6d319ad07dac3273fec5ad7d2173dbd5decde70b566c34c3b119a58f5c215acd

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-08-2024 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89700b06533664668f78aa53d60dce58_JaffaCakes118.html
Size

11KB
MD5

89700b06533664668f78aa53d60dce58
SHA1

a0277e8eeccec8b30f819f0958980269e45cc4df
SHA256

6d319ad07dac3273fec5ad7d2173dbd5decde70b566c34c3b119a58f5c215acd
SHA512

7757b83e75660a013d9c0b583d2d10c7825dc04851f7f61db7a282ab70aa9db6f97d1ce838bc2956236d0803df387370590f5e7049204a171c89f4c6bdc3ee1a
SSDEEP

192:zIbb6FUKSvu2gGvU45H98YLAC9Sg9Ky9rHRe4N1:zIqdSvu2gY198YLd9S+t9Neq

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
3280	msedge.exe
3280	msedge.exe
1380	identity_helper.exe
1380	identity_helper.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 1392	3280	msedge.exe	84
PID 3280 wrote to memory of 1392	3280	msedge.exe	84
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4344	3280	msedge.exe	85
PID 3280 wrote to memory of 4860	3280	msedge.exe	86
PID 3280 wrote to memory of 4860	3280	msedge.exe	86
PID 3280 wrote to memory of 3204	3280	msedge.exe	87
PID 3280 wrote to memory of 3204	3280	msedge.exe	87
PID 3280 wrote to memory of 3204	3280	msedge.exe	87
PID 3280 wrote to memory of 3204	3280	msedge.exe	87
PID 3280 wrote to memory of 3204	3280	msedge.exe	87
PID 3280 wrote to memory of 3204	3280	msedge.exe	87
PID 3280 wrote to memory of 3204	3280	msedge.exe	87
PID 3280 wrote to memory of 3204	3280	msedge.exe	87
PID 3280 wrote to memory of 3204	3280	msedge.exe	87
PID 3280 wrote to memory of 3204	3280	msedge.exe	87
PID 3280 wrote to memory of 3204	3280	msedge.exe	87
PID 3280 wrote to memory of 3204	3280	msedge.exe	87
PID 3280 wrote to memory of 3204	3280	msedge.exe	87
PID 3280 wrote to memory of 3204	3280	msedge.exe	87
PID 3280 wrote to memory of 3204	3280	msedge.exe	87
PID 3280 wrote to memory of 3204	3280	msedge.exe	87
PID 3280 wrote to memory of 3204	3280	msedge.exe	87
PID 3280 wrote to memory of 3204	3280	msedge.exe	87
PID 3280 wrote to memory of 3204	3280	msedge.exe	87
PID 3280 wrote to memory of 3204	3280	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\89700b06533664668f78aa53d60dce58_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8540646f8,0x7ff854064708,0x7ff854064718
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,14922433218261735176,4451913802122949174,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,14922433218261735176,4451913802122949174,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,14922433218261735176,4451913802122949174,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14922433218261735176,4451913802122949174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14922433218261735176,4451913802122949174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,14922433218261735176,4451913802122949174,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,14922433218261735176,4451913802122949174,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14922433218261735176,4451913802122949174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14922433218261735176,4451913802122949174,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14922433218261735176,4451913802122949174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14922433218261735176,4451913802122949174,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,14922433218261735176,4451913802122949174,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5752 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0deae2fac9910ea09248c509bdfb9330

SHA1
80bf49074bfa7e9097baa2a8b8e999b6ce87be3a

SHA256
dad7c88e2420ee02d009fd22ee7b35ad92d9af2490ba1ccc37ef8d53454e9bb3

SHA512
d9ba1de85aa88ea1ae9c958aff1fb01245e8b9abbc88d6988bc8cb0e69be05fbf300a83e4aa8fe8ef609bd08ad14fcab53da157ce8cb89085b6cd6b47e9a5851

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cbd49888b8441efe3760a119018e5c53

SHA1
28302215ca9be9e4fd7abb15df9c3e72e36879bd

SHA256
1aa7dffa2c9a97041fe21a0ea1a33063883506806514a98b6828299aad79efe6

SHA512
005fe1ad709534c302aebe73487038d52f5b5a6357e513093dee9e46df4075e3a50c75b7de4e8827c390e2a12b82486bb2dd6dda66edb09f6cb2ba343c4dfe0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ccb7b7774a16df50a00011e0a7cf1840

SHA1
7ab2c475ea9b525aa9444f5010582ac51b462913

SHA256
393462b50a8220c468263dd79020603a7045158794a0417cc68a3dd7d6ca2b73

SHA512
4eb9e6e8cabdd37d7c710605894e844ac35641d90ecf87b070f7ce6c4820318fa3115775ab9f0c3b9954835056c9840f8885b97d276725430946339a7d40a734

Download Submit