25a5070045911f5fc5ec80b44cd8e9d057d6029bab185f4d3bfc63e3d4d4e6cc

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-08-2024 23:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf9dd3120c457ab6699d3994a9bdfa3b_JaffaCakes118.html
Size

461KB
MD5

bf9dd3120c457ab6699d3994a9bdfa3b
SHA1

e99b98a98c2075b4859d296cae8058c53c186ee6
SHA256

25a5070045911f5fc5ec80b44cd8e9d057d6029bab185f4d3bfc63e3d4d4e6cc
SHA512

b6fb98bbc7275c5ebc276728bfd0e2bae7a4e226a4277d5443550f43726d8946aa789d818da5ca4b962c1f77a7f045783887d3bb6ef085b055356143e7a34e36
SSDEEP

6144:SxsMYod+X3oI+YLQAQ/sMYod+X3oI+Y1sMYod+X3oI+YLsMYod+X3oI+YQ:65d+X385d+X3v5d+X315d+X3+

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3080	msedge.exe
3080	msedge.exe
2684	msedge.exe
2684	msedge.exe
4172	identity_helper.exe
4172	identity_helper.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2956	2684	msedge.exe	84
PID 2684 wrote to memory of 2956	2684	msedge.exe	84
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 1816	2684	msedge.exe	85
PID 2684 wrote to memory of 3080	2684	msedge.exe	86
PID 2684 wrote to memory of 3080	2684	msedge.exe	86
PID 2684 wrote to memory of 3820	2684	msedge.exe	87
PID 2684 wrote to memory of 3820	2684	msedge.exe	87
PID 2684 wrote to memory of 3820	2684	msedge.exe	87
PID 2684 wrote to memory of 3820	2684	msedge.exe	87
PID 2684 wrote to memory of 3820	2684	msedge.exe	87
PID 2684 wrote to memory of 3820	2684	msedge.exe	87
PID 2684 wrote to memory of 3820	2684	msedge.exe	87
PID 2684 wrote to memory of 3820	2684	msedge.exe	87
PID 2684 wrote to memory of 3820	2684	msedge.exe	87
PID 2684 wrote to memory of 3820	2684	msedge.exe	87
PID 2684 wrote to memory of 3820	2684	msedge.exe	87
PID 2684 wrote to memory of 3820	2684	msedge.exe	87
PID 2684 wrote to memory of 3820	2684	msedge.exe	87
PID 2684 wrote to memory of 3820	2684	msedge.exe	87
PID 2684 wrote to memory of 3820	2684	msedge.exe	87
PID 2684 wrote to memory of 3820	2684	msedge.exe	87
PID 2684 wrote to memory of 3820	2684	msedge.exe	87
PID 2684 wrote to memory of 3820	2684	msedge.exe	87
PID 2684 wrote to memory of 3820	2684	msedge.exe	87
PID 2684 wrote to memory of 3820	2684	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bf9dd3120c457ab6699d3994a9bdfa3b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbe2f46f8,0x7ffdbe2f4708,0x7ffdbe2f4718
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,16339288531815991586,8448484520535320344,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,16339288531815991586,8448484520535320344,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,16339288531815991586,8448484520535320344,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16339288531815991586,8448484520535320344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16339288531815991586,8448484520535320344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,16339288531815991586,8448484520535320344,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,16339288531815991586,8448484520535320344,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16339288531815991586,8448484520535320344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16339288531815991586,8448484520535320344,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16339288531815991586,8448484520535320344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16339288531815991586,8448484520535320344,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,16339288531815991586,8448484520535320344,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4884 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d9c7e8915dff77a04712729295c93194

SHA1
2d35d8a886ba2e95fbd83f8cb77bd52a1d1756e5

SHA256
9f537be5137a74861e387443a28af75869ad6252ddec18a22defcde5e396072b

SHA512
83940fb71058d398a70ae19aa0eb3f3f0311e38cb6a526642a9bd4f0a0418d3a0598ab085276c6fc2e15d84d2e260bd5be6991a09c527c94a2332b6126e24610

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
81d8579ee35fbc1c25bd59202455b3b2

SHA1
1ed6a181db7a9b772febcaac75f70b4716f8852c

SHA256
f092f92920fa05d734681b02ec55a34b63234ef3649cbe0a29ef729bdd3cff2a

SHA512
e9c9177a823a2702af95264c4f6f8716cc0cd2ffa247522f3bb14c3545c6599eeca707a6f63069304bc9a3435bea0d713fb6e3167153df3759d01ba428a297f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
669bf204dcc7542f7a986833d366a631

SHA1
402b0a97b1deaa90e01f6f2f5cbacda1e704dfbc

SHA256
afbfa538a16ce1e6b14e144a8caa122eb832fc5f7a8aadaf0d89cc384c1ba818

SHA512
188ffa2ce3e2ef8a0562c3fc4f4515223fffce8d09b810a60161f147fedeca1655413812d854d3f8cfd8ac24daf47619ecb9b3d3eb268776ba999e479e12bdaa

Download Submit