5fde74dc9230a2c46a368bd9f1ec2b9d47431cad4c76e111a6fc6256c5fa668d

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bfd5f084854ebecaf51a86177c2cbafd_JaffaCakes118.html
Size

130KB
MD5

bfd5f084854ebecaf51a86177c2cbafd
SHA1

6086035822be197a7c7657bd3291a3c2fd8cbdb6
SHA256

5fde74dc9230a2c46a368bd9f1ec2b9d47431cad4c76e111a6fc6256c5fa668d
SHA512

c94740abcfa6038ad0a340bba6ffd916bbde7485c2d8fefde30d5fc00244309b5303c9d5250569d580443aa05e62d571dab969d47934a9edee877d45d4f5c052
SSDEEP

1536:SKzJLI1yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9w:SGI1yfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4308	msedge.exe
4308	msedge.exe
3152	msedge.exe
3152	msedge.exe
516	identity_helper.exe
516	identity_helper.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 520	3152	msedge.exe	84
PID 3152 wrote to memory of 520	3152	msedge.exe	84
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4104	3152	msedge.exe	85
PID 3152 wrote to memory of 4308	3152	msedge.exe	86
PID 3152 wrote to memory of 4308	3152	msedge.exe	86
PID 3152 wrote to memory of 1780	3152	msedge.exe	87
PID 3152 wrote to memory of 1780	3152	msedge.exe	87
PID 3152 wrote to memory of 1780	3152	msedge.exe	87
PID 3152 wrote to memory of 1780	3152	msedge.exe	87
PID 3152 wrote to memory of 1780	3152	msedge.exe	87
PID 3152 wrote to memory of 1780	3152	msedge.exe	87
PID 3152 wrote to memory of 1780	3152	msedge.exe	87
PID 3152 wrote to memory of 1780	3152	msedge.exe	87
PID 3152 wrote to memory of 1780	3152	msedge.exe	87
PID 3152 wrote to memory of 1780	3152	msedge.exe	87
PID 3152 wrote to memory of 1780	3152	msedge.exe	87
PID 3152 wrote to memory of 1780	3152	msedge.exe	87
PID 3152 wrote to memory of 1780	3152	msedge.exe	87
PID 3152 wrote to memory of 1780	3152	msedge.exe	87
PID 3152 wrote to memory of 1780	3152	msedge.exe	87
PID 3152 wrote to memory of 1780	3152	msedge.exe	87
PID 3152 wrote to memory of 1780	3152	msedge.exe	87
PID 3152 wrote to memory of 1780	3152	msedge.exe	87
PID 3152 wrote to memory of 1780	3152	msedge.exe	87
PID 3152 wrote to memory of 1780	3152	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bfd5f084854ebecaf51a86177c2cbafd_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa50b46f8,0x7fffa50b4708,0x7fffa50b4718
  2⤵
  PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,2733624521887983585,7223034626850060970,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,2733624521887983585,7223034626850060970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,2733624521887983585,7223034626850060970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2733624521887983585,7223034626850060970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2733624521887983585,7223034626850060970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,2733624521887983585,7223034626850060970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,2733624521887983585,7223034626850060970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2733624521887983585,7223034626850060970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2733624521887983585,7223034626850060970,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2733624521887983585,7223034626850060970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2733624521887983585,7223034626850060970,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,2733624521887983585,7223034626850060970,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
78ac0927f1f11af8ba59966c59ebd817

SHA1
c625b921ac8e180cf253f727857442f517e7235c

SHA256
77c6cb7172ae08a1b63d5f17732720b6224a804d5fc519bba2bba135b8721262

SHA512
1f9556cf67df520dbfb27d039af2bc79041cbc9655f3be8ff8fc2506bb78a855b47ae99a5d12143afa50adb914c50891a6bc41ae33d8947e66051fa13b3dd0a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ef424c4fafd0e52a9963779024965672

SHA1
ad2b6123b210d73a4f5c019da337d32dabf4fbfe

SHA256
f74c7167b43138d40bc985f61efe59f38232b162fad57c844119f1e13f2cb5e5

SHA512
b2063e6ffd71ca50df2a96507fa9d4619943ce4f8858b910b4d2cd39744d99e04c8f86d62847fd1d6104db5663a11c94d24a357ab0aee7a7378c2555db8db99f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d1d3bccfb796ec2e05aed0e07b8093b2

SHA1
15ea99527465fbdd56bb5dfaefd1203433c52458

SHA256
a3adaaaf2c290721454cb10a567d75e237ca623c36ad3392bcc109866c64f57e

SHA512
20520743d6413ed352fcc47419f14710add390cd5e4faa8f9fdaa1579ffb472737f5ce8ef1fc1922684d872dc955d93d79e9d06e4ce5f3e882949ffdacfafbb9

Download Submit