43ee71eb4459c17339b571fdb797836cf12bcd4f4caac167998397f6c902c3c5

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 00:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

71e405907c38154394125f6e269828bd_JaffaCakes118.html
Size

53KB
MD5

71e405907c38154394125f6e269828bd
SHA1

8521e22e56bdf66074725c6962433ed80d0bf81f
SHA256

43ee71eb4459c17339b571fdb797836cf12bcd4f4caac167998397f6c902c3c5
SHA512

afc7a4dbbc04d7994bc47d7e4b340390b4c5bec97dcc86232442b2da559dd46a56b7b4f1f3fca362b8493965097ce4c65a0add6d7215fe7a6f3f5a2143eb754b
SSDEEP

1536:CkgUiIakTqGivi+PyUYrunlY263Nj+q5VyvR0w2AzTICbbKo3/t9M/dNwIUEDmDU:CkgUiIakTqGivi+PyUYrunlY263Nj+qt

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe
4740	msedge.exe
4740	msedge.exe
4460	identity_helper.exe
4460	identity_helper.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 2184	4740	msedge.exe	83
PID 4740 wrote to memory of 2184	4740	msedge.exe	83
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 412	4740	msedge.exe	84
PID 4740 wrote to memory of 1224	4740	msedge.exe	85
PID 4740 wrote to memory of 1224	4740	msedge.exe	85
PID 4740 wrote to memory of 1592	4740	msedge.exe	86
PID 4740 wrote to memory of 1592	4740	msedge.exe	86
PID 4740 wrote to memory of 1592	4740	msedge.exe	86
PID 4740 wrote to memory of 1592	4740	msedge.exe	86
PID 4740 wrote to memory of 1592	4740	msedge.exe	86
PID 4740 wrote to memory of 1592	4740	msedge.exe	86
PID 4740 wrote to memory of 1592	4740	msedge.exe	86
PID 4740 wrote to memory of 1592	4740	msedge.exe	86
PID 4740 wrote to memory of 1592	4740	msedge.exe	86
PID 4740 wrote to memory of 1592	4740	msedge.exe	86
PID 4740 wrote to memory of 1592	4740	msedge.exe	86
PID 4740 wrote to memory of 1592	4740	msedge.exe	86
PID 4740 wrote to memory of 1592	4740	msedge.exe	86
PID 4740 wrote to memory of 1592	4740	msedge.exe	86
PID 4740 wrote to memory of 1592	4740	msedge.exe	86
PID 4740 wrote to memory of 1592	4740	msedge.exe	86
PID 4740 wrote to memory of 1592	4740	msedge.exe	86
PID 4740 wrote to memory of 1592	4740	msedge.exe	86
PID 4740 wrote to memory of 1592	4740	msedge.exe	86
PID 4740 wrote to memory of 1592	4740	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\71e405907c38154394125f6e269828bd_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff88a7846f8,0x7ff88a784708,0x7ff88a784718
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,13462590716341050843,9688228036736609955,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,13462590716341050843,9688228036736609955,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,13462590716341050843,9688228036736609955,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13462590716341050843,9688228036736609955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13462590716341050843,9688228036736609955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13462590716341050843,9688228036736609955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,13462590716341050843,9688228036736609955,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,13462590716341050843,9688228036736609955,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13462590716341050843,9688228036736609955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13462590716341050843,9688228036736609955,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13462590716341050843,9688228036736609955,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13462590716341050843,9688228036736609955,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,13462590716341050843,9688228036736609955,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3612 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
210676dde5c0bd984dc057e2333e1075

SHA1
2d2f8c14ee48a2580f852db7ac605f81b5b1399a

SHA256
2a89d71b4ddd34734b16d91ebd8ea68b760f321baccdd4963f91b8d3507a3fb5

SHA512
aeb81804cac5b17a5d1e55327f62df7645e9bbbfa8cad1401e7382628341a939b7aedc749b2412c06174a9e3fcdd5248d6df9b5d3f56c53232d17e59277ab017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4e6521c03f1bc16d91d99c059cc5424

SHA1
043665051c486192a6eefe6d0632cf34ae8e89ad

SHA256
7759c346539367b2f80e78abca170f09731caa169e3462f11eda84c3f1ca63d1

SHA512
0bb4f628da6d715910161439685052409be54435e192cb4105191472bb14a33724592df24686d1655e9ba9572bd3dff8f46e211c0310e16bfe2ac949c49fbc5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
402B

MD5
8b6d42f625298511f3cfb33715f0b277

SHA1
2f24d235d6111e2377633b8c2cb43f06fffd3410

SHA256
53ed17575a4bbe11f7f3477771dbdefd87e02fd7ef39928a3fdf83c5177a4186

SHA512
9d3d3ca94ff010dbbf63a1d17d4acc641d43765d5b0a3fbf885bf89ff948ead9926bb052a4a6f46df2f9939a0392c9a6c51974ccd24a0fc873608ef6a93deaed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d7a24d1308f22627c7c814b9d360fa63

SHA1
2c03c3b2591f995c8afdfedf92a68ed6499265b1

SHA256
12ecab997e332efc0f8891724623359c67e04fa113d905e4637250dac7914436

SHA512
2a70f2c18f2b141af13f2d2acc6eacf59e57a10dcb956a2396ea2bdb222dfee41f4a198b75e9f7713ec9c3882fa274c04c90001285623d082305de018c59008a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2c1f37ded73c288b53a5db294baba6da

SHA1
1561133b1170757ad3c916ac816a2576640b0dcd

SHA256
335be9e2e5447966ba3b00fc3958e3366cd850de50321463fb6cf0d19a48cd3f

SHA512
af36125dcb867c26f5aa774675b37bd5ddea90c0b9c899409c64e9402c43d35fb3a78b25c4c3c8598a5b6f0d0bfeac770545b8df36e2dfe298b856cb8420f3c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8f3c4115d348a9fa36b3fd3d83299ebd

SHA1
35cc247658c0c8c355d192e74e0c603a088b696f

SHA256
21befe3330a20c0f05067dd6412a2f81189c6c9a707ef2be9c8e1fcf8bdd26f9

SHA512
7a76c10ea1a826d87ebe963040afa8af6602bc4a458e4b2cb8163442a133de10db4bd72df00d86e13dc5ce867bdf013d956cb3051914bda98cdc56ad7c3eb120

Download Submit