5a782009c3726c9d8c65812ef6ebd7bc4794600d6184c337cf7e1fad5b4fa491

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2024 15:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c91c525827e22a0b0f3474a8b88ded2c_JaffaCakes118.html
Size

48KB
MD5

c91c525827e22a0b0f3474a8b88ded2c
SHA1

1536019ed8375cc1f321c8b075abd1ebeb74555c
SHA256

5a782009c3726c9d8c65812ef6ebd7bc4794600d6184c337cf7e1fad5b4fa491
SHA512

f74d1689d57e1ddc37d1c19a162b4712b53f32d64027de997cf5269f19106e2893dc4f2000a0df54b0d10bf8d14a52c511101dd43ae7a00a14ea7ae851b8ad44
SSDEEP

1536:S87hotdcQ0D8sdhFhbru/z/cm/1/X/1/Y+GTNS:S87hYjPpvpRGI

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
2564	msedge.exe
2564	msedge.exe
1036	identity_helper.exe
1036	identity_helper.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 3708	2564	msedge.exe	84
PID 2564 wrote to memory of 3708	2564	msedge.exe	84
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 4360	2564	msedge.exe	85
PID 2564 wrote to memory of 3572	2564	msedge.exe	86
PID 2564 wrote to memory of 3572	2564	msedge.exe	86
PID 2564 wrote to memory of 876	2564	msedge.exe	87
PID 2564 wrote to memory of 876	2564	msedge.exe	87
PID 2564 wrote to memory of 876	2564	msedge.exe	87
PID 2564 wrote to memory of 876	2564	msedge.exe	87
PID 2564 wrote to memory of 876	2564	msedge.exe	87
PID 2564 wrote to memory of 876	2564	msedge.exe	87
PID 2564 wrote to memory of 876	2564	msedge.exe	87
PID 2564 wrote to memory of 876	2564	msedge.exe	87
PID 2564 wrote to memory of 876	2564	msedge.exe	87
PID 2564 wrote to memory of 876	2564	msedge.exe	87
PID 2564 wrote to memory of 876	2564	msedge.exe	87
PID 2564 wrote to memory of 876	2564	msedge.exe	87
PID 2564 wrote to memory of 876	2564	msedge.exe	87
PID 2564 wrote to memory of 876	2564	msedge.exe	87
PID 2564 wrote to memory of 876	2564	msedge.exe	87
PID 2564 wrote to memory of 876	2564	msedge.exe	87
PID 2564 wrote to memory of 876	2564	msedge.exe	87
PID 2564 wrote to memory of 876	2564	msedge.exe	87
PID 2564 wrote to memory of 876	2564	msedge.exe	87
PID 2564 wrote to memory of 876	2564	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c91c525827e22a0b0f3474a8b88ded2c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffeed946f8,0x7fffeed94708,0x7fffeed94718
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,8064257202282219722,15554831177777797667,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,8064257202282219722,15554831177777797667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,8064257202282219722,15554831177777797667,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8064257202282219722,15554831177777797667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8064257202282219722,15554831177777797667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,8064257202282219722,15554831177777797667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,8064257202282219722,15554831177777797667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8064257202282219722,15554831177777797667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2328 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8064257202282219722,15554831177777797667,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8064257202282219722,15554831177777797667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8064257202282219722,15554831177777797667,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,8064257202282219722,15554831177777797667,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
470B

MD5
1fcd2c6fbe6c6baebf595374cd7e1a6b

SHA1
099d5c48c3343e280812ed59a0126f65b3dbce21

SHA256
d200b13041c7af61d0b424a241e822db2963e87d49b2d459024f0239bf5ae535

SHA512
5c1813a94bfd954a69a6e78b14ee9c85e42287594d782f98f3c470a2bd27af721afd74c66ad2dafbe82ea99b2bfb469c12c50fc20ee21cf6118b040ae67dbaf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6a24e3f04f83ed72705298514a64f017

SHA1
d76b327e512551eaa41c9e00e7c359ac92c5e74d

SHA256
0988bbd423e5698709547705063de210d792a7ac4ce792ccc83f4dee7998b595

SHA512
3d87815f9e389601896412109f47d039653934dcf184c5c1e80bd2def4015b38082cd468a0bffcea3500caa08993d6d0c748db575bda7dcf60c5a5b7065799e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8e37704955101c90cb39d55e7b083bba

SHA1
ca10c96a0662c18ebe367e9893290dc49b05e840

SHA256
f281de9c7ea46a144ebdabcf01e49dbae36eb0485a749d63f43abe794d4b1067

SHA512
9740bdc54865cb0621d996ab4f85239c1417ceb50362cf1ae3118634e52015f3a79493d9fe3c926b15d9891f7103313929630c705005ba828d4189a9f8c14d1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
009e03f6a3895f55377fa8c1b49a0fb3

SHA1
3e79bad55e70fffb80fb8cbaa49791ef8a8a368a

SHA256
42d6c01e36939d3717ebe33e5b301346d3c5da2d45c29f960031a02de79c0bc1

SHA512
bafd24e06c9f9c3fbddc66ead1dafebe247873ca3435ded4a3399811712fddd35973bdd90303655b07443ba30b20969effe4d2951cc9dc549ba38dcc944f85ae

Download Submit