71679f23a7ff633a94a58912171b95c82861d94b1a1553f42c2d8b076e301ec3

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 07:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

854cefa82519e5b654beee07d385a7be_JaffaCakes118.html
Size

67KB
MD5

854cefa82519e5b654beee07d385a7be
SHA1

e62d4c7e08a20a76f4e122ef47f4a4b1ffbbb16b
SHA256

71679f23a7ff633a94a58912171b95c82861d94b1a1553f42c2d8b076e301ec3
SHA512

bdea7ee2e0ae0740cb33c16d74d6374f30ee4f8c4214c3972e5f53e2c2fe6b30880912785bb875e80622ca5a285e12d3758199bcf32cf72ff9008f2f23265c98
SSDEEP

768:zlkSgOriWNcaSoYBgGb86+D2M1dmJD8j35urDopIVPfJcxT0izXh5rGNSGlW29VT:KBBJ86RM1dmJD8j35urlarKSGlN

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
840	msedge.exe
840	msedge.exe
4336	identity_helper.exe
4336	identity_helper.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 5056	840	msedge.exe	84
PID 840 wrote to memory of 5056	840	msedge.exe	84
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 4500	840	msedge.exe	85
PID 840 wrote to memory of 5064	840	msedge.exe	86
PID 840 wrote to memory of 5064	840	msedge.exe	86
PID 840 wrote to memory of 100	840	msedge.exe	87
PID 840 wrote to memory of 100	840	msedge.exe	87
PID 840 wrote to memory of 100	840	msedge.exe	87
PID 840 wrote to memory of 100	840	msedge.exe	87
PID 840 wrote to memory of 100	840	msedge.exe	87
PID 840 wrote to memory of 100	840	msedge.exe	87
PID 840 wrote to memory of 100	840	msedge.exe	87
PID 840 wrote to memory of 100	840	msedge.exe	87
PID 840 wrote to memory of 100	840	msedge.exe	87
PID 840 wrote to memory of 100	840	msedge.exe	87
PID 840 wrote to memory of 100	840	msedge.exe	87
PID 840 wrote to memory of 100	840	msedge.exe	87
PID 840 wrote to memory of 100	840	msedge.exe	87
PID 840 wrote to memory of 100	840	msedge.exe	87
PID 840 wrote to memory of 100	840	msedge.exe	87
PID 840 wrote to memory of 100	840	msedge.exe	87
PID 840 wrote to memory of 100	840	msedge.exe	87
PID 840 wrote to memory of 100	840	msedge.exe	87
PID 840 wrote to memory of 100	840	msedge.exe	87
PID 840 wrote to memory of 100	840	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\854cefa82519e5b654beee07d385a7be_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e0d346f8,0x7ff8e0d34708,0x7ff8e0d34718
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,15226096645103403844,479396812692453386,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,15226096645103403844,479396812692453386,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,15226096645103403844,479396812692453386,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,15226096645103403844,479396812692453386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,15226096645103403844,479396812692453386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,15226096645103403844,479396812692453386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,15226096645103403844,479396812692453386,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,15226096645103403844,479396812692453386,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,15226096645103403844,479396812692453386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=212 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,15226096645103403844,479396812692453386,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,15226096645103403844,479396812692453386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,15226096645103403844,479396812692453386,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,15226096645103403844,479396812692453386,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5560 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
792364e39e04f2d21bfbf8384d78ce01

SHA1
4e08c4791f1b50119050c4ed3f0aa6cbc1b40e0d

SHA256
b39a957a3393646d402a9f0b4c926a0f709122b492fd66daae99218121bbb82c

SHA512
cb857f42bdaa05550cb62d058b320c3053272e348ae52e55a377b1819ce2815ad9ebd7deba24defbb0ed7baa55e07b43d0e8f1d4c4a25129baf2b4d0f13cddc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
821B

MD5
0f156c4a2da15656c563870174044a7e

SHA1
dbfaa53f48f672dd62d7e181e54cde0ab8a6ccbf

SHA256
7e850c6e13b171a5bdc89e38bc242097b626bfd0375d413350b150c232a5216f

SHA512
a01c5e6c72566f14070a767a7798ca40c5863be16142b65f1b3e42e0337a21d918bdcf58e57724d0475ffd695f8ddb3a6f6a79bbbc98139eb70be7b8a7c1092f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6f60b89d316f041faa24cd176b92166b

SHA1
d41bb2225d03ea680a1ed1324e488749e652ebca

SHA256
eb0f63c4281b3a75722e85c2105a7c541654309da4979e4b80a3899aef74e051

SHA512
4b0f9859518ce932df77e6b260a7bf8ba037b1fdcf2e5100fac67879779f984b762f7856c1735adf3f370738bc8db516abcf6a18d8284f56f9bc8f6a3bfc0fde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b61e9feaf99e4d69783cbdf2a2b266aa

SHA1
f1d687874e928359850feb41385d237c431360a4

SHA256
b65da05138000a1665a3a1760c17769c6146eab857ec24a428d80dafbe889ba9

SHA512
2c3bc4ad07f195d83819bdcfdef031e248143e9358624824f9d60635c7ed3bd4ea92b6a46697773fe6b86f87879cf673d853ded086598fdac35a7a5b2032d758

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ee87d112f76dcdac54502a8ee543fe36

SHA1
106a164f1dfba126f63fbc6f37f29d8f3150cd11

SHA256
752bdbad7de8a6c3e2cc259298e9eb5998e98a2f778e7f9239125e5a06ab6cc5

SHA512
336b4eb602a8a111b6399374441f1735bd69d463cdd5de07003b549fe92426c8e17e8739d5f12f362c1592f1cf420ec93ff71058e153cb90632f7ed97a559bff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
661d10c58340fb0064c9f80ece21074c

SHA1
b8d5154b0a3336e750fd76f81ebd511284874bf2

SHA256
86dcf7d2251c75de08641f0663f5164eb654e4e58c76b27eaa19272c2081cd8f

SHA512
28b20314fc2d2799af5440c6f3a47de017dbe30053a2011335b8c3c9e1b01390e7d313f69a6f033343d75ba4fee4576ce086452220235f4f8fe76a7a1d16a5ef

Download Submit