b3d2dc9ae493a7686c29da6cebf4e2f7f6564660faadc2dc29f41b8f9a4fe71c

Analysis

max time kernel
148s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 01:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

82936b75d1c448a3c0fe8132a0760f4d_JaffaCakes118.html
Size

11KB
MD5

82936b75d1c448a3c0fe8132a0760f4d
SHA1

631ff3f75ebbcf193844358d3158355f8121271f
SHA256

b3d2dc9ae493a7686c29da6cebf4e2f7f6564660faadc2dc29f41b8f9a4fe71c
SHA512

7e395fea8aaa85abcc725bb0ce54afb9622ec64128b202a378d9d0502f7f3af9d19ffb7278ce3b1a0e0140ea88d3ecc25566ccdf485a3d6610e7905278e8c6f6
SSDEEP

192:csJbHR+k3tXqV3i7I3UO7x6jEOtgSJsvfNnxRAJ4+dPEK+M9huQpAcWZME:hHR+WQ3i7I3UexiEOiSJs9xRAJ4+dPEb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
1576	msedge.exe
1576	msedge.exe
1044	identity_helper.exe
1044	identity_helper.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 1140	1576	msedge.exe	82
PID 1576 wrote to memory of 1140	1576	msedge.exe	82
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 4828	1576	msedge.exe	85
PID 1576 wrote to memory of 5096	1576	msedge.exe	86
PID 1576 wrote to memory of 5096	1576	msedge.exe	86
PID 1576 wrote to memory of 1740	1576	msedge.exe	87
PID 1576 wrote to memory of 1740	1576	msedge.exe	87
PID 1576 wrote to memory of 1740	1576	msedge.exe	87
PID 1576 wrote to memory of 1740	1576	msedge.exe	87
PID 1576 wrote to memory of 1740	1576	msedge.exe	87
PID 1576 wrote to memory of 1740	1576	msedge.exe	87
PID 1576 wrote to memory of 1740	1576	msedge.exe	87
PID 1576 wrote to memory of 1740	1576	msedge.exe	87
PID 1576 wrote to memory of 1740	1576	msedge.exe	87
PID 1576 wrote to memory of 1740	1576	msedge.exe	87
PID 1576 wrote to memory of 1740	1576	msedge.exe	87
PID 1576 wrote to memory of 1740	1576	msedge.exe	87
PID 1576 wrote to memory of 1740	1576	msedge.exe	87
PID 1576 wrote to memory of 1740	1576	msedge.exe	87
PID 1576 wrote to memory of 1740	1576	msedge.exe	87
PID 1576 wrote to memory of 1740	1576	msedge.exe	87
PID 1576 wrote to memory of 1740	1576	msedge.exe	87
PID 1576 wrote to memory of 1740	1576	msedge.exe	87
PID 1576 wrote to memory of 1740	1576	msedge.exe	87
PID 1576 wrote to memory of 1740	1576	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\82936b75d1c448a3c0fe8132a0760f4d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd0e2146f8,0x7ffd0e214708,0x7ffd0e214718
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,629374435036635001,10113698709845030676,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,629374435036635001,10113698709845030676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,629374435036635001,10113698709845030676,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,629374435036635001,10113698709845030676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,629374435036635001,10113698709845030676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,629374435036635001,10113698709845030676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,629374435036635001,10113698709845030676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,629374435036635001,10113698709845030676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,629374435036635001,10113698709845030676,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,629374435036635001,10113698709845030676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,629374435036635001,10113698709845030676,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,629374435036635001,10113698709845030676,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5500 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
336e632142966bb5b1555731fdae58b9

SHA1
df21896206cb41e55caef4082b8d402435de5389

SHA256
bf03fb88aee2f97c7757c4d05b84f3873ba82c16de2a537679f521bb42d2a3d8

SHA512
f7cc58005811b16b1842307d473d379a0444269936ab2c0bbd58d827ad5383e0400e2a7e863f59215412a2f84924b1f8758b155b1b7eb83d045d1b6883c92173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dd3fc896ff3b0d6ebf2ed72827fd3aa3

SHA1
8c8a9bcb355d3fddca81c5a0b7c85a094fbe9b5f

SHA256
7d083e4431e3faf959c6c5f74d0319e5c7b199407b6a36c7adc980376e6da72e

SHA512
5950639d09cd39676d2277efd11e4e21fcb6431cd67f7f2ba900def9d25fc4d56015ae2a0e32fa9f599e71f1ffd0f1b3981c57a30d73095915f975e783633619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
55ccb26ecd0be5c0f78e1bad7383f84c

SHA1
43f3666e318553adafb7a2303ee3cad7dd41252e

SHA256
6cf1ea2bd8d199e2a66f4f7138421b58671fbf1e776ba572ac672b112c67a98e

SHA512
63559ffefb549c48b3b4d192345f06886ec8f285baa4e732c69b914079a8ac3c159d4cb16a9cb5e503a2ea8cf10493445bd0d91ce087f9bb495a7c01de4fa4fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9fca27991af99e6379e28500e2d76182

SHA1
077b25fafea1a08094be6ddd8e81d7595653aa8f

SHA256
7d4edb4a668c26077a41bde699d43852b8178845b385cb349433a15178cb9359

SHA512
1ea4e4e9ad6cddc3766550cdee4148921c1d1c5bd28f61d460f066ec4d9b4dbd1e98e075eeeb168be3ed2a8db68a1c912ef4add814cbcfe47af4ba986b116baa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6e5f3950f87252aad191756445a4f2cc

SHA1
62460dc58a45bcb7e5313b1e872854f34f8b90d6

SHA256
0a96f4399cf07e97417340cbcb740ccc15ea6e77d5c3d012bcf40f24558e4c47

SHA512
31ee49991f5516d031b173a7ca7ccce7e828c0a4f191bfbe783607823e16d01fdff95c08f9f45e40168aa7f6fe67962f16864169c37414a221a6d74a59047172

Download Submit