63e9806d8270101609f957a94f188e7ecfe4377eeb428c868e78144dfac8ea3a

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-09-2024 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d02b3fdd92eda9aa65ba400e15bb8957_JaffaCakes118.html
Size

39KB
MD5

d02b3fdd92eda9aa65ba400e15bb8957
SHA1

9c207e079c4efdd9b0ad135b3dff13bffc48caae
SHA256

63e9806d8270101609f957a94f188e7ecfe4377eeb428c868e78144dfac8ea3a
SHA512

cd7b20f986ae62d94e505cd39025dd68b41e9e1a3ac4d5c716133f1c535dd1ad61a41bc8e52b7dbacb3e3ab739b65f26c4dec5a90bd4db081cd32be78997f075
SSDEEP

384:8Lc4SXRIV9zHc+j5vEX12QHz277LNB4r46PmVwXf9tjWBZ6sIri:8Lc4SXR+5s3277Lz709tjW36sIri

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
1588	msedge.exe
1588	msedge.exe
4936	identity_helper.exe
4936	identity_helper.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 4116	1588	msedge.exe	83
PID 1588 wrote to memory of 4116	1588	msedge.exe	83
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 2128	1588	msedge.exe	84
PID 1588 wrote to memory of 740	1588	msedge.exe	85
PID 1588 wrote to memory of 740	1588	msedge.exe	85
PID 1588 wrote to memory of 3708	1588	msedge.exe	86
PID 1588 wrote to memory of 3708	1588	msedge.exe	86
PID 1588 wrote to memory of 3708	1588	msedge.exe	86
PID 1588 wrote to memory of 3708	1588	msedge.exe	86
PID 1588 wrote to memory of 3708	1588	msedge.exe	86
PID 1588 wrote to memory of 3708	1588	msedge.exe	86
PID 1588 wrote to memory of 3708	1588	msedge.exe	86
PID 1588 wrote to memory of 3708	1588	msedge.exe	86
PID 1588 wrote to memory of 3708	1588	msedge.exe	86
PID 1588 wrote to memory of 3708	1588	msedge.exe	86
PID 1588 wrote to memory of 3708	1588	msedge.exe	86
PID 1588 wrote to memory of 3708	1588	msedge.exe	86
PID 1588 wrote to memory of 3708	1588	msedge.exe	86
PID 1588 wrote to memory of 3708	1588	msedge.exe	86
PID 1588 wrote to memory of 3708	1588	msedge.exe	86
PID 1588 wrote to memory of 3708	1588	msedge.exe	86
PID 1588 wrote to memory of 3708	1588	msedge.exe	86
PID 1588 wrote to memory of 3708	1588	msedge.exe	86
PID 1588 wrote to memory of 3708	1588	msedge.exe	86
PID 1588 wrote to memory of 3708	1588	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d02b3fdd92eda9aa65ba400e15bb8957_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff92ff946f8,0x7ff92ff94708,0x7ff92ff94718
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,15898902181829182213,1051944900488230403,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,15898902181829182213,1051944900488230403,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,15898902181829182213,1051944900488230403,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2452 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15898902181829182213,1051944900488230403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15898902181829182213,1051944900488230403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:264
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,15898902181829182213,1051944900488230403,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,15898902181829182213,1051944900488230403,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15898902181829182213,1051944900488230403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15898902181829182213,1051944900488230403,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15898902181829182213,1051944900488230403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15898902181829182213,1051944900488230403,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,15898902181829182213,1051944900488230403,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3480 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7641bedac399dd0f8f2b7de9999998ca

SHA1
697f10324c6e180918eb32f71eae8526923fa9a8

SHA256
79ce9496bb09d147c5667c653536096bf5a734be700bf65bceaccddc4e44cb35

SHA512
d05ac4a0d9e90230cde60ede8e67452ec077cf3d4cbacd922afa76419a7d255da14cef9105620a5674c16ef89983781883a4cc0cd19efeaba0e553d3e4296560

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
04a259594aa47a09186b041e74959d0c

SHA1
5731e29cfd92a20b6e249d41b0f57fbd8742f3c3

SHA256
1bb954aa2f722f03a7f376bddaebf81193c10c1864d846a79844228f87cb0c5e

SHA512
517be933e54d49757a0fa8a245874112d345ab5a72f147bc2974cffe0661a3a467293a9c61acbba368a8857a94b467a8720a0ab93196b5fca5d148554e9ec181

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b05110278b3b8c93af6cc5b8622418d8

SHA1
414478d7c5f5dbd285a36238c10a2908f691d85d

SHA256
2b6c638db914308fb84950e4776ec4d306c8998fe224035798a0f23fc2760a5d

SHA512
3254ecf82663461a78cdaf5f14ae31a1ddfd6924c5d1459110cf9ca835a2132e7c1ba301fad1b48687c4d41f51f687f256cd5c1cb93fe45618c19951e02f01c2

Download Submit