72112a439f2d6f6b1c57b125e6f803ca6c8d5edef1740dbba7eaa5d495cf9af8

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 14:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9667dcf1faced9701572e2bb7e5f73b4_JaffaCakes118.html
Size

67KB
MD5

9667dcf1faced9701572e2bb7e5f73b4
SHA1

19e1026e00f4e1014c704390a09cba08768500d4
SHA256

72112a439f2d6f6b1c57b125e6f803ca6c8d5edef1740dbba7eaa5d495cf9af8
SHA512

148a20ac01f151f760f57ff11f4f743e5eee7875a8ae62b82c0f5fd6001cc62ae4338128b1d7fd35966fbf3434ba9205b8cb8e5d716e55aa3db117153deee78b
SSDEEP

1536:b39PMuokO/jW4Bw4Ea70MuQWE7WV6gVgRNgXbGrvMBVJD:Gjv7uxBVJD

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2156	msedge.exe
2156	msedge.exe
2280	msedge.exe
2280	msedge.exe
1572	identity_helper.exe
1572	identity_helper.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 4064	2280	msedge.exe	86
PID 2280 wrote to memory of 4064	2280	msedge.exe	86
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2312	2280	msedge.exe	87
PID 2280 wrote to memory of 2156	2280	msedge.exe	88
PID 2280 wrote to memory of 2156	2280	msedge.exe	88
PID 2280 wrote to memory of 820	2280	msedge.exe	89
PID 2280 wrote to memory of 820	2280	msedge.exe	89
PID 2280 wrote to memory of 820	2280	msedge.exe	89
PID 2280 wrote to memory of 820	2280	msedge.exe	89
PID 2280 wrote to memory of 820	2280	msedge.exe	89
PID 2280 wrote to memory of 820	2280	msedge.exe	89
PID 2280 wrote to memory of 820	2280	msedge.exe	89
PID 2280 wrote to memory of 820	2280	msedge.exe	89
PID 2280 wrote to memory of 820	2280	msedge.exe	89
PID 2280 wrote to memory of 820	2280	msedge.exe	89
PID 2280 wrote to memory of 820	2280	msedge.exe	89
PID 2280 wrote to memory of 820	2280	msedge.exe	89
PID 2280 wrote to memory of 820	2280	msedge.exe	89
PID 2280 wrote to memory of 820	2280	msedge.exe	89
PID 2280 wrote to memory of 820	2280	msedge.exe	89
PID 2280 wrote to memory of 820	2280	msedge.exe	89
PID 2280 wrote to memory of 820	2280	msedge.exe	89
PID 2280 wrote to memory of 820	2280	msedge.exe	89
PID 2280 wrote to memory of 820	2280	msedge.exe	89
PID 2280 wrote to memory of 820	2280	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9667dcf1faced9701572e2bb7e5f73b4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff969c346f8,0x7ff969c34708,0x7ff969c34718
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,10625691086538642056,7038426362647400736,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,10625691086538642056,7038426362647400736,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,10625691086538642056,7038426362647400736,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10625691086538642056,7038426362647400736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10625691086538642056,7038426362647400736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,10625691086538642056,7038426362647400736,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,10625691086538642056,7038426362647400736,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10625691086538642056,7038426362647400736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10625691086538642056,7038426362647400736,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10625691086538642056,7038426362647400736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10625691086538642056,7038426362647400736,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,10625691086538642056,7038426362647400736,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4820 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
576B

MD5
160c2b0851ba0612a367caacdcb76b2a

SHA1
f403e37f60a3d08e20cfb1ab92e9c368ad994db9

SHA256
b769456cf40ca324591f94a661e822543e042a7398e71493c3b1c561155c267b

SHA512
863969a706fc034bdcd911b4bbb7c909762a4fc2e74c6848d87859a35f40ded7ef1b787e5e8c571eee37e48a32fb9da76259cda35765bc4f84baeaa4db5a3c00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ee02b44e7555892749dcb97e9361f9c6

SHA1
e4177fee4d54c61fd6325ed0f85898ee5afcfd49

SHA256
d9538406a709201c6a60675ce4150a30df65948d9ac5959c3dda61ea4a4cfdde

SHA512
789fc138337ba6c3b0b953ce9bf68612667589467bafdc01de1f983972c4b08b6e8c6ec78a2abca512f4a7eb98d52785e64f9cbb92ee721491d523b3d5b0576f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7406749ca23586e05aeb9bad241db114

SHA1
7f95bf7ebaa93d90e19b6f8b52b267eefe56a544

SHA256
8a1dfe99c4ae03d10ee36df8bf09a5c636fde66f96102877e56717b7ff1f9b7d

SHA512
e2d2756d638a9d4460ba80414f8c6eb50fa4ba4bf8808def7dec98b48858818c493792669077e5eb144f1c7c89c0e5d2b1ada9570fd9b7993f06e6f181811550

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9f106397679508927bafbf340f7c07db

SHA1
d044d554c857f75cffcb4a91cceb8228df37f8bf

SHA256
9a0780ae5ab8d4980910327852c2e9d6453df94e197960c875db2c12476e3d89

SHA512
f5bf4b84f9df0accd96b3e3bfeaea7468f297c71bcb87efed1ee6037a1524d96ed587ba88bf6abdfca4f669c40c14ea3da25054c40ed09050a3600dcea414bc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1624e8ddbc990cb5e19237fb42cf185d

SHA1
854fd5121c962807a4edd84235e4413ec8bb7613

SHA256
47452a1d1cdebe21d726a70a80bc046dd9aa47fbaa95fe016978db8cec67b535

SHA512
db11d744066344da8ced0e339e3f4645ed2360b6c84397771489541be3214e3965f4d5d3120345f388a4c034ec9fa36005b5828d2806dd4def15c1d32ce78fec

Download Submit