d30e64c21ae5d3e80c76ffbdc02fe4eab0fee50c2e907b94bcc903418c77225c

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

840e901f8be7b8af95ca5853566c89d5_JaffaCakes118.html
Size

196KB
MD5

840e901f8be7b8af95ca5853566c89d5
SHA1

69074618ebbbb42b31886aec7f6c7aca53299a7a
SHA256

d30e64c21ae5d3e80c76ffbdc02fe4eab0fee50c2e907b94bcc903418c77225c
SHA512

49d52c10365c16b3a6a1d04f196f4de046cff96b50d183988bee8ebef7880b0d42513bba53bbf638675e03b7512a02ebfb4b78801e2cca6d09518db74e8b124e
SSDEEP

3072:jzSpebM+kLhEtjb9U4HiCiXonLprou0ys+lw0Jmz80K:jzSpew+kLmRhku0ys+VJmAF

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
1204	msedge.exe
1204	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 4636	1204	msedge.exe	84
PID 1204 wrote to memory of 4636	1204	msedge.exe	84
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 1512	1204	msedge.exe	85
PID 1204 wrote to memory of 4880	1204	msedge.exe	86
PID 1204 wrote to memory of 4880	1204	msedge.exe	86
PID 1204 wrote to memory of 2568	1204	msedge.exe	87
PID 1204 wrote to memory of 2568	1204	msedge.exe	87
PID 1204 wrote to memory of 2568	1204	msedge.exe	87
PID 1204 wrote to memory of 2568	1204	msedge.exe	87
PID 1204 wrote to memory of 2568	1204	msedge.exe	87
PID 1204 wrote to memory of 2568	1204	msedge.exe	87
PID 1204 wrote to memory of 2568	1204	msedge.exe	87
PID 1204 wrote to memory of 2568	1204	msedge.exe	87
PID 1204 wrote to memory of 2568	1204	msedge.exe	87
PID 1204 wrote to memory of 2568	1204	msedge.exe	87
PID 1204 wrote to memory of 2568	1204	msedge.exe	87
PID 1204 wrote to memory of 2568	1204	msedge.exe	87
PID 1204 wrote to memory of 2568	1204	msedge.exe	87
PID 1204 wrote to memory of 2568	1204	msedge.exe	87
PID 1204 wrote to memory of 2568	1204	msedge.exe	87
PID 1204 wrote to memory of 2568	1204	msedge.exe	87
PID 1204 wrote to memory of 2568	1204	msedge.exe	87
PID 1204 wrote to memory of 2568	1204	msedge.exe	87
PID 1204 wrote to memory of 2568	1204	msedge.exe	87
PID 1204 wrote to memory of 2568	1204	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\840e901f8be7b8af95ca5853566c89d5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff91c4a46f8,0x7ff91c4a4708,0x7ff91c4a4718
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,8347980988030008249,16763012771440936894,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,8347980988030008249,16763012771440936894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,8347980988030008249,16763012771440936894,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,8347980988030008249,16763012771440936894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,8347980988030008249,16763012771440936894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,8347980988030008249,16763012771440936894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,8347980988030008249,16763012771440936894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,8347980988030008249,16763012771440936894,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
9b11933d697128076d18f08b5456ca37

SHA1
7c2bc24da8ff8edad0c0601a061139c5447cf424

SHA256
fe983596c0d7d7fed78401f3956fd8ef2560e286b8a609808f54565af5e0dc45

SHA512
511a293c4c9eb84c4b4bf5120b73ba74541d5d5f2300577f6b252d3acda90d14c36eb08ba05a025ec6174f64882fa97ffb14984fc827418f0ac6e497084b5e09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
edf5ba4afae216d3b2a0794282fd5a58

SHA1
1c5bee4cbc16453c3d5f9b751cb2a61148aa9898

SHA256
7d1da4b7fac30e6b881d57653e93cf76dba9ce6d8910a6435ab6a2b44cd0edfa

SHA512
0ec31426590fa841121fe84e0d5b25691e697e2057a08bac8a94900174df7d7ec23e0ae27b63cc477bab5a2a4776047d057c68de02fc1bcb57c3caba832a4e55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cdc7fb51af3ea6ae4a82fa8d321a6579

SHA1
66aea3939f46fc285d8d150f28a3e849bcdf1acc

SHA256
97a4001300c17f3f144f5e59c01a027d500a0b9af2f2c27b0bd228d16aea583e

SHA512
5c46831a896da1695f2e83b829171dad4cd9892013d0df9b04e9a96c243cd1893e51b05dac3427ad7f4667a4632937fa8e1bf96f522657269a09aa7b835f3fbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
349632082a976b01d62e0e35c02e01c0

SHA1
9d44b448183a267aa9b8a2a912b0c1d6ca6fed71

SHA256
d5baa1ad4728ca206e79f1fefbbe4a9d1651c8b398a959666b90ab16c1c59eb9

SHA512
344e4dd9e55ef1a9dd7dc01eae4279d076c4695c2a2b7e50e3e84d5ad68cdb2b487b1ba6b91db95a44ee03c0dcd61249541d7c4b439fb9caa85ec5a425bee6d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
13988040284a0b00d16205f1900cad52

SHA1
2cbd8fcf0e2a06c1bd18927bafbb9f5833d4933a

SHA256
d4e6d28b136f9c9d8a88ec21f70ce189bba77f62b46ed3bb592bef50fcdefd19

SHA512
3371abbd142223488ebc4d5bc8675a313ac3c94cb8f564bb76577c9a5b2b68cb34b4ac3c9ded40088a6cf5b44f335c6eae78b19518fc7ba292860ba26ab312be

Download Submit