1ba539e5bab8eb592b92904fed8570bfdd4cb31df96f790e5cb7f1f2f16cc129

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68a39aedbb54b600e34e7ddf69f15a05_JaffaCakes118.html
Size

7KB
MD5

68a39aedbb54b600e34e7ddf69f15a05
SHA1

92a24c06608109e8098dd47b89d29958b6d7b83c
SHA256

1ba539e5bab8eb592b92904fed8570bfdd4cb31df96f790e5cb7f1f2f16cc129
SHA512

067324529b84f63b54069658a79f68f13c493d1ee0e669190e1c82011ba2d24b1c5b792103769a6809444de99e1bc78ef7c349bdb45e71275f81f01b78347c6a
SSDEEP

192:vZRB/aYa5UV7Ar4Sp4Sf4S714SN4Si4SX4S6e54SM4St4SY:na5nE

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3244	msedge.exe
3244	msedge.exe
3920	msedge.exe
3920	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 4500	3920	msedge.exe	84
PID 3920 wrote to memory of 4500	3920	msedge.exe	84
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 4496	3920	msedge.exe	85
PID 3920 wrote to memory of 3244	3920	msedge.exe	86
PID 3920 wrote to memory of 3244	3920	msedge.exe	86
PID 3920 wrote to memory of 1332	3920	msedge.exe	87
PID 3920 wrote to memory of 1332	3920	msedge.exe	87
PID 3920 wrote to memory of 1332	3920	msedge.exe	87
PID 3920 wrote to memory of 1332	3920	msedge.exe	87
PID 3920 wrote to memory of 1332	3920	msedge.exe	87
PID 3920 wrote to memory of 1332	3920	msedge.exe	87
PID 3920 wrote to memory of 1332	3920	msedge.exe	87
PID 3920 wrote to memory of 1332	3920	msedge.exe	87
PID 3920 wrote to memory of 1332	3920	msedge.exe	87
PID 3920 wrote to memory of 1332	3920	msedge.exe	87
PID 3920 wrote to memory of 1332	3920	msedge.exe	87
PID 3920 wrote to memory of 1332	3920	msedge.exe	87
PID 3920 wrote to memory of 1332	3920	msedge.exe	87
PID 3920 wrote to memory of 1332	3920	msedge.exe	87
PID 3920 wrote to memory of 1332	3920	msedge.exe	87
PID 3920 wrote to memory of 1332	3920	msedge.exe	87
PID 3920 wrote to memory of 1332	3920	msedge.exe	87
PID 3920 wrote to memory of 1332	3920	msedge.exe	87
PID 3920 wrote to memory of 1332	3920	msedge.exe	87
PID 3920 wrote to memory of 1332	3920	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68a39aedbb54b600e34e7ddf69f15a05_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9347f46f8,0x7ff9347f4708,0x7ff9347f4718
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,7802012728593027424,11809322647628274455,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,7802012728593027424,11809322647628274455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,7802012728593027424,11809322647628274455,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7802012728593027424,11809322647628274455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7802012728593027424,11809322647628274455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7802012728593027424,11809322647628274455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,7802012728593027424,11809322647628274455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,7802012728593027424,11809322647628274455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7802012728593027424,11809322647628274455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7802012728593027424,11809322647628274455,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7802012728593027424,11809322647628274455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7802012728593027424,11809322647628274455,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,7802012728593027424,11809322647628274455,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3928 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c00b0d6e0f836dfa596c6df9d3b2f8f2

SHA1
69ad27d9b4502630728f98917f67307e9dd12a30

SHA256
578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1

SHA512
0e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54f1b76300ce15e44e5cc1a3947f5ca9

SHA1
c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7

SHA256
43dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24

SHA512
ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6d87070ac9428e4d65b6a8ceebf16110

SHA1
1aeee0aaf94b239b0c42da405ae3eeecf03002e0

SHA256
6d5d3d57aa3811e78da9960aa28f16c813c7b49b0476379bb1b28095eef97c97

SHA512
bfe148aeef5f0c76cd432bf3c2816c9417fe3575b843965736726344a4670ec8f6d8d6fae66761a294b13ac018f6b1735cf95bf0e0ae81bff0ced2312cbf3908

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7db3039b3a991bef8189840a2276254c

SHA1
1167f9efd590f142bb656e400bfdb7617539c402

SHA256
1ebbbabf558c3fdfb825532948028ca03a5292b529e8b2d6a146789d5eae2b60

SHA512
8ae59231b6339b47a449fa1829085e821e02c97442c3cd116089711c92dfaf40734672847cb2c638d0afeab66881101388e25b85d3252426d7b7e07ee1bc7b0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dc84e0040f30388fbd8f0272cc1dc697

SHA1
e883fbb401056cf24014215bf9cec4c2d4c97f3b

SHA256
f7aee0dc35b1c118dd18a42d679c53bd89188690a58fbe3010b2dc505a3d9c72

SHA512
bcc9f6f9597438e5ca39171b9979d609dab05b8430d040397c599edd51d3e807943bbb7c93722e5d4458e380003cbc0066e2de7a785e83bc88db6c1fa0583086

Download Submit