ad643cbe8736ec36c1057799be0d2cad59383dbf484ca1dc2f00c4439a5c282f

Analysis

max time kernel
145s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 11:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be8992467d2e9c2ca2c0af7b6381f919_JaffaCakes118.html
Size

461KB
MD5

be8992467d2e9c2ca2c0af7b6381f919
SHA1

2e657c3d4f9ce675c1ee4ba97c9df2db8a64d4bc
SHA256

ad643cbe8736ec36c1057799be0d2cad59383dbf484ca1dc2f00c4439a5c282f
SHA512

e30e0a7076f4ac85b2397b71c54d2e8cf595c8f83c01a2f60ac44e6a85f36fa6d6fbc0eee5d9384ff402abf7a2075532fe16c784f3bcc0c1b5d186e41d85226b
SSDEEP

6144:SSsMYod+X3oI+YWsMYod+X3oI+YJOsMYod+X3oI+YLsMYod+X3oI+YQ:t5d+X365d+X305d+X315d+X3+

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3304	msedge.exe
3304	msedge.exe
4236	msedge.exe
4236	msedge.exe
4184	identity_helper.exe
4184	identity_helper.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 3364	4236	msedge.exe	84
PID 4236 wrote to memory of 3364	4236	msedge.exe	84
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 2712	4236	msedge.exe	85
PID 4236 wrote to memory of 3304	4236	msedge.exe	86
PID 4236 wrote to memory of 3304	4236	msedge.exe	86
PID 4236 wrote to memory of 1228	4236	msedge.exe	87
PID 4236 wrote to memory of 1228	4236	msedge.exe	87
PID 4236 wrote to memory of 1228	4236	msedge.exe	87
PID 4236 wrote to memory of 1228	4236	msedge.exe	87
PID 4236 wrote to memory of 1228	4236	msedge.exe	87
PID 4236 wrote to memory of 1228	4236	msedge.exe	87
PID 4236 wrote to memory of 1228	4236	msedge.exe	87
PID 4236 wrote to memory of 1228	4236	msedge.exe	87
PID 4236 wrote to memory of 1228	4236	msedge.exe	87
PID 4236 wrote to memory of 1228	4236	msedge.exe	87
PID 4236 wrote to memory of 1228	4236	msedge.exe	87
PID 4236 wrote to memory of 1228	4236	msedge.exe	87
PID 4236 wrote to memory of 1228	4236	msedge.exe	87
PID 4236 wrote to memory of 1228	4236	msedge.exe	87
PID 4236 wrote to memory of 1228	4236	msedge.exe	87
PID 4236 wrote to memory of 1228	4236	msedge.exe	87
PID 4236 wrote to memory of 1228	4236	msedge.exe	87
PID 4236 wrote to memory of 1228	4236	msedge.exe	87
PID 4236 wrote to memory of 1228	4236	msedge.exe	87
PID 4236 wrote to memory of 1228	4236	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\be8992467d2e9c2ca2c0af7b6381f919_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb57d46f8,0x7ffcb57d4708,0x7ffcb57d4718
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,11812316286044378822,13421506538734465517,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,11812316286044378822,13421506538734465517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,11812316286044378822,13421506538734465517,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11812316286044378822,13421506538734465517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11812316286044378822,13421506538734465517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,11812316286044378822,13421506538734465517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,11812316286044378822,13421506538734465517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11812316286044378822,13421506538734465517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11812316286044378822,13421506538734465517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11812316286044378822,13421506538734465517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11812316286044378822,13421506538734465517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,11812316286044378822,13421506538734465517,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4056 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
52d8801711389b5cb95234e87f9226ea

SHA1
fd17a68250a61537c3d9b0a011b2be4acff6308c

SHA256
1bcacf14988114b46b8e1ee813b6ec541734a8752600da8530c4ea26c9e013ce

SHA512
6075ae600cafdd2ce092be45b5b94dd968501e8d553b38a1c16355f54ae467baba03ff5de07d54139e745a7edb3ad2c28895ba73104090da54e124d906436c7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5cb76a48db65c58172310ee35b21e89b

SHA1
ef5d6ffa57d372497f95a82510a54b7858b1af51

SHA256
71119bafeacbaf337b125f55fe5e8b390a386eb76521ac7d80c4b55d7701cff1

SHA512
5652444d137f874987554d71b32756f422a6215bcdacbfd4d49d2c0dc28e80c7ea618cf8c6f98741590e6e5ad822f29934f11eb6d1fa01417f3902b62d391fde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a643ab351737ff88659bd73a76bca54c

SHA1
b7a94e3e56ef1273b602df26b9abf77e6da82832

SHA256
1e84afef05c7cfef1ab01ff4bd0a22717666cc7ac2f6c434b637ba2a61459001

SHA512
943f3b90b164e108ce91f2bd9e1ed2770c246f7bd980b5bbd1e7ee110d181bf30ee10ede28923c1e78cb114a74521f48c11e2e4fd16052dacf82961e2e76d045

Download Submit