16939a3658e75a4fd493c352f5c540893bb44cc65e3329207f1773bd4953b875

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 12:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85f8b0ad2b84cf3cfa0c3c41a825f2b3_JaffaCakes118.html
Size

111KB
MD5

85f8b0ad2b84cf3cfa0c3c41a825f2b3
SHA1

c9dd2ffeaa0128ec0def1c19d90ea5b8cc57c314
SHA256

16939a3658e75a4fd493c352f5c540893bb44cc65e3329207f1773bd4953b875
SHA512

6da7454396c8adbec4e8795281a9de6a483fc114aad990ad79c2fcfa1529700c42e374554ef75dc11bef90d912aeaad803d51d9d6277ad1d658348f5a0c34795
SSDEEP

1536:SB3JIJ1O8tFkYAOIg1pxHFmT0CkciMFOwqmdn6wR6k32HiiHZSSp/m1kK+J3DzAv:SQU3lSW7L2y

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1288	msedge.exe
1288	msedge.exe
264	msedge.exe
264	msedge.exe
4080	identity_helper.exe
4080	identity_helper.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 264 wrote to memory of 4428	264	msedge.exe	84
PID 264 wrote to memory of 4428	264	msedge.exe	84
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1256	264	msedge.exe	85
PID 264 wrote to memory of 1288	264	msedge.exe	86
PID 264 wrote to memory of 1288	264	msedge.exe	86
PID 264 wrote to memory of 4624	264	msedge.exe	87
PID 264 wrote to memory of 4624	264	msedge.exe	87
PID 264 wrote to memory of 4624	264	msedge.exe	87
PID 264 wrote to memory of 4624	264	msedge.exe	87
PID 264 wrote to memory of 4624	264	msedge.exe	87
PID 264 wrote to memory of 4624	264	msedge.exe	87
PID 264 wrote to memory of 4624	264	msedge.exe	87
PID 264 wrote to memory of 4624	264	msedge.exe	87
PID 264 wrote to memory of 4624	264	msedge.exe	87
PID 264 wrote to memory of 4624	264	msedge.exe	87
PID 264 wrote to memory of 4624	264	msedge.exe	87
PID 264 wrote to memory of 4624	264	msedge.exe	87
PID 264 wrote to memory of 4624	264	msedge.exe	87
PID 264 wrote to memory of 4624	264	msedge.exe	87
PID 264 wrote to memory of 4624	264	msedge.exe	87
PID 264 wrote to memory of 4624	264	msedge.exe	87
PID 264 wrote to memory of 4624	264	msedge.exe	87
PID 264 wrote to memory of 4624	264	msedge.exe	87
PID 264 wrote to memory of 4624	264	msedge.exe	87
PID 264 wrote to memory of 4624	264	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\85f8b0ad2b84cf3cfa0c3c41a825f2b3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e2d446f8,0x7ff9e2d44708,0x7ff9e2d44718
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,15324582487594940399,12556649690403509587,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,15324582487594940399,12556649690403509587,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,15324582487594940399,12556649690403509587,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15324582487594940399,12556649690403509587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15324582487594940399,12556649690403509587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,15324582487594940399,12556649690403509587,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,15324582487594940399,12556649690403509587,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15324582487594940399,12556649690403509587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15324582487594940399,12556649690403509587,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15324582487594940399,12556649690403509587,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15324582487594940399,12556649690403509587,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,15324582487594940399,12556649690403509587,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
476a1610398f196e0e891c9833fdb5ba

SHA1
e5d36b80d97470fa6cbcb8b1cd31979a4c2a1218

SHA256
65e2117a0c948228a2d9acbfdb409d37f78df034968e419e835cb3b97f9cb8cd

SHA512
0675864a16da57d919dd0e037f133dd6788ca9d29b87bfb09e81456ab2f28d5570f2829f70bef4d5fb39d7347179cd88cf2246cf258bce792f9b8eef3eccbb15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
285c07096922a6768285992c58162528

SHA1
f267ee5421af9c03cca256ee37974d681d3e3531

SHA256
cb2ffad074cefae24216f064d7e025aee5327a32db5bcc88250dd2489c45db0c

SHA512
76b0e2aa24b0aa86056a8ed92de2364332504bda59850b2131657bd0162739595db4a9d05149a46e685967e09bc4b780ccf7241e4c011e631b4375817cc83e0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fd1a2e0c9cff65ddc91aeb226cd5d881

SHA1
cebdc902f338ec9f1e67c99075adc67ff04003ff

SHA256
268c5e8d6a5068cde95891cb3dfea5e1daab8e1b8467248cd26b9a3349669bfe

SHA512
44e4a8b388e742e2bee5d08291fad81ad903a5faa42994498bedf120d9b4a47787cf6fa520cf339d9162b489681d28f3d9e86786fcdfec7e066b222cc9afe3d6

Download Submit