b7987e7747df2052ff20719ff4c5c4eaa9f792bba5f308e40e67062f6cb01443

Analysis

max time kernel
145s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 07:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf02d0e37bc35752df4af0da3b25b33a_JaffaCakes118.html
Size

238KB
MD5

cf02d0e37bc35752df4af0da3b25b33a
SHA1

153c58457fa552cffe4b92966eff47629a498f30
SHA256

b7987e7747df2052ff20719ff4c5c4eaa9f792bba5f308e40e67062f6cb01443
SHA512

fe33be0c36367cbf9cb591b30d3159d4b68d57a96e3779952196f51608737fbba7796742664fb092d5b12c3eb6b6ab3cbade627d86b034e79d8860b31ea8ee93
SSDEEP

3072:YrzyfkMY+BES09JXAnyrZalI+Y8a9Kjy0srnHHbX:YrWsMYod+X3oI+Y8ssXwnb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
2096	msedge.exe
2096	msedge.exe
4336	identity_helper.exe
4336	identity_helper.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe
2096	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 4792	2096	msedge.exe	83
PID 2096 wrote to memory of 4792	2096	msedge.exe	83
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 3620	2096	msedge.exe	84
PID 2096 wrote to memory of 4512	2096	msedge.exe	85
PID 2096 wrote to memory of 4512	2096	msedge.exe	85
PID 2096 wrote to memory of 4216	2096	msedge.exe	86
PID 2096 wrote to memory of 4216	2096	msedge.exe	86
PID 2096 wrote to memory of 4216	2096	msedge.exe	86
PID 2096 wrote to memory of 4216	2096	msedge.exe	86
PID 2096 wrote to memory of 4216	2096	msedge.exe	86
PID 2096 wrote to memory of 4216	2096	msedge.exe	86
PID 2096 wrote to memory of 4216	2096	msedge.exe	86
PID 2096 wrote to memory of 4216	2096	msedge.exe	86
PID 2096 wrote to memory of 4216	2096	msedge.exe	86
PID 2096 wrote to memory of 4216	2096	msedge.exe	86
PID 2096 wrote to memory of 4216	2096	msedge.exe	86
PID 2096 wrote to memory of 4216	2096	msedge.exe	86
PID 2096 wrote to memory of 4216	2096	msedge.exe	86
PID 2096 wrote to memory of 4216	2096	msedge.exe	86
PID 2096 wrote to memory of 4216	2096	msedge.exe	86
PID 2096 wrote to memory of 4216	2096	msedge.exe	86
PID 2096 wrote to memory of 4216	2096	msedge.exe	86
PID 2096 wrote to memory of 4216	2096	msedge.exe	86
PID 2096 wrote to memory of 4216	2096	msedge.exe	86
PID 2096 wrote to memory of 4216	2096	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\cf02d0e37bc35752df4af0da3b25b33a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe074446f8,0x7ffe07444708,0x7ffe07444718
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,7225552472434522979,14944143440764992794,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,7225552472434522979,14944143440764992794,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,7225552472434522979,14944143440764992794,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7225552472434522979,14944143440764992794,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7225552472434522979,14944143440764992794,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,7225552472434522979,14944143440764992794,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,7225552472434522979,14944143440764992794,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7225552472434522979,14944143440764992794,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7225552472434522979,14944143440764992794,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7225552472434522979,14944143440764992794,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7225552472434522979,14944143440764992794,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2288 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,7225552472434522979,14944143440764992794,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3076 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4be6ef8a78f3c65b438d7ffdf7005e22

SHA1
1ad6b045f55afcbd66df2490e04d7fead0d5973a

SHA256
ca04671c071d60954a8483e475a91c53976dce8a5a4095cf9b5f274e945f91e3

SHA512
323e076f4e64a10efa1249da87c877edd3ca811fb3c0d2b318ec79d4dc86ca5120cc512f96bc2e5c9518f257c8bb8f012a1cc944611112a9cd287458abf68abc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a197be23c315847ac79afefecb0dae3c

SHA1
b2e9489030715a57c8b866eb656180d0a1f20358

SHA256
f08f2f64d0ca82ef8d90331115e946b50979255672eee66f12f0f03eb9b58ece

SHA512
2e19342645a958ba44e40558808c6aa23bb0b215bca81d0ca6070b2af957005bdeb74ac7f9b22cb9c5341623ca7475482b47e04741b80a84e41d8479573604e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e5aeabe536ae5bfc198b1b6c57b7302f

SHA1
8f8561b69bbebcf200ae6d9f4a2f5b8d019276a2

SHA256
1fb637272fe714b187ed84b1ceb83f6e64178d58985af4cb934f3c41c77fe98d

SHA512
0fd819636304906303ed1e8e3266442ff6ee7b0c9c487a5774a549ac3f8abae5affb89f6f25c69dc4922b674f27df1a0e3ddac06f6f9d090f51f1344da2b45ae

Download Submit