50fb21f5dbf0c58608b18bf399b7f2abae54f9c5fe13221234d9c0a9d3cabda6

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 19:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4af61ec34f9611a8cd68f76b6fe385b_JaffaCakes118.html
Size

122KB
MD5

b4af61ec34f9611a8cd68f76b6fe385b
SHA1

e577f5f237076187a72acfa0b627dbbb0a9f85a0
SHA256

50fb21f5dbf0c58608b18bf399b7f2abae54f9c5fe13221234d9c0a9d3cabda6
SHA512

dd210400ca82af346a04e828025a679808ee911b4a234d764b874406d29ddf9aa3b447f8e792c87d102cac8a912079b7b22eaec2792b26634ff896832b91dc89
SSDEEP

1536:WJDMiM0J1jpXvgOcMHDMNKouF1072s6sYN:uM/0JfDHT47kN

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
872	msedge.exe
872	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 596	872	msedge.exe	84
PID 872 wrote to memory of 596	872	msedge.exe	84
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 2720	872	msedge.exe	85
PID 872 wrote to memory of 4968	872	msedge.exe	86
PID 872 wrote to memory of 4968	872	msedge.exe	86
PID 872 wrote to memory of 2104	872	msedge.exe	87
PID 872 wrote to memory of 2104	872	msedge.exe	87
PID 872 wrote to memory of 2104	872	msedge.exe	87
PID 872 wrote to memory of 2104	872	msedge.exe	87
PID 872 wrote to memory of 2104	872	msedge.exe	87
PID 872 wrote to memory of 2104	872	msedge.exe	87
PID 872 wrote to memory of 2104	872	msedge.exe	87
PID 872 wrote to memory of 2104	872	msedge.exe	87
PID 872 wrote to memory of 2104	872	msedge.exe	87
PID 872 wrote to memory of 2104	872	msedge.exe	87
PID 872 wrote to memory of 2104	872	msedge.exe	87
PID 872 wrote to memory of 2104	872	msedge.exe	87
PID 872 wrote to memory of 2104	872	msedge.exe	87
PID 872 wrote to memory of 2104	872	msedge.exe	87
PID 872 wrote to memory of 2104	872	msedge.exe	87
PID 872 wrote to memory of 2104	872	msedge.exe	87
PID 872 wrote to memory of 2104	872	msedge.exe	87
PID 872 wrote to memory of 2104	872	msedge.exe	87
PID 872 wrote to memory of 2104	872	msedge.exe	87
PID 872 wrote to memory of 2104	872	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b4af61ec34f9611a8cd68f76b6fe385b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa08db46f8,0x7ffa08db4708,0x7ffa08db4718
  2⤵
  PID:596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,5705591750333682127,14042383923860561296,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,5705591750333682127,14042383923860561296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,5705591750333682127,14042383923860561296,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5705591750333682127,14042383923860561296,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5705591750333682127,14042383923860561296,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5705591750333682127,14042383923860561296,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5705591750333682127,14042383923860561296,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5705591750333682127,14042383923860561296,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,5705591750333682127,14042383923860561296,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9f82c9b7d8e1e5bc99098dfe27aea66e

SHA1
4f1c23b42d30134d2bbda1e62acf002882975b24

SHA256
1d5f87d6f8acba0d47335035c04e062073a15cc9111890739fe7b3cb6de7d90c

SHA512
45415d20ab782dcefddb52a804889be1a72e413a9844c8fe8a2d5d58c94fb024b290f5ce45e98d4442e780ce40bd039e0aa60a9c56787718c7fde49696d3da0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5c4c6638a361d37bf0775218901ef535

SHA1
6f09a1b6ab7225ee587d4084b418687b9d3c0403

SHA256
df688c731722604d961e11676556b88806abb4d9ce7d25b57f7b9168eecbfff8

SHA512
0c82c7f08b998e7785681354e28597008974208703e2379299848ed864dad60df2ac3401dddc46f267c4794c870e08e015942455806a3cf53ed2af011bb22865

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
771d94a0a09a962417883222910edbc4

SHA1
42708ce9c1b8f83c5dcd8086e8a579e58e9cfb06

SHA256
5d1dc46c9e3a250bf45c7c258a212170928d143160bd85a271f916902b17ccfd

SHA512
19d3ef035420fb4d53af9ab0fddf3a1a75fd4d553e73d459083a85e588362b271ef04b02b3482a50b6de39c8354bf524a48693f70c236d2c63b601ff9961f041

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5c27198ae948eb39e494489c8935b4f9

SHA1
4bc2875571a630b67d178097974fad94f0b6de9b

SHA256
5b5f0bfe4d211a111298a87b90f1afe71c97b0875b6b8da397552f5536720515

SHA512
38fbbab88cabcb53d93698b4ff5b1303824ca610adadb8ba521bb45e9a04f9bc37286c9851a3865f86b05bb125f5d9974cf038bcc2990b1b6c946d7f24d5e1ac

Download Submit