 1488	5068	msedge.exe	86
PID 5068 wrote to memory of 1488	5068	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\40fa8411df5151e595c1af4d8b54446e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8314946f8,0x7ff831494708,0x7ff831494718
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,14350541175773720148,7350381062343833886,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,14350541175773720148,7350381062343833886,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,14350541175773720148,7350381062343833886,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14350541175773720148,7350381062343833886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14350541175773720148,7350381062343833886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,14350541175773720148,7350381062343833886,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,14350541175773720148,7350381062343833886,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14350541175773720148,7350381062343833886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14350541175773720148,7350381062343833886,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14350541175773720148,7350381062343833886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14350541175773720148,7350381062343833886,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,14350541175773720148,7350381062343833886,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5708 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
395B

MD5
c34e7ae089924db6a0a35c28022f1f71

SHA1
1e4bf786017150e1181d9d0e37a0f195ee6c7178

SHA256
579e95e9edce16cf74a6482e5e91f9693524a1540f7460d7e2d51b55ea4d32c6

SHA512
41d6b815a4e6080173342f51143abff875b306d2e6fd1b39d1bbf77037066b7e4aecab1f2f164ccf45932d4dc698de8be8d0bd38032fd0e3fcc41f9ea94067c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f5330cad82699fdeb710aaf1aea7bd39

SHA1
825119eccdd7311ce7efe535cc063ac3dbc8015d

SHA256
6ddcf3ce49c67b9b8a834c4418b94fb13a0bbcf7f6ce46ea57034840e20ccf65

SHA512
278822d694faea54d2acd121e7e561115388e327f79408f07960bb5ee6f0c357594105404642fb68d2a3a463e248846756a915f98a1dd1e824d32e3385ae6c87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7f125ddd029a303e4761d94ca8000817

SHA1
4cc6dead36b1d75369746b53b42f2e9aac42d512

SHA256
3ef30bf0773182cfdfc8b91c8c83038d3a9ff99b602cd336a78daf37175db11e

SHA512
4270a37f793083e9ada5cb5a249e69112389b4b04f6b381c3eda3a846526e82ebc717a630ed5e0d10cfcb721223ce67d9d931bcb4caaeca6b1b28ad78a2fc762

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
840ebd87fe26ddcd754da7726d84b455

SHA1
70fc37ec41d92491e2ae0392973eaa53d4422b00

SHA256
d74281bd343d26959088f2470006dd5855a2a0a85d4d14eb5a21e28b2820fcd9

SHA512
72844122a5a773be289c3d1ff1f68fe339161ee13570f9936647b42c819251a6b81f8ea99b232a297397e748bf3e2a31c5b6362dbc57c651fccbe4d1c8ec0478

Download Submit