7584b191874fbb2f630132b6b99bf4bdb7cc41100482d6c7a72181dd11ec23ce

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b3db7672d2080a6f90d253f56ba4876b_JaffaCakes118.html
Size

9KB
MD5

b3db7672d2080a6f90d253f56ba4876b
SHA1

5c49110d25364bd98770d7d43f9f9880f4bb5258
SHA256

7584b191874fbb2f630132b6b99bf4bdb7cc41100482d6c7a72181dd11ec23ce
SHA512

eb9cbfadfb15c0a810e295ebb93dcf62e9514522d3b9b94750ab97eb864ad6edc7e23259fbbf1058dd638383c5156c7e84cc8353252ef26daea4f279f41957d7
SSDEEP

192:ttj8I/Fq7/YHNhZyQT4VquitbDiZxSnEuRmJ/DDFJ9qmePquzpxy:f5ZSunEuqPFJ93ePquq

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1764	msedge.exe
1764	msedge.exe
4528	msedge.exe
4528	msedge.exe
1776	identity_helper.exe
1776	identity_helper.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe
5640	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 1524	4528	msedge.exe	84
PID 4528 wrote to memory of 1524	4528	msedge.exe	84
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 5000	4528	msedge.exe	87
PID 4528 wrote to memory of 1764	4528	msedge.exe	88
PID 4528 wrote to memory of 1764	4528	msedge.exe	88
PID 4528 wrote to memory of 3920	4528	msedge.exe	89
PID 4528 wrote to memory of 3920	4528	msedge.exe	89
PID 4528 wrote to memory of 3920	4528	msedge.exe	89
PID 4528 wrote to memory of 3920	4528	msedge.exe	89
PID 4528 wrote to memory of 3920	4528	msedge.exe	89
PID 4528 wrote to memory of 3920	4528	msedge.exe	89
PID 4528 wrote to memory of 3920	4528	msedge.exe	89
PID 4528 wrote to memory of 3920	4528	msedge.exe	89
PID 4528 wrote to memory of 3920	4528	msedge.exe	89
PID 4528 wrote to memory of 3920	4528	msedge.exe	89
PID 4528 wrote to memory of 3920	4528	msedge.exe	89
PID 4528 wrote to memory of 3920	4528	msedge.exe	89
PID 4528 wrote to memory of 3920	4528	msedge.exe	89
PID 4528 wrote to memory of 3920	4528	msedge.exe	89
PID 4528 wrote to memory of 3920	4528	msedge.exe	89
PID 4528 wrote to memory of 3920	4528	msedge.exe	89
PID 4528 wrote to memory of 3920	4528	msedge.exe	89
PID 4528 wrote to memory of 3920	4528	msedge.exe	89
PID 4528 wrote to memory of 3920	4528	msedge.exe	89
PID 4528 wrote to memory of 3920	4528	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b3db7672d2080a6f90d253f56ba4876b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffee3946f8,0x7fffee394708,0x7fffee394718
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,15256655945119658086,1423181057096251657,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,15256655945119658086,1423181057096251657,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,15256655945119658086,1423181057096251657,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15256655945119658086,1423181057096251657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15256655945119658086,1423181057096251657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15256655945119658086,1423181057096251657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,15256655945119658086,1423181057096251657,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,15256655945119658086,1423181057096251657,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15256655945119658086,1423181057096251657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15256655945119658086,1423181057096251657,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15256655945119658086,1423181057096251657,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15256655945119658086,1423181057096251657,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,15256655945119658086,1423181057096251657,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2672 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
732bc74644a47906dccab3cfc017e217

SHA1
a3da16a7a5f0beff1879cdcc632fc668f2b47ed1

SHA256
3e4174697b88fde0d966a03ad7fc7bf366f95978308c19d216ef668daa4fcffa

SHA512
470c54d10aa8bcc4922a782746dfbd34058aeac18b9871f1cd98afc39914e489166f7ecfbe55eb590fac744ee35e119484afbbf7d69f0a264b7e04c134869cd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
185B

MD5
efa3b79297b792ddfa72609e2389407a

SHA1
7c959b0d9c508607119d7c112fe81939169c8ccb

SHA256
04371cb7276a5868761433e311d805f97da580075fc9bf1a66f0a9d8ac9a4017

SHA512
1f08b7ea9823ae979382586db83b05c0d0dc5cb565b3946fb8134c0dfaaf61fdf80d6c666ceca6522964ac446d2a2e798e1f0eaff3dd2ab5cae88a793db20eaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
48edad78a9caad80479c62470f1129db

SHA1
5ee79265c8d2b42a208ee1c87f5795df68561de5

SHA256
518195c05d9375c1ccb6c50133b5ae09cfb12ce1caae1e5b0b2c20828b6bd442

SHA512
ddbdbc158e8a64295b2f85ff5b01b975abcd102b84c5d9b31fb54275a7172cfa2d7b2c65fbafc8357c9785d2c0c67436a64458df6d80e9c66193b90cfe070360

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
43b8aef8112b7dcd39c3321a8d54f71a

SHA1
f0b06bcfaab715a18881dddff678b03cc8a46e6f

SHA256
ef36d5a801b84d5bef2c031ae24ddf1c80ae1474ee151c21e14b035cadfd9289

SHA512
53cf811f8c1458b8d3856cc9661694f9eb72044fb87b0adeccf1c498fbd171f81e5d041108e0aaeb661ce087528cd4bbea6d3316f582b589bfc3c46d85a93674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3329bb764ebc00d87b097f16aa0f0ad2

SHA1
315ac11ec8684464186479285e5df3b683b4de78

SHA256
1b81594d4d7a611cc1fba8cf211c722473f52ff62b0f58d2835789be0a7760ee

SHA512
e1d93a1a7428ef7b0741e46e765f135358cf21b4a01252d4cb312853ebc4b2ae149756e8a16da1fb47bb1aedead05aed0a4ec79311752255c10f8cc5eaf93662

Download Submit