40b97cd6395614ac035d3b2702bf7a36d238ea9aaefa06afd07dfe33fd00b766

Analysis

max time kernel
148s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26-07-2024 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7626c65d6ff5854f634667547c10a7e9_JaffaCakes118.html
Size

11KB
MD5

7626c65d6ff5854f634667547c10a7e9
SHA1

24b84b28513026bde3bad6aca8ac0bb7deef6532
SHA256

40b97cd6395614ac035d3b2702bf7a36d238ea9aaefa06afd07dfe33fd00b766
SHA512

1c262133b523e1ed3ddb76a09e547843792c57538e24e34ad5a694cf0c3c964db083658fdd640b13b3e4f3189a7bae56d6882f1583ee85493e37097e7cc29c55
SSDEEP

192:2VflIsr03nE8k/w1wvqVkZaBCZnXK2Kj801kHauBuLbdU8d:sflIcuns/gYaBCZnXK2Kj80WaguLZ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe
4028	msedge.exe
4028	msedge.exe
452	identity_helper.exe
452	identity_helper.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 2212	4028	msedge.exe	84
PID 4028 wrote to memory of 2212	4028	msedge.exe	84
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 2684	4028	msedge.exe	85
PID 4028 wrote to memory of 1060	4028	msedge.exe	86
PID 4028 wrote to memory of 1060	4028	msedge.exe	86
PID 4028 wrote to memory of 340	4028	msedge.exe	87
PID 4028 wrote to memory of 340	4028	msedge.exe	87
PID 4028 wrote to memory of 340	4028	msedge.exe	87
PID 4028 wrote to memory of 340	4028	msedge.exe	87
PID 4028 wrote to memory of 340	4028	msedge.exe	87
PID 4028 wrote to memory of 340	4028	msedge.exe	87
PID 4028 wrote to memory of 340	4028	msedge.exe	87
PID 4028 wrote to memory of 340	4028	msedge.exe	87
PID 4028 wrote to memory of 340	4028	msedge.exe	87
PID 4028 wrote to memory of 340	4028	msedge.exe	87
PID 4028 wrote to memory of 340	4028	msedge.exe	87
PID 4028 wrote to memory of 340	4028	msedge.exe	87
PID 4028 wrote to memory of 340	4028	msedge.exe	87
PID 4028 wrote to memory of 340	4028	msedge.exe	87
PID 4028 wrote to memory of 340	4028	msedge.exe	87
PID 4028 wrote to memory of 340	4028	msedge.exe	87
PID 4028 wrote to memory of 340	4028	msedge.exe	87
PID 4028 wrote to memory of 340	4028	msedge.exe	87
PID 4028 wrote to memory of 340	4028	msedge.exe	87
PID 4028 wrote to memory of 340	4028	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7626c65d6ff5854f634667547c10a7e9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc715846f8,0x7ffc71584708,0x7ffc71584718
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,17847916360853692451,7572428638164402593,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,17847916360853692451,7572428638164402593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,17847916360853692451,7572428638164402593,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,17847916360853692451,7572428638164402593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,17847916360853692451,7572428638164402593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,17847916360853692451,7572428638164402593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,17847916360853692451,7572428638164402593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,17847916360853692451,7572428638164402593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,17847916360853692451,7572428638164402593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,17847916360853692451,7572428638164402593,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,17847916360853692451,7572428638164402593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,17847916360853692451,7572428638164402593,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,17847916360853692451,7572428638164402593,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5096 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:60

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2f842025e22e522658c640cfc7edc529

SHA1
4c2b24b02709acdd159f1b9bbeb396e52af27033

SHA256
1191573f2a7c12f0b9b8460e06dc36ca5386305eb8c883ebbbc8eb15f4d8e23e

SHA512
6e4393fd43984722229020ef662fc5981f253de31f13f30fadd6660bbc9ededcbfd163f132f6adaf42d435873322a5d0d3eea60060cf0e7f2e256262632c5d05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54aadd2d8ec66e446f1edb466b99ba8d

SHA1
a94f02b035dc918d8d9a46e6886413f15be5bff0

SHA256
1971045943002ef01930add9ba1a96a92ddc10d6c581ce29e33c38c2120b130e

SHA512
7e077f903463da60b5587aed4f5352060df400ebda713b602b88c15cb2f91076531ea07546a9352df772656065e0bf27bd285905a60f036a5c5951076d35e994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
6cdb91395bcf4f71ee692a91885f11c4

SHA1
79366f6cbdcbcded0d2ae30d58ede490d342b4b0

SHA256
b522549340e0118c3c979664b27697efe3b5a9d405a1c4290d36db35a6f539be

SHA512
95639da1572b1d5ad009344638c7e7650327de6ebcde4227684a1be0d05ad53ef09bb0b0815781dfb0b8480aaa7ebc1b2d93432271c4b018d57784b6ee86a3c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0ac16dc6c6a6c7cfddfc9c0a09400c26

SHA1
446f7bfd1c4d512dba4f997319cff192831bb394

SHA256
fc8c04b73b36324630f9d7968192bbc93e5be06f3211d2297e72c15bfbd9ad08

SHA512
ec9e7ceec54ccba36e68e6165b9f03268069678c69de6ac3004148bd63d001bc521cbdcec4da3f17f5c05d98d62dc32eef8d8dc392e340b66501380b7e3b4951

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
34b7b761a3221d231bebd5720173ef7b

SHA1
f8ffd00b46338d6f05485ec93542a4178ce50154

SHA256
79a2b01cb7c261419172d3162d2b11e4d47ce2ee45527c4c48eef1cccf975a73

SHA512
f93f08824ec1101d740c30903efd453c097ff1c30b60327b61012662497ee448c90f7041d4ff76a6634a44854f6cf050539df4cdd1ade5b9f2040860dcabfff3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
72cf2987508d5268ef49e0011377bc1a

SHA1
86046b64d14e94fdde399f3a3b18bb7f681970b9

SHA256
721ca3c67e0fd7a2413f83a75d33e7278122935a98d6d1efca9c3ca20a08a15f

SHA512
8045cf09bdcab87f5a95b538a4aa0a6ec4b979c4eca8c61203c6b062299110a26bf95f57a09dc790fa147c1b2525cadccd5422b0828191ad62e26b4911b2bc69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
26d7e7ff96dd83da477bf1cdca110a19

SHA1
e463d213eb4fba4b960cd3e5a31edf52396e5450

SHA256
7bf467a383132f98af5a58f92b71cdcbbdcb915cefb472ee33972b44b97bbb50

SHA512
43c68dfe1cbf9a74dbfdc856a5bc278eb8f68aca2fc2af8a8f259e2a3e9d5b666d220568b07fab7850075f11c30bf899bbc8b3e0b50bcd47ad33640959816639

Download Submit