0d8517742cf9edae2f78a0b2a02cc9473a695a2a27b18b1466e94d65f24c2a73

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 05:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bdf5b5a0d08f342049c8fab0a2cae623_JaffaCakes118.html
Size

4KB
MD5

bdf5b5a0d08f342049c8fab0a2cae623
SHA1

6e87856e7a1296f24a4b8cdcf996fdc800cc79f6
SHA256

0d8517742cf9edae2f78a0b2a02cc9473a695a2a27b18b1466e94d65f24c2a73
SHA512

c129e9bdfafe4534254aea694ec5e128bbeae72ca773b67d3abf973789f4c96b37a86ddb6e6bb7d980031819e5b14dd9194c58c1bba4edb710bc9b5b03adf6ca
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8ojPBOXd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDX

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe
2216	msedge.exe
2216	msedge.exe
2612	identity_helper.exe
2612	identity_helper.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 912	2216	msedge.exe	88
PID 2216 wrote to memory of 912	2216	msedge.exe	88
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 456	2216	msedge.exe	89
PID 2216 wrote to memory of 4276	2216	msedge.exe	90
PID 2216 wrote to memory of 4276	2216	msedge.exe	90
PID 2216 wrote to memory of 4460	2216	msedge.exe	91
PID 2216 wrote to memory of 4460	2216	msedge.exe	91
PID 2216 wrote to memory of 4460	2216	msedge.exe	91
PID 2216 wrote to memory of 4460	2216	msedge.exe	91
PID 2216 wrote to memory of 4460	2216	msedge.exe	91
PID 2216 wrote to memory of 4460	2216	msedge.exe	91
PID 2216 wrote to memory of 4460	2216	msedge.exe	91
PID 2216 wrote to memory of 4460	2216	msedge.exe	91
PID 2216 wrote to memory of 4460	2216	msedge.exe	91
PID 2216 wrote to memory of 4460	2216	msedge.exe	91
PID 2216 wrote to memory of 4460	2216	msedge.exe	91
PID 2216 wrote to memory of 4460	2216	msedge.exe	91
PID 2216 wrote to memory of 4460	2216	msedge.exe	91
PID 2216 wrote to memory of 4460	2216	msedge.exe	91
PID 2216 wrote to memory of 4460	2216	msedge.exe	91
PID 2216 wrote to memory of 4460	2216	msedge.exe	91
PID 2216 wrote to memory of 4460	2216	msedge.exe	91
PID 2216 wrote to memory of 4460	2216	msedge.exe	91
PID 2216 wrote to memory of 4460	2216	msedge.exe	91
PID 2216 wrote to memory of 4460	2216	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bdf5b5a0d08f342049c8fab0a2cae623_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfc5946f8,0x7ffcfc594708,0x7ffcfc594718
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13367286906362605807,8747782337768107882,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,13367286906362605807,8747782337768107882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,13367286906362605807,8747782337768107882,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13367286906362605807,8747782337768107882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13367286906362605807,8747782337768107882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,13367286906362605807,8747782337768107882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,13367286906362605807,8747782337768107882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13367286906362605807,8747782337768107882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13367286906362605807,8747782337768107882,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13367286906362605807,8747782337768107882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13367286906362605807,8747782337768107882,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13367286906362605807,8747782337768107882,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3740 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
292B

MD5
eaf4609dd66d8f3dd6f044c3c381a38c

SHA1
af5e03bfd97a01d8c1b2cd3c512e54460e912470

SHA256
e8974d5679d20427eafc2c97891ccad65e972e2103710349e6ae6a02d89d518d

SHA512
c36212e1ce7abf58f3ac440caf499609ee55e018bf641c21375ad52f14739f8356b0030ab778c1f6724fa34e35aa47664a39d2909891d44fb10d0be87b3f1dd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fbcd5e69af344158aa6ea247193a3b04

SHA1
799e66598c734b1ea0f8dd51103004fda1a66789

SHA256
94e94aae91c6632bef296fe57c71ea47992d3d0636053760935fb8ca8b7773ce

SHA512
f0a8774496f858f3f09e9e58f284e8cf01b9b5ca11ce66583af69be5a6474763b630aec4a13026b0ae2e59e7856403e29d300f7a7ccca148c38a3f83123dc87c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0188f4c315316e3f6196a2a5425f0230

SHA1
536bcf5cbd3c00098f0a723cdf81bf47d24f06c4

SHA256
0a57144fef3425de465d2ce625d2a757339fe64a7d51a0734ced1ed9b17c39e5

SHA512
5eb2e49aa463e0d6b85bbd8375d384dbf697633171ab9798857cb635e28e9975ab638f8eb97884e7b4ddf0d82c330bbc9ed25c9e7e46578dafb73e346574cfe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
091f4fef53c37cfe4bd7d7f0cb90f7a4

SHA1
ba5c6a8386dbae8f718fdd6c9bc96c0652d78b9e

SHA256
878f8c810a719b184c7c6ffe15a14a9bc1a94038fe72754e00707baa2d2a4330

SHA512
efc472da8b00f9f6b689f3c505eebdcad75341b975ab570881a15893478913a68f25621016b908cb0ba1ff5e5070b93c355db358aeae3722958315a933e77a24

Download Submit