9b886b50e0d98f22878c59887447f76b4e2c8680051449528142b8c96dc49284

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 13:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3b06c759df1b64b06192978deef52da_JaffaCakes118.html
Size

12KB
MD5

b3b06c759df1b64b06192978deef52da
SHA1

7173d55739b7b9bc4147aed4de4ef854bbdf99d4
SHA256

9b886b50e0d98f22878c59887447f76b4e2c8680051449528142b8c96dc49284
SHA512

865376d5c3bfb84354a448b5182e8a75d595af7f503879662af9972679e47fd322547b26c2830424748e32632801e72700b5db6aa54cb1434a8f55600737b87f
SSDEEP

384:BE4HCmmlNtyCWw18ATTkS/r2A+SwQlz4zWhuj2HgZ:BE4H4lN4w1UfSBLhXHgZ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2292	msedge.exe
2292	msedge.exe
3708	msedge.exe
3708	msedge.exe
1928	identity_helper.exe
1928	identity_helper.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 3672	3708	msedge.exe	84
PID 3708 wrote to memory of 3672	3708	msedge.exe	84
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 4148	3708	msedge.exe	85
PID 3708 wrote to memory of 2292	3708	msedge.exe	86
PID 3708 wrote to memory of 2292	3708	msedge.exe	86
PID 3708 wrote to memory of 912	3708	msedge.exe	87
PID 3708 wrote to memory of 912	3708	msedge.exe	87
PID 3708 wrote to memory of 912	3708	msedge.exe	87
PID 3708 wrote to memory of 912	3708	msedge.exe	87
PID 3708 wrote to memory of 912	3708	msedge.exe	87
PID 3708 wrote to memory of 912	3708	msedge.exe	87
PID 3708 wrote to memory of 912	3708	msedge.exe	87
PID 3708 wrote to memory of 912	3708	msedge.exe	87
PID 3708 wrote to memory of 912	3708	msedge.exe	87
PID 3708 wrote to memory of 912	3708	msedge.exe	87
PID 3708 wrote to memory of 912	3708	msedge.exe	87
PID 3708 wrote to memory of 912	3708	msedge.exe	87
PID 3708 wrote to memory of 912	3708	msedge.exe	87
PID 3708 wrote to memory of 912	3708	msedge.exe	87
PID 3708 wrote to memory of 912	3708	msedge.exe	87
PID 3708 wrote to memory of 912	3708	msedge.exe	87
PID 3708 wrote to memory of 912	3708	msedge.exe	87
PID 3708 wrote to memory of 912	3708	msedge.exe	87
PID 3708 wrote to memory of 912	3708	msedge.exe	87
PID 3708 wrote to memory of 912	3708	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b3b06c759df1b64b06192978deef52da_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7fff80e346f8,0x7fff80e34708,0x7fff80e34718
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,3335760811938117932,8619518150731596609,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,3335760811938117932,8619518150731596609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,3335760811938117932,8619518150731596609,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3335760811938117932,8619518150731596609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3335760811938117932,8619518150731596609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3335760811938117932,8619518150731596609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3335760811938117932,8619518150731596609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3335760811938117932,8619518150731596609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3335760811938117932,8619518150731596609,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,3335760811938117932,8619518150731596609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,3335760811938117932,8619518150731596609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3335760811938117932,8619518150731596609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3335760811938117932,8619518150731596609,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,3335760811938117932,8619518150731596609,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3000 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
5f3b1204ea7cdf63e3791f29a7a49b4b

SHA1
c6dce02de8420bfb3d804c579c58fb93cfa2857b

SHA256
4484fe0ea41a50a1c8422f2f42e69ec06f7adffc7bb137e7381eeb09713b8e26

SHA512
7d5352ea3157191615af121b49f37e9e42353a0ed3396cb4d9043433f9a08e3a0b3c1ee3f678e9ede9900ff302a060df9b772e47272525ee83d8e781a51f6311

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a159faa0197b8f561cf6b8587829c705

SHA1
d4b9f2791cd947e5ebfa2ed01748830b7468f39b

SHA256
1bc00c2fec157609821b0f0f20d3d199e042e2f4bc5ed4fa4db0191c3e526dd1

SHA512
c7f019f08538c2151b3ac503f6aeb5541188d0b3a193eb42de12214bc54826d79d62237ba32b87ec572476c2dd6a8b14f2f976d1e648f901476514b2b890b602

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4c0543a5b886f6b59905b4fd7e77666f

SHA1
b2934ff52b6790078cd60d87c2fc2f37d060adb2

SHA256
a8993bc15fed931ba2efced917f6a0a6083e5aa53f6a9ff90c9d6400a738b64d

SHA512
81c5f5e621c74ec2e637c32f7cb55121b5d547ba8b19e40a24549f45e7f3ccf73b1b18c1a0055b2ddf0af8c99ade45417bec88933dcb4456caad8b7f0f92833f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8a6b7412af0f568cd31f09b8c20f19e6

SHA1
4ec79fa1ea52b0625e607a69e3664d775cf31937

SHA256
f19b7d28ef6d5a68f4f92b23fe46ad740f6587f948bd58eeef08479c03c909e9

SHA512
6458e08a02a5bb89af8058a9d0a0eb3e69e636c5287f66e1dd36f6a75a3059c80bd23061c2ba1720603b9c91ecb280e4f2d88bba4533f263e57e471fe0dcd1f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3a64690e935b9bad5e2b7862f841aadf

SHA1
36e9003de115c362fc6cade52a19898574d1470d

SHA256
33a432b84f00b55d3a0cda88dcd5cc82e49ea30fac098df3f7855a76e061a4c8

SHA512
d1ffa8f45008d6d297ba31401c4e949c23ef2a948cef12bb154c8ce5b0905948d97ac2c73b3efc7a3fcd1cd05c2d97211d32503c209f44550bae2f4bdee4a789

Download Submit