4917b37d2ec6f311db9a569dda5793f5ab355d7d3ad5d2b12f2b3ba17dd9a9d5

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 13:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af6b520ebff24946e4504c29612d2a50_JaffaCakes118.html
Size

20KB
MD5

af6b520ebff24946e4504c29612d2a50
SHA1

d011bf28efbfd1f33669c516b26491a96fc2dbd6
SHA256

4917b37d2ec6f311db9a569dda5793f5ab355d7d3ad5d2b12f2b3ba17dd9a9d5
SHA512

21a9ab21de6cc1bb2e0829a495ca84759574336bdf98387fa12239d5d36f9b62ca2e0aa17530cb7d0e5b4c982361f3561db38c27ec23b4f087fd83ec5e45e4ab
SSDEEP

384:mcGd0k+Icd1ttUKBSIkE0ShF6lRVJJ3nDql6eIF0zGWLK0:mDn+Iq1ttUKBSIkE0SD6lf3Dqlyw

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1916	msedge.exe
1916	msedge.exe
2812	msedge.exe
2812	msedge.exe
2096	identity_helper.exe
2096	identity_helper.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 3572	2812	msedge.exe	84
PID 2812 wrote to memory of 3572	2812	msedge.exe	84
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1700	2812	msedge.exe	85
PID 2812 wrote to memory of 1916	2812	msedge.exe	86
PID 2812 wrote to memory of 1916	2812	msedge.exe	86
PID 2812 wrote to memory of 2304	2812	msedge.exe	87
PID 2812 wrote to memory of 2304	2812	msedge.exe	87
PID 2812 wrote to memory of 2304	2812	msedge.exe	87
PID 2812 wrote to memory of 2304	2812	msedge.exe	87
PID 2812 wrote to memory of 2304	2812	msedge.exe	87
PID 2812 wrote to memory of 2304	2812	msedge.exe	87
PID 2812 wrote to memory of 2304	2812	msedge.exe	87
PID 2812 wrote to memory of 2304	2812	msedge.exe	87
PID 2812 wrote to memory of 2304	2812	msedge.exe	87
PID 2812 wrote to memory of 2304	2812	msedge.exe	87
PID 2812 wrote to memory of 2304	2812	msedge.exe	87
PID 2812 wrote to memory of 2304	2812	msedge.exe	87
PID 2812 wrote to memory of 2304	2812	msedge.exe	87
PID 2812 wrote to memory of 2304	2812	msedge.exe	87
PID 2812 wrote to memory of 2304	2812	msedge.exe	87
PID 2812 wrote to memory of 2304	2812	msedge.exe	87
PID 2812 wrote to memory of 2304	2812	msedge.exe	87
PID 2812 wrote to memory of 2304	2812	msedge.exe	87
PID 2812 wrote to memory of 2304	2812	msedge.exe	87
PID 2812 wrote to memory of 2304	2812	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\af6b520ebff24946e4504c29612d2a50_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1f1946f8,0x7ffa1f194708,0x7ffa1f194718
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,17933550540087008137,6569121478859414111,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,17933550540087008137,6569121478859414111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,17933550540087008137,6569121478859414111,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,17933550540087008137,6569121478859414111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,17933550540087008137,6569121478859414111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,17933550540087008137,6569121478859414111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,17933550540087008137,6569121478859414111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,17933550540087008137,6569121478859414111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,17933550540087008137,6569121478859414111,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,17933550540087008137,6569121478859414111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,17933550540087008137,6569121478859414111,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,17933550540087008137,6569121478859414111,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
250B

MD5
3e271ea6aaf5bb76936158d4745d5d8a

SHA1
7e698d0ef76bef3ab138a6e378d8a00256411293

SHA256
7935ac040caed4d7b1a763616c1bee063fef626b9425bc7652dba1d20f0688bb

SHA512
8bd86b9f5974ff8807f828e1b4fc10d30206e49888f0d6759885db87f7483a56a0456f046aefdd5a55fb6c3729ef0ba28fd910eeb2d1c7d12146d9e4ed4a0993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
962fdc01614d5bc7f37927c272b19fab

SHA1
cb98cf807eae7aab05226c8b7d5a52d302c80c20

SHA256
7657c4555166d4505c369e5c5bd5676c5d0a4526a0683654a39562fa59f3616f

SHA512
0f4b37c51724356c51a164a916a7720791ef2915d630ee7c8dc0074dbe57b014afab02d3e2848cea4a9544f2503406fe500003b35d0711b07fb1208d4c5ac6bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7d88808a53399ebc1a20bd9b158336c7

SHA1
18b9af3929c5a101e9514f1d8b028d572ab2cbac

SHA256
796f89fbc13b54242a1304924460e07c0840a9b7b59831b979aae7b3c8b6478e

SHA512
fa4211f9c832f87cd50bc7e12881d87d932bcab3e25d7679d8d4f464c15db81739027460473c57e67cc2ff0d834ad656cc1ddcddcad5169efdcfab94804a5c9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
336aa18326949c145b1e22fbd3054102

SHA1
d2128e20d20cf30ffb98b78931f2318993ea204f

SHA256
093ee254e96bea78e87cb4a0c8c84453518f1a9dc81d6c5048661d5863640e7a

SHA512
0a95ba51dddefc80bcfb866f15950477fe00009672e11fdc69ee2f948ffbebbbed1e5eb3d2a936b3dae6f6af26616ac425cbcb3dd7ac15ed0fabd134d8625e2b

Download Submit