8045594132eaa3dcfb34eca1a86712e8f003ce7a14d8233f53c2ed3796043369

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 16:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afe7f060461353edd7bc30059a76f6ce_JaffaCakes118.html
Size

42KB
MD5

afe7f060461353edd7bc30059a76f6ce
SHA1

5cf82728310438a410d4febffd3067462683e4da
SHA256

8045594132eaa3dcfb34eca1a86712e8f003ce7a14d8233f53c2ed3796043369
SHA512

12ae732a474b0c23e6b9f3bb1ec053a0df13f582da996034071804780e6af0bf8c0c84cfc587728d18d164297c7d1def47fadfe4961566c7caf37033c9ca881f
SSDEEP

192:uwPTb5nIjW9nQjxn5Q/GnQielNnanQOkEntOsnQTbnhnQmSRx5GiauMPQPQ/zRPe:OQ/9WxQizw80ikEbGNjkPM1gtiuc8Dp

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2104	msedge.exe
2104	msedge.exe
3596	msedge.exe
3596	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3596 wrote to memory of 3504	3596	msedge.exe	84
PID 3596 wrote to memory of 3504	3596	msedge.exe	84
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 3760	3596	msedge.exe	85
PID 3596 wrote to memory of 2104	3596	msedge.exe	86
PID 3596 wrote to memory of 2104	3596	msedge.exe	86
PID 3596 wrote to memory of 836	3596	msedge.exe	87
PID 3596 wrote to memory of 836	3596	msedge.exe	87
PID 3596 wrote to memory of 836	3596	msedge.exe	87
PID 3596 wrote to memory of 836	3596	msedge.exe	87
PID 3596 wrote to memory of 836	3596	msedge.exe	87
PID 3596 wrote to memory of 836	3596	msedge.exe	87
PID 3596 wrote to memory of 836	3596	msedge.exe	87
PID 3596 wrote to memory of 836	3596	msedge.exe	87
PID 3596 wrote to memory of 836	3596	msedge.exe	87
PID 3596 wrote to memory of 836	3596	msedge.exe	87
PID 3596 wrote to memory of 836	3596	msedge.exe	87
PID 3596 wrote to memory of 836	3596	msedge.exe	87
PID 3596 wrote to memory of 836	3596	msedge.exe	87
PID 3596 wrote to memory of 836	3596	msedge.exe	87
PID 3596 wrote to memory of 836	3596	msedge.exe	87
PID 3596 wrote to memory of 836	3596	msedge.exe	87
PID 3596 wrote to memory of 836	3596	msedge.exe	87
PID 3596 wrote to memory of 836	3596	msedge.exe	87
PID 3596 wrote to memory of 836	3596	msedge.exe	87
PID 3596 wrote to memory of 836	3596	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\afe7f060461353edd7bc30059a76f6ce_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8d7d46f8,0x7ffd8d7d4708,0x7ffd8d7d4718
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,3753155998889103032,15693064724375818958,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,3753155998889103032,15693064724375818958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,3753155998889103032,15693064724375818958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3753155998889103032,15693064724375818958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3753155998889103032,15693064724375818958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,3753155998889103032,15693064724375818958,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3008 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,3753155998889103032,15693064724375818958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3024 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,3753155998889103032,15693064724375818958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3024 /prefetch:8
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3753155998889103032,15693064724375818958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3753155998889103032,15693064724375818958,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:4504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\15b162d7-7225-4b98-bfb1-f3681285ff88.tmp

Filesize
6KB

MD5
212579afbb72669e5857aacc925331a4

SHA1
9916f00bfbf936c83b9405c8fb5c9901a2ab63a4

SHA256
75114527eaee1b84146ca396aa91da4f2d9a3d7e2731a644fdb62035bd22964d

SHA512
1e39cb6461e34286ba0fecabbeeb957d0007a02b1070d35b52dd9e1dc62d58b52c4fe0d6f1f7722a2035a6f0775b8a7cd1e76be00912f09dd284ab341c5a041f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c7a62cf7dbf4c7c3b57b2c4f593b227b

SHA1
1ffd957c2b0a45b1b02e3e39a3a964e396383adb

SHA256
138e78637e44f3741e3d36d989479e85cf8df47b775f7cda959c9a6117aa4e89

SHA512
14c98471c72b9622fc322a4a49b33a73aa3e28acf665bedcae753f1ffc1db3e9c8a476af6bb84e51121ebca311f6323ab6b10213f2538858f7f924a82a59db03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c5b878d703e8c4859cf79ad0173ca1fb

SHA1
8510f0140fc7e1cc836fdbd7f6d70e2c33f99fe6

SHA256
dd1bd3670cb8d44d23d001aa3d07041e8aa53626ddc2c0105a07105a6568f7c3

SHA512
3a6a314a517a225bc05d3f093bc60cf40c09c15f21b3443527b58c71f3f7f53cb790892856145233639692b9290f9f5a9b78cdc6ebc956b23adfdab443aa7fa3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
38a375b01b6bbd7ad3fa7b7b313447dc

SHA1
74f7568af99dae99ac5882d936072424a4661957

SHA256
da467072bf30b5db19079b2f2d920935181687bed33bdf754eee504228f976fd

SHA512
3a33de6fcb8b4df3040b0e99ce5f5ed6c5f2c47430facba3062f93dda798a6a04660626ca08522fa21bee7019732f1473cd1f35dd06c23bfd98d822d4ab76839

Download Submit