8d80f0de21c4825a5c366ee3243819c625509854ce0ca9ee7b90f8bc42e72cca

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

75068fe814c79f74ccd9ee2e765064bf_JaffaCakes118.html
Size

86KB
MD5

75068fe814c79f74ccd9ee2e765064bf
SHA1

2c4b19ca3379c12c96bcd74c3cc311726875deed
SHA256

8d80f0de21c4825a5c366ee3243819c625509854ce0ca9ee7b90f8bc42e72cca
SHA512

31c22fc3d07832e5358bd61b22957039c580ca2dcd33cd5e2b085aa356a9c0bab0afc9971909faa96bdc9b1e27b0abd874566ed9a57b6eec7b2fa8b72c5d82d1
SSDEEP

768:COfiAPMz3kW1T0YRwTIGmuG0UwuifeRoXP:COfiAPMz3kWWTIGmuG0U3ifeRof

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2840	msedge.exe
2840	msedge.exe
2616	msedge.exe
2616	msedge.exe
4104	identity_helper.exe
4104	identity_helper.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 4740	2616	msedge.exe	84
PID 2616 wrote to memory of 4740	2616	msedge.exe	84
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 4252	2616	msedge.exe	85
PID 2616 wrote to memory of 2840	2616	msedge.exe	86
PID 2616 wrote to memory of 2840	2616	msedge.exe	86
PID 2616 wrote to memory of 4348	2616	msedge.exe	87
PID 2616 wrote to memory of 4348	2616	msedge.exe	87
PID 2616 wrote to memory of 4348	2616	msedge.exe	87
PID 2616 wrote to memory of 4348	2616	msedge.exe	87
PID 2616 wrote to memory of 4348	2616	msedge.exe	87
PID 2616 wrote to memory of 4348	2616	msedge.exe	87
PID 2616 wrote to memory of 4348	2616	msedge.exe	87
PID 2616 wrote to memory of 4348	2616	msedge.exe	87
PID 2616 wrote to memory of 4348	2616	msedge.exe	87
PID 2616 wrote to memory of 4348	2616	msedge.exe	87
PID 2616 wrote to memory of 4348	2616	msedge.exe	87
PID 2616 wrote to memory of 4348	2616	msedge.exe	87
PID 2616 wrote to memory of 4348	2616	msedge.exe	87
PID 2616 wrote to memory of 4348	2616	msedge.exe	87
PID 2616 wrote to memory of 4348	2616	msedge.exe	87
PID 2616 wrote to memory of 4348	2616	msedge.exe	87
PID 2616 wrote to memory of 4348	2616	msedge.exe	87
PID 2616 wrote to memory of 4348	2616	msedge.exe	87
PID 2616 wrote to memory of 4348	2616	msedge.exe	87
PID 2616 wrote to memory of 4348	2616	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\75068fe814c79f74ccd9ee2e765064bf_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8470446f8,0x7ff847044708,0x7ff847044718
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,10336968547194127006,6395099088758188560,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,10336968547194127006,6395099088758188560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,10336968547194127006,6395099088758188560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10336968547194127006,6395099088758188560,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10336968547194127006,6395099088758188560,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,10336968547194127006,6395099088758188560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,10336968547194127006,6395099088758188560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10336968547194127006,6395099088758188560,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10336968547194127006,6395099088758188560,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10336968547194127006,6395099088758188560,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10336968547194127006,6395099088758188560,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,10336968547194127006,6395099088758188560,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5296 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
04b60a51907d399f3685e03094b603cb

SHA1
228d18888782f4e66ca207c1a073560e0a4cc6e7

SHA256
87a9d9f1bd99313295b2ce703580b9d37c3a68b9b33026fdda4c2530f562e6a3

SHA512
2a8e3da94eaf0a6c4a2f29da6fec2796ba6a13cad6425bb650349a60eb3204643fc2fd1ab425f0251610cb9cce65e7dba459388b4e00c12ba3434a1798855c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9622e603d436ca747f3a4407a6ca952e

SHA1
297d9aed5337a8a7290ea436b61458c372b1d497

SHA256
ace0e47e358fba0831b508cd23949a503ae0e6a5c857859e720d1b6479ff2261

SHA512
f774c5c44f0fcdfb45847626f6808076dccabfbcb8a37d00329ec792e2901dc59636ef15c95d84d0080272571542d43b473ce11c2209ac251bee13bd611b200a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4722b06d-f946-4caf-8888-e2fbf889d35d.tmp

Filesize
5KB

MD5
09420310f50ef51cbab476c52d0959f7

SHA1
2d29bcfe09146dfff4777dfc387cf636bce8243a

SHA256
23e2da123152a950362318c05c6954acfd60b9fdc1174e70377ecc90bbd07a2a

SHA512
e0f4196be885afef4d065366be66574f2ed7fca86f47deb17a8c90a7bff5d58ddb9a38b05700cda9bf45ec01c43f9362d4a654b6b28a5c93bce43c380cce1406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
897952ed2f5a02f0c578e2f3a39899ca

SHA1
5cce9f907d6bcbe4338227cf0c42bf536ad7fb2f

SHA256
2fa61eb7fa7f0675287c8c032feea8199d2a6d3a54c0db49ea23639f9051dbf8

SHA512
1b7b9261b27e317caccdcaa44be165f211181d31f68418d8608736a7969803509fd53532e37b3c23b54e80e47f57f4aadd4e302e96de61061f5bcf50f13ce37c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2e8966fbd25802166d604e7e098cba3a

SHA1
702a6ae89ebc11a969faf96a7654cf5e725b767f

SHA256
1b2f408acd42eab765acdebd85410564244768dbeab39b2c01f2a07c26f3f95f

SHA512
8d811121b27c211033eaff9d1ec63b700bbaa36842bf059138e4f0801fdbbc26ce10948cc978152a6d0760c6a31fe99731d14ea4f78c30da6b17ea92d358c188

Download Submit