d51ca514fc5b7524053550850b5330fa7b938b1a86187b017987fcadd6e0173d

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 03:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76f2c3ff3e44be56b2f5e4a4b69f6ade_JaffaCakes118.html
Size

26KB
MD5

76f2c3ff3e44be56b2f5e4a4b69f6ade
SHA1

6efc19a571bee935355dc14fa03988301981900e
SHA256

d51ca514fc5b7524053550850b5330fa7b938b1a86187b017987fcadd6e0173d
SHA512

b349c37abdeb4c6b57351a82abc7fc8678ad9daae4e75bc55b50ffaee8f37c0a743c3a9d00c5278048059742935940e93f36974c75d144d6b8315683f773a17a
SSDEEP

384:SZ+CEPRcX1pyyt7PbjbfjeZ4O+uGsIz9Jd4+Cd9T6ApbDYA77Lwvob1:SGRcX1pyyt7Pnbfq6b7S+4jXwI

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1108	msedge.exe
1108	msedge.exe
1276	msedge.exe
1276	msedge.exe
660	identity_helper.exe
660	identity_helper.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 4716	1276	msedge.exe	84
PID 1276 wrote to memory of 4716	1276	msedge.exe	84
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 4584	1276	msedge.exe	85
PID 1276 wrote to memory of 1108	1276	msedge.exe	86
PID 1276 wrote to memory of 1108	1276	msedge.exe	86
PID 1276 wrote to memory of 376	1276	msedge.exe	87
PID 1276 wrote to memory of 376	1276	msedge.exe	87
PID 1276 wrote to memory of 376	1276	msedge.exe	87
PID 1276 wrote to memory of 376	1276	msedge.exe	87
PID 1276 wrote to memory of 376	1276	msedge.exe	87
PID 1276 wrote to memory of 376	1276	msedge.exe	87
PID 1276 wrote to memory of 376	1276	msedge.exe	87
PID 1276 wrote to memory of 376	1276	msedge.exe	87
PID 1276 wrote to memory of 376	1276	msedge.exe	87
PID 1276 wrote to memory of 376	1276	msedge.exe	87
PID 1276 wrote to memory of 376	1276	msedge.exe	87
PID 1276 wrote to memory of 376	1276	msedge.exe	87
PID 1276 wrote to memory of 376	1276	msedge.exe	87
PID 1276 wrote to memory of 376	1276	msedge.exe	87
PID 1276 wrote to memory of 376	1276	msedge.exe	87
PID 1276 wrote to memory of 376	1276	msedge.exe	87
PID 1276 wrote to memory of 376	1276	msedge.exe	87
PID 1276 wrote to memory of 376	1276	msedge.exe	87
PID 1276 wrote to memory of 376	1276	msedge.exe	87
PID 1276 wrote to memory of 376	1276	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\76f2c3ff3e44be56b2f5e4a4b69f6ade_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ff8c39246f8,0x7ff8c3924708,0x7ff8c3924718
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,7405457413903689555,10624580154429906717,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,7405457413903689555,10624580154429906717,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,7405457413903689555,10624580154429906717,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7405457413903689555,10624580154429906717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7405457413903689555,10624580154429906717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,7405457413903689555,10624580154429906717,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,7405457413903689555,10624580154429906717,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7405457413903689555,10624580154429906717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7405457413903689555,10624580154429906717,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7405457413903689555,10624580154429906717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7405457413903689555,10624580154429906717,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,7405457413903689555,10624580154429906717,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
584971c8ba88c824fd51a05dddb45a98

SHA1
b7c9489b4427652a9cdd754d1c1b6ac4034be421

SHA256
e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307

SHA512
5dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b28ef7d9f6d74f055cc49876767c886c

SHA1
d6b3267f36c340979f8fc3e012fdd02c468740bf

SHA256
fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37

SHA512
491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
187B

MD5
2b18e7507da50694867047e724194d87

SHA1
a30ee8845d5195291e76d14989a76e52e4845066

SHA256
935e2cbdf455c4bb083b610b9d71182fe0cf703d3d6a35609e32db807de2004d

SHA512
bbaafa76be71c9f6b303ddbd1ac803c8fed98024bf1dc13dfa82bcff6e20ab5f8f8e99f756dada98503cba1bc38bb1e0443bbf86832a5af2f55d49daf6382d53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1d2471499b90cc24d7ad4905667baae2

SHA1
c8379eabef1cebf2f0940d6dcddb08e9e4d4187f

SHA256
61503bdacb11c825b3c4b691aafc061699a1984991c6b5c1151f3f539c5f35dc

SHA512
11a0603bbfd8716f74790be00ba4e38722423e9f34de11bce7dd98de7976d6ac45c9ed29e5bd413ca23623fc3ad8bcbaa56d10035ce1536e4467a8867cf5856c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
24b782682078f214af57b65af7a19024

SHA1
bc24feeb522987551d3b76c2f6815265146e2033

SHA256
203c04679892746863739a7863eab581c1c0a0853e40d1f5e3e32ed2e86bf62f

SHA512
3590a1008296a7bdc42e73e49e21f5c40a22f14c558b1a10fdb19f37eb2e5a2bb4d9c53093338b806135e5268f20d12d29fc81528a72b85771a1927c2a2c6bbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ed950f2feba39c4aafb47916bb3c02a9

SHA1
85486cd88ed2cad3b75cc0b1801b5d16f669e58c

SHA256
19b0f8f79e022cb72767899d88521c70f23f70f3abd886f0410fac2e4b0ad159

SHA512
6aa2bece9b4c719d6c79c44613e33aeabfd44a2daa390559be0442c4336f0ef1505fe7c4554f9336f615fc7d1e940f7ae30ac263423378b343da941ef267be0d

Download Submit