6570d94985f25a54a63d13ab2a7decedb265978c49774abc3b812ba221e47674

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 01:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c20765fc6a1e31e8841040c275d6be4c_JaffaCakes118.html
Size

35KB
MD5

c20765fc6a1e31e8841040c275d6be4c
SHA1

d7a3b6f65843bc86dce9652b0b63ba7de1572432
SHA256

6570d94985f25a54a63d13ab2a7decedb265978c49774abc3b812ba221e47674
SHA512

2028c587e5e64762327199c9a3b0e33cdb34ca9a2c3fb8eeb8c3261811f7601bbf965369899eae6ac0b2081caacca2c1b68794c626e069a5115e200c5846aefb
SSDEEP

768:zwx/MDTHWI88hARkZPXbE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TIZOf6sggf6lLRB:Q/rbJxNVNu0Sx/P8mK

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
4476	msedge.exe
4476	msedge.exe
4488	identity_helper.exe
4488	identity_helper.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 3196	4476	msedge.exe	84
PID 4476 wrote to memory of 3196	4476	msedge.exe	84
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 3220	4476	msedge.exe	85
PID 4476 wrote to memory of 4724	4476	msedge.exe	86
PID 4476 wrote to memory of 4724	4476	msedge.exe	86
PID 4476 wrote to memory of 1388	4476	msedge.exe	87
PID 4476 wrote to memory of 1388	4476	msedge.exe	87
PID 4476 wrote to memory of 1388	4476	msedge.exe	87
PID 4476 wrote to memory of 1388	4476	msedge.exe	87
PID 4476 wrote to memory of 1388	4476	msedge.exe	87
PID 4476 wrote to memory of 1388	4476	msedge.exe	87
PID 4476 wrote to memory of 1388	4476	msedge.exe	87
PID 4476 wrote to memory of 1388	4476	msedge.exe	87
PID 4476 wrote to memory of 1388	4476	msedge.exe	87
PID 4476 wrote to memory of 1388	4476	msedge.exe	87
PID 4476 wrote to memory of 1388	4476	msedge.exe	87
PID 4476 wrote to memory of 1388	4476	msedge.exe	87
PID 4476 wrote to memory of 1388	4476	msedge.exe	87
PID 4476 wrote to memory of 1388	4476	msedge.exe	87
PID 4476 wrote to memory of 1388	4476	msedge.exe	87
PID 4476 wrote to memory of 1388	4476	msedge.exe	87
PID 4476 wrote to memory of 1388	4476	msedge.exe	87
PID 4476 wrote to memory of 1388	4476	msedge.exe	87
PID 4476 wrote to memory of 1388	4476	msedge.exe	87
PID 4476 wrote to memory of 1388	4476	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c20765fc6a1e31e8841040c275d6be4c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa2e9046f8,0x7ffa2e904708,0x7ffa2e904718
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,17833485135305671303,7441895930256083888,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,17833485135305671303,7441895930256083888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,17833485135305671303,7441895930256083888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17833485135305671303,7441895930256083888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17833485135305671303,7441895930256083888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,17833485135305671303,7441895930256083888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,17833485135305671303,7441895930256083888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17833485135305671303,7441895930256083888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17833485135305671303,7441895930256083888,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17833485135305671303,7441895930256083888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17833485135305671303,7441895930256083888,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,17833485135305671303,7441895930256083888,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
613B

MD5
c8fc80c880a7d2218794a96254718c19

SHA1
2ab39b6dd1c4c8d95b7e6c582c1b8d9e5f2c85fd

SHA256
bbacde9b3f7bccac94d737154801726b909a41355a9e3ce4eeb762aae01f5e36

SHA512
79132a86d77b8d09e57fb66c2cef0ab7b92f9463be4beb25d736ba4d493fdb6eb2ea11915e8598ff3592642da4739aa8096c3d7838ca7a98327b01b06439dc4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0676ceedf41ae1a0b3a23799fec3cba9

SHA1
af86e8bb12c9ff58be6053ebe59090ee3428f8e8

SHA256
32da612e85be382dc4cb321aa68424bd1aa9c181b037903b4327a692836abf11

SHA512
ae468b1c1b51c732f3be662e6d4e265ab82da2d2e9db23bbafd92000234d16f53376cdc7546473e25fb3dd198bcb00bdaf1a55295c667ac4b1f5e3bd4c68f5d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d4a4fc7f9e535bfc87ed14089f18edf7

SHA1
adf1d5f385a3801ba18426d9b42fa9ecf990e031

SHA256
3e1f65dd0b56e388d310254730889024afe30c54c121b31a924c5f93bf83e863

SHA512
2108bca753ab5705f53e3d7c572f356abf258cea082d6bc343d0d8941f33f106afa9c224de9b92f0631aeb9b96739a7ffb5911c960f395f2a5741a3bc85f3f23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8546c01cab9c20eaec343242bc8b860a

SHA1
c6cde6635f3ace3854ac7016b6f5b7c2d6563c56

SHA256
0120e80f6c007b8fd81c5fcb3b5924d37c74bdd9e1572e60bd85deef476c9666

SHA512
f7867a62fbe018c2c25451b934e6660739edf61b7cde05be4cd23013c33f83889f96cfe29e0e382a7eab014b4c639da07902adee1a0551d0c034b61de2c7d502

Download Submit