52fda9b281cce8023f610cec5688a3f6b164c02714051eeb0dd5b93c8e05e07d

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 11:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f6e908325a1a630e879df3c682e0e0b_JaffaCakes118.html
Size

182KB
MD5

6f6e908325a1a630e879df3c682e0e0b
SHA1

a85aa5d67c7b0be78f673d9f283548f6b3896366
SHA256

52fda9b281cce8023f610cec5688a3f6b164c02714051eeb0dd5b93c8e05e07d
SHA512

7664906bdd7c0a0fd54909b9f8b4eec458e0e3326849fff7c579a46a2c944cec39e12d2e5f17874aff769ea2a0236d6b1bafa053a14bf0c4e08557e087985cbb
SSDEEP

1536:pbMjw2fMk1D3O9Pj2fc+aMHAfTMiLNT/CDcZy15dTp:sRGfL0D7

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1232	msedge.exe
1232	msedge.exe
3344	msedge.exe
3344	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3344	msedge.exe
3344	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 4352	3344	msedge.exe	84
PID 3344 wrote to memory of 4352	3344	msedge.exe	84
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 4928	3344	msedge.exe	85
PID 3344 wrote to memory of 1232	3344	msedge.exe	86
PID 3344 wrote to memory of 1232	3344	msedge.exe	86
PID 3344 wrote to memory of 3464	3344	msedge.exe	87
PID 3344 wrote to memory of 3464	3344	msedge.exe	87
PID 3344 wrote to memory of 3464	3344	msedge.exe	87
PID 3344 wrote to memory of 3464	3344	msedge.exe	87
PID 3344 wrote to memory of 3464	3344	msedge.exe	87
PID 3344 wrote to memory of 3464	3344	msedge.exe	87
PID 3344 wrote to memory of 3464	3344	msedge.exe	87
PID 3344 wrote to memory of 3464	3344	msedge.exe	87
PID 3344 wrote to memory of 3464	3344	msedge.exe	87
PID 3344 wrote to memory of 3464	3344	msedge.exe	87
PID 3344 wrote to memory of 3464	3344	msedge.exe	87
PID 3344 wrote to memory of 3464	3344	msedge.exe	87
PID 3344 wrote to memory of 3464	3344	msedge.exe	87
PID 3344 wrote to memory of 3464	3344	msedge.exe	87
PID 3344 wrote to memory of 3464	3344	msedge.exe	87
PID 3344 wrote to memory of 3464	3344	msedge.exe	87
PID 3344 wrote to memory of 3464	3344	msedge.exe	87
PID 3344 wrote to memory of 3464	3344	msedge.exe	87
PID 3344 wrote to memory of 3464	3344	msedge.exe	87
PID 3344 wrote to memory of 3464	3344	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6f6e908325a1a630e879df3c682e0e0b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd3f6b46f8,0x7ffd3f6b4708,0x7ffd3f6b4718
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2284,9897366209864108866,6523275696544650621,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2284,9897366209864108866,6523275696544650621,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2284,9897366209864108866,6523275696544650621,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,9897366209864108866,6523275696544650621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,9897366209864108866,6523275696544650621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2284,9897366209864108866,6523275696544650621,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
929431f21d34cacf331089889f139885

SHA1
21eccb24e172a6d22f80911bc68e85d8e8ba008c

SHA256
f7c3f97ede5deab97c47c8c52105156cc556922adecb67f416a95adbc55693ca

SHA512
de6e04728fdc0cbf16edd5e912c3b2f69cbc02136d897ab80d947db0714b19433d1b5f444fcd54c3e7c901eb99876e97eacc04ade2897bb271460dc0db4380ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c94a51e981091402c08c814ad274bb4f

SHA1
92218288a6c98e73921abc51ec4f8304f835ba4a

SHA256
aa1abc20eca4c18f83b8ec219b453187750b66cae5a5ed41371accf74dc7bcec

SHA512
f41ee83b317bbd82568f600e2838e17df7bfbd09f84b67ac5613a8fcf8065f6b695e67cab39a24b1c2f907edd7de111df127a451321a4392aec10511f20b76b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b06754abd33486ac05cdbe2ef03ff20f

SHA1
9e45d2ee568c85b73879eb745a2bbf8eb0ff1bbe

SHA256
0b89dc31028c0402fd39dc1949f6871ca3ae3534956c8048ff206de8c437ff12

SHA512
60d54019aab9c0678e557e2d73a3549b43712709189ebf88e56809c80e397192628a6532588ced04d822f9946e8dcab9bdce9e62aa762ccbd0ea28f1e8451c97

Download Submit