496f72bac7ea774e9cb003a3b712dabe2e5f1682529ec426c592c8d5690db91d

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 20:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71359c97d060bae4c2e62a5c6fb530e3_JaffaCakes118.html
Size

124KB
MD5

71359c97d060bae4c2e62a5c6fb530e3
SHA1

8e4b20d7ba3973736e7c32bf85c3a74ffe0e8242
SHA256

496f72bac7ea774e9cb003a3b712dabe2e5f1682529ec426c592c8d5690db91d
SHA512

eabb4304fa175815ccf790e5a5f1a713476920ea35866d43c84101e6b461c562c8e15ac96f21674ed510672be5efe56ac8394bef08277d039878103f3345b6dc
SSDEEP

1536:fTbhmI9UW+zSwyVfA+IpXAGA1o9k+i3Vyp:XII9D++LIA/+9

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2844	msedge.exe
2844	msedge.exe
3060	msedge.exe
3060	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 4256	3060	msedge.exe	84
PID 3060 wrote to memory of 4256	3060	msedge.exe	84
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2704	3060	msedge.exe	85
PID 3060 wrote to memory of 2844	3060	msedge.exe	86
PID 3060 wrote to memory of 2844	3060	msedge.exe	86
PID 3060 wrote to memory of 1584	3060	msedge.exe	87
PID 3060 wrote to memory of 1584	3060	msedge.exe	87
PID 3060 wrote to memory of 1584	3060	msedge.exe	87
PID 3060 wrote to memory of 1584	3060	msedge.exe	87
PID 3060 wrote to memory of 1584	3060	msedge.exe	87
PID 3060 wrote to memory of 1584	3060	msedge.exe	87
PID 3060 wrote to memory of 1584	3060	msedge.exe	87
PID 3060 wrote to memory of 1584	3060	msedge.exe	87
PID 3060 wrote to memory of 1584	3060	msedge.exe	87
PID 3060 wrote to memory of 1584	3060	msedge.exe	87
PID 3060 wrote to memory of 1584	3060	msedge.exe	87
PID 3060 wrote to memory of 1584	3060	msedge.exe	87
PID 3060 wrote to memory of 1584	3060	msedge.exe	87
PID 3060 wrote to memory of 1584	3060	msedge.exe	87
PID 3060 wrote to memory of 1584	3060	msedge.exe	87
PID 3060 wrote to memory of 1584	3060	msedge.exe	87
PID 3060 wrote to memory of 1584	3060	msedge.exe	87
PID 3060 wrote to memory of 1584	3060	msedge.exe	87
PID 3060 wrote to memory of 1584	3060	msedge.exe	87
PID 3060 wrote to memory of 1584	3060	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\71359c97d060bae4c2e62a5c6fb530e3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe38f446f8,0x7ffe38f44708,0x7ffe38f44718
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,13316109225828909909,15570443718893130613,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,13316109225828909909,15570443718893130613,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,13316109225828909909,15570443718893130613,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13316109225828909909,15570443718893130613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13316109225828909909,15570443718893130613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13316109225828909909,15570443718893130613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13316109225828909909,15570443718893130613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13316109225828909909,15570443718893130613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,13316109225828909909,15570443718893130613,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4940 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaaad45aced1889a90a8aa4c39f92659

SHA1
5c0130d9e8d1a64c97924090d9a5258b8a31b83c

SHA256
5e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b

SHA512
0db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3ee50fb26a9d3f096c47ff8696c24321

SHA1
a8c83e798d2a8b31fec0820560525e80dfa4fe66

SHA256
d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f

SHA512
479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4c9f5f15ca18a0d6570cae32d40f5b80

SHA1
ce58c527f53f6060dd2f36f8cfe214e3ec85e1c1

SHA256
dbd63759d2b3f909a9114cbb4a630bbebfcf32e0186acce82d30f896543a4c5f

SHA512
90f84619dc3d3c4351d9b3e405d6d0e41f4a40f306522f15ad052b39aeb24697075a5e06de2eccbef28eefa5853598cb85b321b5937d68aef6a6d727cc88fc5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3c2cc03dd275cb12bedbb8730e60d0ae

SHA1
3123418d5864ab9579931af6419e003d30e2120e

SHA256
ce859b75ab271dafc707ef9cde458b6e182c9145a5742d80562464f4f34ae343

SHA512
d0a031d1edb0fdd417d4fc756f8f102e45b7a296995ba644a633519f5c69049d52d88249039215654be03d2c05073af27796e28233fa2507dcf22ccc913726a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e8ebbec4a9587fbd1c6ad0394635ee56

SHA1
c3b149ac08a302f8d0a0b8f08bf0e7a31f3f8a79

SHA256
cbfdb0d15f84c584067a6eacc4aff3d044ef2c472f1fe980bca1990ef3e2e331

SHA512
1880c57cd47036f3acf222128fc6b786023cf2f87a38659e08f13db570a16a80db722c65b41b982b3741e2a56ba10279c01ebdb56b752035549012f655ec661e

Download Submit