ca66a8804f12ab701fc26100e8845c5916f6809461a711d70a4d16430d725114

Analysis

max time kernel
148s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1907dff5093667fe5b79ef8a3ad59ee_JaffaCakes118.html
Size

6KB
MD5

b1907dff5093667fe5b79ef8a3ad59ee
SHA1

92f264d996c1f7839e20079d4707e6933c0d3806
SHA256

ca66a8804f12ab701fc26100e8845c5916f6809461a711d70a4d16430d725114
SHA512

7b25fe90c8c7f9c567cb2009d6bba98c414d24785256bd06d8bc756566433e892f1b8b47a8d148cf5f1dfbcc0883c65ba9a7ef334c95e61f42fc18ff752864d8
SSDEEP

96:uzVs+ux7HQLLY1k9o84d12ef7CSTUeJ/6/NcEZ7ru7f:csz7HQAYS/54Nb76f

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4324	msedge.exe
4324	msedge.exe
4064	msedge.exe
4064	msedge.exe
772	identity_helper.exe
772	identity_helper.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 2656	4064	msedge.exe	84
PID 4064 wrote to memory of 2656	4064	msedge.exe	84
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 3108	4064	msedge.exe	85
PID 4064 wrote to memory of 4324	4064	msedge.exe	86
PID 4064 wrote to memory of 4324	4064	msedge.exe	86
PID 4064 wrote to memory of 1100	4064	msedge.exe	87
PID 4064 wrote to memory of 1100	4064	msedge.exe	87
PID 4064 wrote to memory of 1100	4064	msedge.exe	87
PID 4064 wrote to memory of 1100	4064	msedge.exe	87
PID 4064 wrote to memory of 1100	4064	msedge.exe	87
PID 4064 wrote to memory of 1100	4064	msedge.exe	87
PID 4064 wrote to memory of 1100	4064	msedge.exe	87
PID 4064 wrote to memory of 1100	4064	msedge.exe	87
PID 4064 wrote to memory of 1100	4064	msedge.exe	87
PID 4064 wrote to memory of 1100	4064	msedge.exe	87
PID 4064 wrote to memory of 1100	4064	msedge.exe	87
PID 4064 wrote to memory of 1100	4064	msedge.exe	87
PID 4064 wrote to memory of 1100	4064	msedge.exe	87
PID 4064 wrote to memory of 1100	4064	msedge.exe	87
PID 4064 wrote to memory of 1100	4064	msedge.exe	87
PID 4064 wrote to memory of 1100	4064	msedge.exe	87
PID 4064 wrote to memory of 1100	4064	msedge.exe	87
PID 4064 wrote to memory of 1100	4064	msedge.exe	87
PID 4064 wrote to memory of 1100	4064	msedge.exe	87
PID 4064 wrote to memory of 1100	4064	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b1907dff5093667fe5b79ef8a3ad59ee_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd83a46f8,0x7ffcd83a4708,0x7ffcd83a4718
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,5134158142361519431,11769717150451811544,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,5134158142361519431,11769717150451811544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,5134158142361519431,11769717150451811544,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5134158142361519431,11769717150451811544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5134158142361519431,11769717150451811544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,5134158142361519431,11769717150451811544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,5134158142361519431,11769717150451811544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5134158142361519431,11769717150451811544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5134158142361519431,11769717150451811544,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5134158142361519431,11769717150451811544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5134158142361519431,11769717150451811544,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,5134158142361519431,11769717150451811544,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
920b8ed0bcf0d0ad3d866a2d07a9af51

SHA1
8f27109bf41f328de7a0a02e19bb73684cc4603a

SHA256
a607f87e7ebc1a43bf91b8a489f29d082693ee9236c0d46d0d838e68e84fcbaa

SHA512
30d424835a22f94d6c29448e1f100e03958844fcc1b592fdf2711e36fc694ff2427b6c1251abb2145d96e6fab42703911c45925ceef8479af88d55daf11c6152

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7828874cab6f5861da363aee0bb55d4f

SHA1
cdc23187b8da2492496532b26bd605cf2d849607

SHA256
704017371cfe25e9aa6144641c431b53b0b76de4ac5fbbc2ad0f327e89e1fb73

SHA512
27bdeaa8a582ad5001ab90cc35054303bb96afd3905e8663bd6fec3d4c60779bc832b423177ab39a7815a4342e2aa08d62899b86468fd5ec01b403ce77385489

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
868dc4c747d92c23c0b433f5822a098b

SHA1
7fffb7580458d47747fd1832ce3372b00bdfac8a

SHA256
d3a0fa5bc6802b280231f61f8038930bacffd887c1cc74262fadf417137e7128

SHA512
4eb7c68ee8d1a82dce55f3cc501b1b98f9bebc7561a6ea16732b86c7609f12e70d190b93e2680b42de91c508856ccdd09b412c898d613366e117cdb9d8e761a8

Download Submit