f40d05c0661b5a25e4c06a0e1cef5f0fa0db464e136d1711a40a55017d6b639c

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 08:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be3d421b6ac3e34a1ada6a76a45c8758_JaffaCakes118.html
Size

20KB
MD5

be3d421b6ac3e34a1ada6a76a45c8758
SHA1

e8ac7f5ec640382cc5159e90b6e69f6866b13b3b
SHA256

f40d05c0661b5a25e4c06a0e1cef5f0fa0db464e136d1711a40a55017d6b639c
SHA512

0251809e8c3f3f33c865650bd5c47ff12e2aa882a0f6a366f679daa84756bb8c67c6b2d9b0ca18655f4ac8658163664719c3db899fc5c74f6d15fe9b7184155f
SSDEEP

384:CanlVBbjPqoV+zji0Ft0LOzTQTzT+TCTGmvTG8LYqnJTydoBgUjk:nlVBbjik+zxPKPg0GmrGEJTydoCU4

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
884	msedge.exe
884	msedge.exe
5004	msedge.exe
5004	msedge.exe
1256	identity_helper.exe
1256	identity_helper.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 3208	5004	msedge.exe	84
PID 5004 wrote to memory of 3208	5004	msedge.exe	84
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 3572	5004	msedge.exe	85
PID 5004 wrote to memory of 884	5004	msedge.exe	86
PID 5004 wrote to memory of 884	5004	msedge.exe	86
PID 5004 wrote to memory of 3520	5004	msedge.exe	87
PID 5004 wrote to memory of 3520	5004	msedge.exe	87
PID 5004 wrote to memory of 3520	5004	msedge.exe	87
PID 5004 wrote to memory of 3520	5004	msedge.exe	87
PID 5004 wrote to memory of 3520	5004	msedge.exe	87
PID 5004 wrote to memory of 3520	5004	msedge.exe	87
PID 5004 wrote to memory of 3520	5004	msedge.exe	87
PID 5004 wrote to memory of 3520	5004	msedge.exe	87
PID 5004 wrote to memory of 3520	5004	msedge.exe	87
PID 5004 wrote to memory of 3520	5004	msedge.exe	87
PID 5004 wrote to memory of 3520	5004	msedge.exe	87
PID 5004 wrote to memory of 3520	5004	msedge.exe	87
PID 5004 wrote to memory of 3520	5004	msedge.exe	87
PID 5004 wrote to memory of 3520	5004	msedge.exe	87
PID 5004 wrote to memory of 3520	5004	msedge.exe	87
PID 5004 wrote to memory of 3520	5004	msedge.exe	87
PID 5004 wrote to memory of 3520	5004	msedge.exe	87
PID 5004 wrote to memory of 3520	5004	msedge.exe	87
PID 5004 wrote to memory of 3520	5004	msedge.exe	87
PID 5004 wrote to memory of 3520	5004	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\be3d421b6ac3e34a1ada6a76a45c8758_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe899d46f8,0x7ffe899d4708,0x7ffe899d4718
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,17599213769008524806,15954582727308757636,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,17599213769008524806,15954582727308757636,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,17599213769008524806,15954582727308757636,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,17599213769008524806,15954582727308757636,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,17599213769008524806,15954582727308757636,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,17599213769008524806,15954582727308757636,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:576
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,17599213769008524806,15954582727308757636,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,17599213769008524806,15954582727308757636,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,17599213769008524806,15954582727308757636,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,17599213769008524806,15954582727308757636,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,17599213769008524806,15954582727308757636,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,17599213769008524806,15954582727308757636,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2420 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
1237012826a4271d706ff2c80484bbb5

SHA1
cc3b3680cc295649ec9569fe63ba628575fd81bf

SHA256
786cdf44b4241062772309c1c36d779a5d3087b01ca72b615e2cb817b3c04741

SHA512
2a4367e7c102b4dd3e8186d562e8465b642db51a9fa3540217965544d97a2bb1206185e810671206a700f0f34465385456e07789755033fe4f74fc037a9cfbc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
84f004032d4b8659a9f02fa263222e90

SHA1
d32cc8945acf4fa70664369ee99feee6cf35ee67

SHA256
25eafcfa263bf0f6bf82d48e78f9ad6a365433d671a9536916eb9df35742c114

SHA512
7b29db5482a43667edc1b187690c9c11582057f5b40b9ceaf563d54511992cd639aa291342bbb4fc4c22f0801cb7d002f63f3bbc910fbcf0011daae7089bb9c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6c1eab5432c4ca4a36c7259f7d5c671c

SHA1
cfdd7a5aeb4a57ef74d554e163f98c6a64aeafbd

SHA256
d11d0338fde89e21dbc4aeba23e6a2cf20b20dd2392a9a5a7af6eac1f3d9c1f3

SHA512
c6078a06a9784df1e6d243756fc907bbf9d2ffceef8c55cd92bbb4a7df6df3d15cd2484173e1b86de4f0d83dd9de2f1a3d71d6458a8f4738ffdec2951c71357a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7b673af6dff17f9a2855b3818afb5f9d

SHA1
b2848a6307ad311e264f9a7b8f5251e0cdf627e8

SHA256
181c5568a62159bc7983cf2bb53f1da0b7bf920f29753238ee26ec8bee6f64d0

SHA512
2edc8b4dbaf248f8cd3b308fa66aa71a5030198c4f82ba7ce97dca142dc05294a946b77bb83425f916c51c5ec91eb74b3eaa6d2095fb0dacfc6dcd4c77d929ff

Download Submit