6274471e79ea091cf84b60d15ee2df5300c479f1d999b24b5c4cf7b185223722

Analysis

max time kernel
145s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/08/2024, 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93ce208bd282b4c49645ba34884f7357_JaffaCakes118.html
Size

28KB
MD5

93ce208bd282b4c49645ba34884f7357
SHA1

26a87604e66c3ef4ffdae4c9d57781e2432c7883
SHA256

6274471e79ea091cf84b60d15ee2df5300c479f1d999b24b5c4cf7b185223722
SHA512

79d39308d2a722486e6df18b9ccc6a09b9a4a36c1254450c3ca3755e5622913f5cbca77e9b29eb5cbad44a50f4316c816c5d12b291cf1c232b6da9319b989ced
SSDEEP

192:uwzob5nZeDknQjxn5Q/dnQieoNnAnQOkEntXTnQTbnxnQ9eWYm6sVWqv3Ql7MBIW:1Q/UXAQWqeSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1680	msedge.exe
1680	msedge.exe
4584	msedge.exe
4584	msedge.exe
3808	identity_helper.exe
3808	identity_helper.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 1104	4584	msedge.exe	84
PID 4584 wrote to memory of 1104	4584	msedge.exe	84
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 3528	4584	msedge.exe	85
PID 4584 wrote to memory of 1680	4584	msedge.exe	86
PID 4584 wrote to memory of 1680	4584	msedge.exe	86
PID 4584 wrote to memory of 4440	4584	msedge.exe	87
PID 4584 wrote to memory of 4440	4584	msedge.exe	87
PID 4584 wrote to memory of 4440	4584	msedge.exe	87
PID 4584 wrote to memory of 4440	4584	msedge.exe	87
PID 4584 wrote to memory of 4440	4584	msedge.exe	87
PID 4584 wrote to memory of 4440	4584	msedge.exe	87
PID 4584 wrote to memory of 4440	4584	msedge.exe	87
PID 4584 wrote to memory of 4440	4584	msedge.exe	87
PID 4584 wrote to memory of 4440	4584	msedge.exe	87
PID 4584 wrote to memory of 4440	4584	msedge.exe	87
PID 4584 wrote to memory of 4440	4584	msedge.exe	87
PID 4584 wrote to memory of 4440	4584	msedge.exe	87
PID 4584 wrote to memory of 4440	4584	msedge.exe	87
PID 4584 wrote to memory of 4440	4584	msedge.exe	87
PID 4584 wrote to memory of 4440	4584	msedge.exe	87
PID 4584 wrote to memory of 4440	4584	msedge.exe	87
PID 4584 wrote to memory of 4440	4584	msedge.exe	87
PID 4584 wrote to memory of 4440	4584	msedge.exe	87
PID 4584 wrote to memory of 4440	4584	msedge.exe	87
PID 4584 wrote to memory of 4440	4584	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\93ce208bd282b4c49645ba34884f7357_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff894246f8,0x7fff89424708,0x7fff89424718
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,9131972448158703838,5727594840350049455,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,9131972448158703838,5727594840350049455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,9131972448158703838,5727594840350049455,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9131972448158703838,5727594840350049455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9131972448158703838,5727594840350049455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,9131972448158703838,5727594840350049455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,9131972448158703838,5727594840350049455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9131972448158703838,5727594840350049455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9131972448158703838,5727594840350049455,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2288 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9131972448158703838,5727594840350049455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9131972448158703838,5727594840350049455,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,9131972448158703838,5727594840350049455,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5832 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a5c9a6886578a9ab508b01f6f157e4e4

SHA1
b28677e1fa10aafd5efb7aa0e7b9e63db3a2b88a

SHA256
a5edd7110cba3e90c465b5d8899e998685a2037ab50e55abf2a681c81cca331e

SHA512
9778d66e3f159bbda3f8e24b538a3ec8a8c5079f5ff825d9f5133b319bbd7257b4b6ab733779e88ad4aa66050fc8253fb8918019d716c6108bb1f1527c1fa287

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8cfd761483bfc50f8a191e50bb4e544e

SHA1
18d70dbedb7e51a7575ead911780c5b4665a5b6e

SHA256
9d4984d30566b7bbcdd495e683fa46410426bf28f7bfe96a8bc7656adc73e350

SHA512
cce13ead0794c193d3390f65daef3b031361decbb7428ad68e580f64ef3ed0e29fe2aac04b1e029cc5008c364c58b2b7494361664a397dc293e1ae8e8202eaf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8a16b8e3e79b8cb0c1a01ff1cc2d16fe

SHA1
6bc65980e866f9408e1a850f624b9d74a4c843a1

SHA256
084b4fabe472075f4827bb00aba95ee25bc4d902d095c9607722220d3ec7a572

SHA512
3d1a716c76b98ef352fac3f03a50eda96a49e379feb1494d55cda95ad0b2a86e10edbf76efdcad259977e9d2d652c7e9f5c42c5ab58376e3cf68359644f2184e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
937cf2c1010eb633b2f33c92a669a75f

SHA1
91238a6ee71f63ec8d46b3e963377eef965def53

SHA256
6d3da64872dc813d34c12b496e85471a80f51c96caac1ddf4047d6883c4bfee4

SHA512
81c8bc37a8a5d139445fbf011cfa975ad5df0e12ff58626c8bcc2caf983eee084882935095644f24c47026cea41823673e6b91a7d92feeface9aee710bbcc384

Download Submit