49241e5789a6272374b8edbe21349773e9b8c5725674bf0fc236111a55e71a77

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-08-2024 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c782f67be99686b8ab5de314d4a693bd_JaffaCakes118.html
Size

2KB
MD5

c782f67be99686b8ab5de314d4a693bd
SHA1

e56db7668a29a544a4ab6e51f73e1d83f559663f
SHA256

49241e5789a6272374b8edbe21349773e9b8c5725674bf0fc236111a55e71a77
SHA512

7b37a466d20480c8c38902d9352bd23147993783380d38c732069e99c494d47b4a9af467b17b460004a3cbd60640be9fe1b1be0c2c298fd835e5de9311896b10

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe
4776	msedge.exe
4776	msedge.exe
732	identity_helper.exe
732	identity_helper.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 4576	4776	msedge.exe	84
PID 4776 wrote to memory of 4576	4776	msedge.exe	84
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 208	4776	msedge.exe	85
PID 4776 wrote to memory of 1276	4776	msedge.exe	86
PID 4776 wrote to memory of 1276	4776	msedge.exe	86
PID 4776 wrote to memory of 5040	4776	msedge.exe	87
PID 4776 wrote to memory of 5040	4776	msedge.exe	87
PID 4776 wrote to memory of 5040	4776	msedge.exe	87
PID 4776 wrote to memory of 5040	4776	msedge.exe	87
PID 4776 wrote to memory of 5040	4776	msedge.exe	87
PID 4776 wrote to memory of 5040	4776	msedge.exe	87
PID 4776 wrote to memory of 5040	4776	msedge.exe	87
PID 4776 wrote to memory of 5040	4776	msedge.exe	87
PID 4776 wrote to memory of 5040	4776	msedge.exe	87
PID 4776 wrote to memory of 5040	4776	msedge.exe	87
PID 4776 wrote to memory of 5040	4776	msedge.exe	87
PID 4776 wrote to memory of 5040	4776	msedge.exe	87
PID 4776 wrote to memory of 5040	4776	msedge.exe	87
PID 4776 wrote to memory of 5040	4776	msedge.exe	87
PID 4776 wrote to memory of 5040	4776	msedge.exe	87
PID 4776 wrote to memory of 5040	4776	msedge.exe	87
PID 4776 wrote to memory of 5040	4776	msedge.exe	87
PID 4776 wrote to memory of 5040	4776	msedge.exe	87
PID 4776 wrote to memory of 5040	4776	msedge.exe	87
PID 4776 wrote to memory of 5040	4776	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c782f67be99686b8ab5de314d4a693bd_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8f2946f8,0x7ffd8f294708,0x7ffd8f294718
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,14543850650369807740,1567577526417697565,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,14543850650369807740,1567577526417697565,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,14543850650369807740,1567577526417697565,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14543850650369807740,1567577526417697565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14543850650369807740,1567577526417697565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,14543850650369807740,1567577526417697565,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,14543850650369807740,1567577526417697565,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14543850650369807740,1567577526417697565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14543850650369807740,1567577526417697565,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14543850650369807740,1567577526417697565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14543850650369807740,1567577526417697565,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,14543850650369807740,1567577526417697565,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
64df2e64dfaa4d9c184ad3d8fffb621b

SHA1
f374de1511ddcc4143aa8d00bbddf1a1ec6879ba

SHA256
0ed7c0683c50b3a684f5a97117043b4091bc2dfd7e9d5d6e6ae0691e89d5ce43

SHA512
f15432f01c6729def3c7359d00ea5632d695c1ab592201e0ef313294f3999d0af586e899c0c1f37a45c1630855ca435dc28d2de297effdfe277b685cda48a5af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bfde7ac3cdd6cf7fcc1093e345c00f28

SHA1
2e714a0afc1f49d74ae5ecb3a47e9509fc43fa7d

SHA256
f147e76997a15822f34157df636381aa38b65bfb79ac5b992965ed903a3bce1c

SHA512
a3208a32d1c0a1344760a528b677aa2665302730f6294eb5f4cc9fa863e6590d3a598bc8bec50b198492b645b25a510d751c45c935a1981b75910172f50eab36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fcafc7d04693e3fefb7b1ab523dfd043

SHA1
57c02584342dabb6c39021540a473ba36afb35b1

SHA256
3f3e750581c81a4b39ffb06ef88739210674b04c5d2018abbf668f7c26e9408c

SHA512
cdb575a0f16f37c45f71c8ed8b93b0f37b8c7fd49a4948901964152176fe4513a01b218587544fc028b01fcf315038e59d2b3575f21a17d3252685fd84d88fd8

Download Submit