472796b0f3803ac648a97c6bef713350ed5cf819630aa416c63cab4c516bad9c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2024, 21:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

81dc3ef2ec1e86b60b68d496afb84fcd_JaffaCakes118.html
Size

6KB
MD5

81dc3ef2ec1e86b60b68d496afb84fcd
SHA1

b0e2c0872e4f1ceed6650e8bf32fc81ecde9cc74
SHA256

472796b0f3803ac648a97c6bef713350ed5cf819630aa416c63cab4c516bad9c
SHA512

eb5f5cf1aa2f74d015e9565f4896d4bfccf3f9f7b72b517975f9400569bd828326bcfc7dd9522f0f8a59a10dc3385aaa77e389cbed6e6fa40fb1c3ddc53b9235
SSDEEP

96:uzVs+ux7VwaLLY1k9o84d12ef7CSTU6ZcEZ7ru7f:csz7SaAYS/Jb76f

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
4928	msedge.exe
4928	msedge.exe
4268	identity_helper.exe
4268	identity_helper.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 4684	4928	msedge.exe	83
PID 4928 wrote to memory of 4684	4928	msedge.exe	83
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 1472	4928	msedge.exe	84
PID 4928 wrote to memory of 3600	4928	msedge.exe	85
PID 4928 wrote to memory of 3600	4928	msedge.exe	85
PID 4928 wrote to memory of 1724	4928	msedge.exe	86
PID 4928 wrote to memory of 1724	4928	msedge.exe	86
PID 4928 wrote to memory of 1724	4928	msedge.exe	86
PID 4928 wrote to memory of 1724	4928	msedge.exe	86
PID 4928 wrote to memory of 1724	4928	msedge.exe	86
PID 4928 wrote to memory of 1724	4928	msedge.exe	86
PID 4928 wrote to memory of 1724	4928	msedge.exe	86
PID 4928 wrote to memory of 1724	4928	msedge.exe	86
PID 4928 wrote to memory of 1724	4928	msedge.exe	86
PID 4928 wrote to memory of 1724	4928	msedge.exe	86
PID 4928 wrote to memory of 1724	4928	msedge.exe	86
PID 4928 wrote to memory of 1724	4928	msedge.exe	86
PID 4928 wrote to memory of 1724	4928	msedge.exe	86
PID 4928 wrote to memory of 1724	4928	msedge.exe	86
PID 4928 wrote to memory of 1724	4928	msedge.exe	86
PID 4928 wrote to memory of 1724	4928	msedge.exe	86
PID 4928 wrote to memory of 1724	4928	msedge.exe	86
PID 4928 wrote to memory of 1724	4928	msedge.exe	86
PID 4928 wrote to memory of 1724	4928	msedge.exe	86
PID 4928 wrote to memory of 1724	4928	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\81dc3ef2ec1e86b60b68d496afb84fcd_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd342b46f8,0x7ffd342b4708,0x7ffd342b4718
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,6340764390540164075,5335903365056286328,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,6340764390540164075,5335903365056286328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,6340764390540164075,5335903365056286328,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6340764390540164075,5335903365056286328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6340764390540164075,5335903365056286328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,6340764390540164075,5335903365056286328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,6340764390540164075,5335903365056286328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6340764390540164075,5335903365056286328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6340764390540164075,5335903365056286328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6340764390540164075,5335903365056286328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6340764390540164075,5335903365056286328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,6340764390540164075,5335903365056286328,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5424 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
23b6e2531d39ba76e0604a4685249f2d

SHA1
5f396f68bd58b4141a3a0927d0a93d5ef2c8172f

SHA256
4a486d7be440ddf2909be2c2b41e55f0666b02670bbf077ac435e3cddc55a15e

SHA512
a1a7fef086526e65184f60b61d483848183ef7c98cf09f05ac9e5b11504696406120ab01da8ed7f35e3145aa5fc54307c9397770681e4d10feea64113e7a57cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6ffd468ded3255ce35ba13e5d87c985a

SHA1
09f11746553fd82f0a0ddef4994dc3605f39ccec

SHA256
33103b1e4da1933459575d2e0441b8693ba1ede4695a3d924e2d74e72becabd8

SHA512
5d5530c57faa4711f51e4baef0d1f556937a5db1e2a54ee376c3556c01db0ddf628856f346057d3849baa5db35603b96a0a9894f3c65a80c947085eb640348ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c3978d9df483727fa5f9e576aa794faa

SHA1
dab245b28a5398a1a0debeadd0b9c8765bbd54bd

SHA256
4b07dfbdecef600a528e1c63e3806d101060a59c5fb3a32dd822065ba0f734a0

SHA512
26b68ca31c981ca86e6cf1d356011c049d9e01628f8150e0cea9fff6eb517691bbff4ccb483db87ab8f3d570bd5962b22c95d5956ad8cc00cfe871efdef0af90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b10a8150eb80272c46a1637d3ab4d7ff

SHA1
46f7c56dea4c093286d7d6932a3d47cca05625b3

SHA256
c58dae5a68d503d44443bc9bfb042dcf9225980c52905a46935c2c0dd7a519cd

SHA512
040edf9831afb7ff84ac8af1193398caff387fee6704fbfbccdd972505293a839e908adb491c0f727a88456005d1dfc3d7a8788b30b0b293139fccd4096988ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\faa8df9c-3e74-429b-9987-b147944456ef.tmp

Filesize
10KB

MD5
4ad695b565722c894bd7cddd80305e46

SHA1
3d95b293e07d63a12da0d9147c2e47a588ecd5ee

SHA256
4e943a7b92257a267784eed99e25b48087ae7b4acfb47433671095a3a491cb73

SHA512
31249ba03bf11f41dafa533e9256e3024c560350e191d446639164b059cd809e757ee746276b60e1fb821c233f87a0f0929795af5aee6b5ace2a53418e4434f0

Download Submit