617abe0f0b6ad4055b6327899e62947c819c89e80a847f08cc0fa2514e1103a1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
02-08-2024 04:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83061cfbe27f42909dc1e48165cc6846_JaffaCakes118.html
Size

35KB
MD5

83061cfbe27f42909dc1e48165cc6846
SHA1

f39c26cba38ed66604bbb8eaa2a4927cad59d97a
SHA256

617abe0f0b6ad4055b6327899e62947c819c89e80a847f08cc0fa2514e1103a1
SHA512

94319262556794d9c7f4a8c2dec7cca0190387007a07b14fda55755f38f002ff33f59948d0ea3536af8749bafdd3ec7d3d92bddbf24cf6f1fd9da91bb45fccef
SSDEEP

768:vnlCC+yfE+3F/euk/CUE50B/LwLckN0/S5lI5f+Q3YI19wx32tHf3VXb:vlCC+yfE+hURZwLckNp5KR+Q3YIrwC3J

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
1144	msedge.exe
1144	msedge.exe
3616	identity_helper.exe
3616	identity_helper.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 4532	1144	msedge.exe	83
PID 1144 wrote to memory of 4532	1144	msedge.exe	83
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 2568	1144	msedge.exe	84
PID 1144 wrote to memory of 3680	1144	msedge.exe	85
PID 1144 wrote to memory of 3680	1144	msedge.exe	85
PID 1144 wrote to memory of 3724	1144	msedge.exe	86
PID 1144 wrote to memory of 3724	1144	msedge.exe	86
PID 1144 wrote to memory of 3724	1144	msedge.exe	86
PID 1144 wrote to memory of 3724	1144	msedge.exe	86
PID 1144 wrote to memory of 3724	1144	msedge.exe	86
PID 1144 wrote to memory of 3724	1144	msedge.exe	86
PID 1144 wrote to memory of 3724	1144	msedge.exe	86
PID 1144 wrote to memory of 3724	1144	msedge.exe	86
PID 1144 wrote to memory of 3724	1144	msedge.exe	86
PID 1144 wrote to memory of 3724	1144	msedge.exe	86
PID 1144 wrote to memory of 3724	1144	msedge.exe	86
PID 1144 wrote to memory of 3724	1144	msedge.exe	86
PID 1144 wrote to memory of 3724	1144	msedge.exe	86
PID 1144 wrote to memory of 3724	1144	msedge.exe	86
PID 1144 wrote to memory of 3724	1144	msedge.exe	86
PID 1144 wrote to memory of 3724	1144	msedge.exe	86
PID 1144 wrote to memory of 3724	1144	msedge.exe	86
PID 1144 wrote to memory of 3724	1144	msedge.exe	86
PID 1144 wrote to memory of 3724	1144	msedge.exe	86
PID 1144 wrote to memory of 3724	1144	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\83061cfbe27f42909dc1e48165cc6846_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc41f946f8,0x7ffc41f94708,0x7ffc41f94718
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,7591002783178083851,7139081611482501388,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,7591002783178083851,7139081611482501388,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,7591002783178083851,7139081611482501388,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2960 /prefetch:8
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7591002783178083851,7139081611482501388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7591002783178083851,7139081611482501388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7591002783178083851,7139081611482501388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,7591002783178083851,7139081611482501388,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,7591002783178083851,7139081611482501388,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7591002783178083851,7139081611482501388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7591002783178083851,7139081611482501388,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7591002783178083851,7139081611482501388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7591002783178083851,7139081611482501388,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,7591002783178083851,7139081611482501388,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2796 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8edf5aee848362b3fa4c7102382947c3

SHA1
0ca71672592fef3c37dbf92a155d747c927b433f

SHA256
16594552785f10884854bf38d179c9c3d26d023a089180bfe5a3ceb03c395e6d

SHA512
a8863cfcea01c05938edd34690db467f0d429f0598528f23392ca7e7233a9b2fe2eaf7b886ac965e22e8c63ee79af84654e5b2f7e94033e5f54622f7b9584893

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
78d53c4ecb4f237a195804abc28ebb1e

SHA1
5b036abe11431d0c164cc5427aa7eaaa2d8d1580

SHA256
b1ead24150c5c17d1e8cdfaa64b4395cb1b0872c6f4bb25eb8e024ba0e39c847

SHA512
90c1e12b736dc1a644262a44141f4bd7eb5fe935249978d1ff083e39017652ab847107add5b5fbeec6318db181cd22a728938fba7c384c8023ed8e3c03e61496

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
914B

MD5
4ec714d1ecd66031aee6de98b8c053c7

SHA1
c37347c884561514be4da6a3ae19930f24b26e3f

SHA256
6b5baaea52b863a5a6421ddaa1cc0d337b22fd71afcdc89a20b1383e2b7a9f33

SHA512
704eafb90cd0315719b78c7af0c55cd7c1a4f858660a9b7f525e34669b73f3a715e70fca573ea09af97257edc6b700d4ef719003817dbd2a5d74bb3d2e2ab0d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
57adcf557f25899b500430b872513eae

SHA1
bb085434b2692255dfa76a6e81578e31397f3b66

SHA256
5046713c87e0fb49edbb4d697c916d13f7ab042b4c38e24e24bf9df26c0eeb99

SHA512
70091d7dc4facb49d7ea3e84865a12c10d41380eab69279dbd26d769b061f129e666ac8fcf8f2235e38f3bdb5c07a44b9a36bd605c58d4177688187fe60b350c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b1d3542a825854472180d42b0e3bb97b

SHA1
b1728771df61fdc7aa8bed6f7ad8712278c596c8

SHA256
53a4b92edbf1e2c6f962030e89263d8a74bcb49e75347d161d1561cc4ab63185

SHA512
402b871c442de4f48bc3f5bbf22fb7648cfe7912f0ecb226728a0141ea299855525b22eb6cea6882dcf01d4e769567bea6c2eaca7703963837d5d725750a5e7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ea36a5ef7402be606a32e2ecb3a3eb7e

SHA1
d647fb0d9b83ef90a35480e4ed9f044c8f2ef535

SHA256
825266158f7309171efb8770daf84a4f1782d30a9ffcd3be75e40cd48534c296

SHA512
e43b6ba4d5e15ac99d4fc5f68ad250dfa9d8114d9fa188a9ae0745cef1af9762ce40853df455887bf8680b4ccf68ce95b4a5d63219f034dc4966ed394ed46375

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
614356eda7534db773e4753dc896a611

SHA1
b43fc394e3bd73d6f4c64b9dcb76e6d8bef99584

SHA256
e59654486790e295b8b9857074f6a3e57da4592c0cd7aafdf7bc4df726bce79b

SHA512
baf199b1335a79540ed9dc4254a41709ed26077f49c4d64703470851ec6227b1f51fe2196257b878fab15961586458b4eace1b7aa4a7a6b7f8d15e7b79e50e93

Download Submit