02c38e103a890af9de8b6d5c2a8636e56bfc318893c505242f2bc7d932c5b667

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 10:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

aa932c5f6c24d738adfb91ab7a207672_JaffaCakes118.html
Size

240KB
MD5

aa932c5f6c24d738adfb91ab7a207672
SHA1

de6a0fd35b7383c9fa8595bfe58f6a8393188895
SHA256

02c38e103a890af9de8b6d5c2a8636e56bfc318893c505242f2bc7d932c5b667
SHA512

c2e5b92bc2322467dfd421253fc2da9e94919ae1f368999b8ab90fb6083d566655ab8b0d7d628a08f967283a86ae3c42ec502fd91a74223b35dc0363179f06dc
SSDEEP

3072:SdKBsBUZQPJussCycSh+hXMCAxkS+NwVcU80taePFftJ0mehR4Epn:SMBZQPJussCyY/AxkiV+vePUD

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4164	msedge.exe
4164	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2320	identity_helper.exe
2320	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 3076	4164	msedge.exe	84
PID 4164 wrote to memory of 3076	4164	msedge.exe	84
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 3912	4164	msedge.exe	85
PID 4164 wrote to memory of 4368	4164	msedge.exe	86
PID 4164 wrote to memory of 4368	4164	msedge.exe	86
PID 4164 wrote to memory of 4480	4164	msedge.exe	87
PID 4164 wrote to memory of 4480	4164	msedge.exe	87
PID 4164 wrote to memory of 4480	4164	msedge.exe	87
PID 4164 wrote to memory of 4480	4164	msedge.exe	87
PID 4164 wrote to memory of 4480	4164	msedge.exe	87
PID 4164 wrote to memory of 4480	4164	msedge.exe	87
PID 4164 wrote to memory of 4480	4164	msedge.exe	87
PID 4164 wrote to memory of 4480	4164	msedge.exe	87
PID 4164 wrote to memory of 4480	4164	msedge.exe	87
PID 4164 wrote to memory of 4480	4164	msedge.exe	87
PID 4164 wrote to memory of 4480	4164	msedge.exe	87
PID 4164 wrote to memory of 4480	4164	msedge.exe	87
PID 4164 wrote to memory of 4480	4164	msedge.exe	87
PID 4164 wrote to memory of 4480	4164	msedge.exe	87
PID 4164 wrote to memory of 4480	4164	msedge.exe	87
PID 4164 wrote to memory of 4480	4164	msedge.exe	87
PID 4164 wrote to memory of 4480	4164	msedge.exe	87
PID 4164 wrote to memory of 4480	4164	msedge.exe	87
PID 4164 wrote to memory of 4480	4164	msedge.exe	87
PID 4164 wrote to memory of 4480	4164	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\aa932c5f6c24d738adfb91ab7a207672_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffeed946f8,0x7fffeed94708,0x7fffeed94718
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,1654365303198067033,15693087878181900166,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,1654365303198067033,15693087878181900166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,1654365303198067033,15693087878181900166,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1654365303198067033,15693087878181900166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1654365303198067033,15693087878181900166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,1654365303198067033,15693087878181900166,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4788 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1654365303198067033,15693087878181900166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,1654365303198067033,15693087878181900166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,1654365303198067033,15693087878181900166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1654365303198067033,15693087878181900166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1654365303198067033,15693087878181900166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1654365303198067033,15693087878181900166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1380 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1654365303198067033,15693087878181900166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:4764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b7e4119b1e731a1de2334a7a7d3384c0

SHA1
18bc21b91f85e70c9fba43e27f59f982e82d6ee1

SHA256
778668b7c54ebc4c2b750571b1edc8e4e62c331ae6acc595df34558e5ab1f2e8

SHA512
012437b084037daf576825252cc058493e8fa58f1173d407d67ef31f209d80f7d1be3f22d42b5f9465eb63895d5f654b0103263e9c3a383d401a0485f98d1887

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
445a652f2de8624bd56150cb9931af92

SHA1
a92bb16b879af2d281e0b9a819b5df01d36942d4

SHA256
63b99b78e72675d07bb69cde6bb78a19c31f123e2ffd005bcd142ca835cab497

SHA512
3bc1f66b64d6375d160b1ed268e737900325f274a95fa51ed898a3449964bc45951271ef9cc7070dc0e6f8d052a8f0c4b2b96c52be5582a1e3557f5f5fe59b5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c7aaace0afea9d1aaa7b0788d272572c

SHA1
0a8d8c5f8324184c1a756bf0e39dad82cbe25fe5

SHA256
401d2c6429d76de2f9882c7b030989021f627de13c2c864ec5f102bd803eed5b

SHA512
7f3f02ed3c0b2a2cd76d188d5a456942ea444820200d26bf8d7996d329481117b86e7820646d969d80be3bc5f92933ae382100259e319c677288d70dc1825769

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d15c092a281c064bd1bc21452f4d3bce

SHA1
74bd3d7f966815a4a54a1bfa992cb0f3d5af1dff

SHA256
833b3af6095acc03b3a043b241166ce85ab93a338fca5e7af5f20bf3b3d42b37

SHA512
3d66e70e423ad04c475ba21abeb455e413e6099afe55369103723c7d6a25d9cd6b4ccfa30256a8da6059282517ea638a8576f2ba8aed5c731fbd4497fefe99c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2dbcd1b2a6728bdafcd120441bdbe033

SHA1
1b44d9fe1b73176b8d1f6416e3f15f00a8e3ed71

SHA256
4a0fd522a63354f9c78bf4eb8c775d1533b4630bcb25763f9a89fd899c72936b

SHA512
8353707e49797926059c4943e82aa72e10ff87b06a61c1db95e28bbafb4af5b6741f8f47408c0afcb9dbb94de44d19c422aab1e919ff19b50bf7235bb6580e06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b90e5ad537f4c779f2cff7203828d894

SHA1
465ea09ab6ab0613b3864513b71e3055452f9194

SHA256
c8f14751cfd5e5d0f435f58a1b12c44a306b9cdf10dd6bd33c0dfa22d2d25fca

SHA512
7002498c645ab9708b86eb17529c25a998a513d760c905daea485141c2e2ce62cf59c6b434ae408dc5a322098118e9cfa5607444b74f9e461565fdef78a4d729

Download Submit