a8ec1578cbdc570d4e1b8fe22a19ecbf9a41a630c0f32364253e08a851615da4

Analysis

max time kernel
145s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/08/2024, 07:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8dd31fed4176930eaf0db1e48f26bf1b_JaffaCakes118.html
Size

19KB
MD5

8dd31fed4176930eaf0db1e48f26bf1b
SHA1

86025a37ed32f8bdbb5afa7963f32eddc1527d44
SHA256

a8ec1578cbdc570d4e1b8fe22a19ecbf9a41a630c0f32364253e08a851615da4
SHA512

b5ed1d12ee7256969ba125b53dfc7f92ade1eac4ff8fc33162190c212669694c19c1b35813e0482dc628f769533e28c3a1e952c3f17d8234a6b3ea66c68f6916
SSDEEP

384:LLRxaoMItvoleWWzDEPhJOKJ/WRqNzTH54cDoSh4FCEWYUn4Z4AxVDGGFN3oVL:LLRxaoMQwlARyHXnWFCEaHAxtdFN3oVL

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
4276	msedge.exe
4276	msedge.exe
3992	identity_helper.exe
3992	identity_helper.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 4444	4276	msedge.exe	83
PID 4276 wrote to memory of 4444	4276	msedge.exe	83
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1624	4276	msedge.exe	84
PID 4276 wrote to memory of 1672	4276	msedge.exe	85
PID 4276 wrote to memory of 1672	4276	msedge.exe	85
PID 4276 wrote to memory of 5092	4276	msedge.exe	86
PID 4276 wrote to memory of 5092	4276	msedge.exe	86
PID 4276 wrote to memory of 5092	4276	msedge.exe	86
PID 4276 wrote to memory of 5092	4276	msedge.exe	86
PID 4276 wrote to memory of 5092	4276	msedge.exe	86
PID 4276 wrote to memory of 5092	4276	msedge.exe	86
PID 4276 wrote to memory of 5092	4276	msedge.exe	86
PID 4276 wrote to memory of 5092	4276	msedge.exe	86
PID 4276 wrote to memory of 5092	4276	msedge.exe	86
PID 4276 wrote to memory of 5092	4276	msedge.exe	86
PID 4276 wrote to memory of 5092	4276	msedge.exe	86
PID 4276 wrote to memory of 5092	4276	msedge.exe	86
PID 4276 wrote to memory of 5092	4276	msedge.exe	86
PID 4276 wrote to memory of 5092	4276	msedge.exe	86
PID 4276 wrote to memory of 5092	4276	msedge.exe	86
PID 4276 wrote to memory of 5092	4276	msedge.exe	86
PID 4276 wrote to memory of 5092	4276	msedge.exe	86
PID 4276 wrote to memory of 5092	4276	msedge.exe	86
PID 4276 wrote to memory of 5092	4276	msedge.exe	86
PID 4276 wrote to memory of 5092	4276	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8dd31fed4176930eaf0db1e48f26bf1b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab96846f8,0x7ffab9684708,0x7ffab9684718
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,11112862624154895362,6751685317908201512,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,11112862624154895362,6751685317908201512,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,11112862624154895362,6751685317908201512,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11112862624154895362,6751685317908201512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11112862624154895362,6751685317908201512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11112862624154895362,6751685317908201512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,11112862624154895362,6751685317908201512,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,11112862624154895362,6751685317908201512,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11112862624154895362,6751685317908201512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11112862624154895362,6751685317908201512,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11112862624154895362,6751685317908201512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11112862624154895362,6751685317908201512,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,11112862624154895362,6751685317908201512,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
22fa9df69e92b8024421a8d3090552f5

SHA1
5a49f905d41896fd4182ab6d04dd3b22286591f3

SHA256
7e12b0767072ae596ff62e0fb3242ce27e3d0f2cd427c3718914655d0b3d5ae0

SHA512
819ce1b46899f9a5f0649131a038f5d02fee95d123db4a8527dbaca586a8c1ba50383c0b6aad0e3370bcf54df31e892f64b636ebd7a1d5ac479181abfc9c4b1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
80d478f8c49da0f623b6455dad0e2e65

SHA1
38dd3d4e9df857856bc921740f37d6ad46c65db1

SHA256
ecfda1506de710463060f27ec5818ca2a25e5a77edeedf8990b8375fa2ae7967

SHA512
c9f70d3d12e180fd14280bc3578f5dd39a3a3113662ffacb388a79cf19b80cc7709e9c4c55659f6d9304ec1f127a29cc631a078f103ef9331f934412a4342771

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
554de3aab678b5925de0c666ede699b0

SHA1
e01d27cbf21284fb151c14d85ef828b3fb592fd1

SHA256
2278d447a7b56c216b805c5b0e7c5a8db2865ccd320936db4ade897f745bc1cf

SHA512
da3c93ac7644e9a58d84afe66d662a1c759fc833b5f2b24d10e34e4172aa6ed50794b3a4f4937e153f34c522491497c7dd79f02adda84e7ec843897be73e7628

Download Submit