469b2ab2119656c695640d802274afd50f633ac08b9cd30b834799ef65e92920

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27-07-2024 08:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7794323300f6d82bfe4632e5fe71ffab_JaffaCakes118.html
Size

11KB
MD5

7794323300f6d82bfe4632e5fe71ffab
SHA1

818e485fb5fe9801e13f54977553b9a5d5eed7c1
SHA256

469b2ab2119656c695640d802274afd50f633ac08b9cd30b834799ef65e92920
SHA512

eb2efda7f1c12db7db7f695db0614fb09fd335381608122ef55c890404c35af146cb6d4b8abc491ecca7485282d5801a8c725e731269d6881b627f7123b6dc04
SSDEEP

192:SIjlctL9phIwH/3xVyhxI4UFpMKbclWa2/BLDoaoc63LOQyDvfBCLSo9AmTp:SIwL9phIiSuMEc0awLkaocMLOnTfBI9j

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1648	msedge.exe
1648	msedge.exe
2920	identity_helper.exe
2920	identity_helper.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 4300	1648	msedge.exe	84
PID 1648 wrote to memory of 4300	1648	msedge.exe	84
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1224	1648	msedge.exe	85
PID 1648 wrote to memory of 1072	1648	msedge.exe	86
PID 1648 wrote to memory of 1072	1648	msedge.exe	86
PID 1648 wrote to memory of 5016	1648	msedge.exe	87
PID 1648 wrote to memory of 5016	1648	msedge.exe	87
PID 1648 wrote to memory of 5016	1648	msedge.exe	87
PID 1648 wrote to memory of 5016	1648	msedge.exe	87
PID 1648 wrote to memory of 5016	1648	msedge.exe	87
PID 1648 wrote to memory of 5016	1648	msedge.exe	87
PID 1648 wrote to memory of 5016	1648	msedge.exe	87
PID 1648 wrote to memory of 5016	1648	msedge.exe	87
PID 1648 wrote to memory of 5016	1648	msedge.exe	87
PID 1648 wrote to memory of 5016	1648	msedge.exe	87
PID 1648 wrote to memory of 5016	1648	msedge.exe	87
PID 1648 wrote to memory of 5016	1648	msedge.exe	87
PID 1648 wrote to memory of 5016	1648	msedge.exe	87
PID 1648 wrote to memory of 5016	1648	msedge.exe	87
PID 1648 wrote to memory of 5016	1648	msedge.exe	87
PID 1648 wrote to memory of 5016	1648	msedge.exe	87
PID 1648 wrote to memory of 5016	1648	msedge.exe	87
PID 1648 wrote to memory of 5016	1648	msedge.exe	87
PID 1648 wrote to memory of 5016	1648	msedge.exe	87
PID 1648 wrote to memory of 5016	1648	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7794323300f6d82bfe4632e5fe71ffab_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa842a46f8,0x7ffa842a4708,0x7ffa842a4718
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,15105444267926676139,1467179599004966721,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,15105444267926676139,1467179599004966721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,15105444267926676139,1467179599004966721,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15105444267926676139,1467179599004966721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15105444267926676139,1467179599004966721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,15105444267926676139,1467179599004966721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,15105444267926676139,1467179599004966721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15105444267926676139,1467179599004966721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15105444267926676139,1467179599004966721,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15105444267926676139,1467179599004966721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,15105444267926676139,1467179599004966721,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,15105444267926676139,1467179599004966721,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3088 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c00b0d6e0f836dfa596c6df9d3b2f8f2

SHA1
69ad27d9b4502630728f98917f67307e9dd12a30

SHA256
578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1

SHA512
0e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54f1b76300ce15e44e5cc1a3947f5ca9

SHA1
c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7

SHA256
43dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24

SHA512
ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
497d1d1c38f76210ca5d54429af4af19

SHA1
22d08aa928c3965151a3b07db190efd5e2fe2cf1

SHA256
0ad1c162010fd016eb43b7d479659bccff9af9546c350899556d6735092e7169

SHA512
0e495e64d91877f24de3e719c43c9837b4d5ef20b73adf40e1ee1e5815fe2f7a0a19b71e2855773214f205871d5ec7e4c2c7df463a6052012759cec277e6fc4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ddbc5aade90adfae91a2c9665563256a

SHA1
366ccee203f5bb88d004edce7894d0db050d61ed

SHA256
04a46196bd02fc1f3d4498daf3fc3cb86a8ad37397011ffe33a68117a7268f1f

SHA512
9381d1622d990551b5a8fa9510f550e1d45679379055416eedc4474d1606dce7a40b6521b5231adc9b9d7caab32f9e63c83e7d7a14f5d4bf4076cebd8ab88410

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d3e624d8bdeba4a6dae0d8b8eda2b241

SHA1
6477635fcac768200789f6b42db153de03b5d345

SHA256
9640d78492c629a50c46dc755820400231e2ecc63bd150332fc991691a32286c

SHA512
19a57a3b1b05e298a20a92d81c7c540ee91a72e8b196ac7538c8f83d4f707486dc4bf237fb21d33ee82f3af625da8531d949b3b03c4b8c2f5fcc098ff0f9e51a

Download Submit