61eefadf09625caf90052be4a7061707e5583e1efe91186dcfe8bcb3c3cd407c

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 20:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b0af074a16080048028accf2f9a750a9_JaffaCakes118.html
Size

121KB
MD5

b0af074a16080048028accf2f9a750a9
SHA1

f05f3f0f744bcd10743535acccda78a7d44099ac
SHA256

61eefadf09625caf90052be4a7061707e5583e1efe91186dcfe8bcb3c3cd407c
SHA512

40403e4797b5b30a1f411184ccb74206f6e08228ba9938db02571026c3fa6f86c94d46b92e2c5c9531569062633647fa8c779346128d5e5e3f6926df2a06fbb1
SSDEEP

1536:Ue3kTjPGleVW1yi73VGbpuB2d8n7u3RsDRnisr2:qfPGoVgMkMdsCRsDg22

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
2892	msedge.exe
2892	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe
3700	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 4064	2892	msedge.exe	84
PID 2892 wrote to memory of 4064	2892	msedge.exe	84
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 4288	2892	msedge.exe	85
PID 2892 wrote to memory of 1176	2892	msedge.exe	86
PID 2892 wrote to memory of 1176	2892	msedge.exe	86
PID 2892 wrote to memory of 2380	2892	msedge.exe	87
PID 2892 wrote to memory of 2380	2892	msedge.exe	87
PID 2892 wrote to memory of 2380	2892	msedge.exe	87
PID 2892 wrote to memory of 2380	2892	msedge.exe	87
PID 2892 wrote to memory of 2380	2892	msedge.exe	87
PID 2892 wrote to memory of 2380	2892	msedge.exe	87
PID 2892 wrote to memory of 2380	2892	msedge.exe	87
PID 2892 wrote to memory of 2380	2892	msedge.exe	87
PID 2892 wrote to memory of 2380	2892	msedge.exe	87
PID 2892 wrote to memory of 2380	2892	msedge.exe	87
PID 2892 wrote to memory of 2380	2892	msedge.exe	87
PID 2892 wrote to memory of 2380	2892	msedge.exe	87
PID 2892 wrote to memory of 2380	2892	msedge.exe	87
PID 2892 wrote to memory of 2380	2892	msedge.exe	87
PID 2892 wrote to memory of 2380	2892	msedge.exe	87
PID 2892 wrote to memory of 2380	2892	msedge.exe	87
PID 2892 wrote to memory of 2380	2892	msedge.exe	87
PID 2892 wrote to memory of 2380	2892	msedge.exe	87
PID 2892 wrote to memory of 2380	2892	msedge.exe	87
PID 2892 wrote to memory of 2380	2892	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b0af074a16080048028accf2f9a750a9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd77346f8,0x7ffcd7734708,0x7ffcd7734718
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,16427011129788337889,11773430971375731399,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,16427011129788337889,11773430971375731399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,16427011129788337889,11773430971375731399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16427011129788337889,11773430971375731399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16427011129788337889,11773430971375731399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16427011129788337889,11773430971375731399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16427011129788337889,11773430971375731399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,16427011129788337889,11773430971375731399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,16427011129788337889,11773430971375731399,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4ba06c4a8dee1201f7981d6d4c621f29

SHA1
327860142a14245ab23af2416007301de7500b2c

SHA256
827f02c72eff64d7a4018d6f5b4be5d887e62da90e272aba49f9ecf895144d34

SHA512
2db86c1c3a163ebcb68ed5f48e0cb7ad728c182b2c78dea577b53e3731003194b488ff06c3ce50f8ed8b10cefcfe3c6ff4e15b49f2bda02f0586f888b90b9da9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1644afe1fe34a6d17b6daf6b9654aa9f

SHA1
5c5a963d7c19d05e6299032782f3b64ab4c039ab

SHA256
21015af3ed976707139a60460b4b06a3bfef9475eb4a430088738263f4410318

SHA512
128bf27a7b55ea9c84c57bf3e0bbe0b1ec74c1267c1ce6d590da106e94418667b72a43ad04cde15bbb2fd6fe3f451779b4a7e057284fc837a43007e3d1c796bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
314355bd3207928fdb5f868ab0d91f2c

SHA1
1f720abf9037c2dea2d24a48cd15a590b003077a

SHA256
8f8f4f7d0065a93b71b0ded8f4a601fad1b6b46fbf0ad6a7ec35c170c80ffb36

SHA512
1cb9588acce0cf7541f2315baf27b92ee454027ca38fa706de56e03ef2266a9bde612f165ef43ec31f92855fe7e88e5b3bf2232acc918c3537166f95e3631712

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d522f24c-3bc2-463e-a4f3-e462acf97893.tmp

Filesize
10KB

MD5
98f90420bdeb97a15fa457e96cad041c

SHA1
d1d1d71a5d1345abb9af9b81bf64f58516bff0f6

SHA256
ad883b19cded90ee93a87fc65547a8ec77fbdd9209d43cbab1f65ee230302ee6

SHA512
080dc291001131a8389dc21d0ac572c964307e3d425fb8058ee4ae28d93e2e2664fe77ebd812db89fb5e888b250a99aacad644a769795df33ba9ba09cc89686b

Download Submit