c41feb8589837a6284b54b6486ec4874b99f28e6bedaef7341f5bc1c7db70927

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 20:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d0713de1d96b7f89fc687aac323918ff_JaffaCakes118.html
Size

171KB
MD5

d0713de1d96b7f89fc687aac323918ff
SHA1

5ad98544eeba04f352a7cea555816906c01422ee
SHA256

c41feb8589837a6284b54b6486ec4874b99f28e6bedaef7341f5bc1c7db70927
SHA512

0ae41ada6f00735741d3afa67ae5bc300e33c001fc42bd16b8e09706947f719915adf19a095cd4aa49006e099a0b01c3209992a45bd149a4c755432918767d2c
SSDEEP

1536:+v229vLjItdOA7jnhP01SERyltDetW9aLGWkyI8Egi/UlHkXYK/tpBoG4uVkG/Od:+O29TK7jnhcK+07EKpztmX1t3

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1120	msedge.exe
1120	msedge.exe
3380	msedge.exe
3380	msedge.exe
672	identity_helper.exe
672	identity_helper.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 3760	3380	msedge.exe	83
PID 3380 wrote to memory of 3760	3380	msedge.exe	83
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 5012	3380	msedge.exe	84
PID 3380 wrote to memory of 1120	3380	msedge.exe	85
PID 3380 wrote to memory of 1120	3380	msedge.exe	85
PID 3380 wrote to memory of 4972	3380	msedge.exe	86
PID 3380 wrote to memory of 4972	3380	msedge.exe	86
PID 3380 wrote to memory of 4972	3380	msedge.exe	86
PID 3380 wrote to memory of 4972	3380	msedge.exe	86
PID 3380 wrote to memory of 4972	3380	msedge.exe	86
PID 3380 wrote to memory of 4972	3380	msedge.exe	86
PID 3380 wrote to memory of 4972	3380	msedge.exe	86
PID 3380 wrote to memory of 4972	3380	msedge.exe	86
PID 3380 wrote to memory of 4972	3380	msedge.exe	86
PID 3380 wrote to memory of 4972	3380	msedge.exe	86
PID 3380 wrote to memory of 4972	3380	msedge.exe	86
PID 3380 wrote to memory of 4972	3380	msedge.exe	86
PID 3380 wrote to memory of 4972	3380	msedge.exe	86
PID 3380 wrote to memory of 4972	3380	msedge.exe	86
PID 3380 wrote to memory of 4972	3380	msedge.exe	86
PID 3380 wrote to memory of 4972	3380	msedge.exe	86
PID 3380 wrote to memory of 4972	3380	msedge.exe	86
PID 3380 wrote to memory of 4972	3380	msedge.exe	86
PID 3380 wrote to memory of 4972	3380	msedge.exe	86
PID 3380 wrote to memory of 4972	3380	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d0713de1d96b7f89fc687aac323918ff_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffabc4646f8,0x7ffabc464708,0x7ffabc464718
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,10306879035370031126,6215190763631446159,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,10306879035370031126,6215190763631446159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,10306879035370031126,6215190763631446159,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,10306879035370031126,6215190763631446159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,10306879035370031126,6215190763631446159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,10306879035370031126,6215190763631446159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,10306879035370031126,6215190763631446159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,10306879035370031126,6215190763631446159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,10306879035370031126,6215190763631446159,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,10306879035370031126,6215190763631446159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,10306879035370031126,6215190763631446159,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1756 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,10306879035370031126,6215190763631446159,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3100 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
456B

MD5
3ebefaa85c5496ae58264347ad9277c6

SHA1
a33ab90be2a441ea623de9e678bff42066e06c9a

SHA256
c57eb9812529a2eba7d10e96d751f6594b5fc6db25d68fa41ce4613bc451e6d6

SHA512
fc4ea3b3944732916d9b6e8598d8c5fe91dc1a6484009dac43ee54ea95f13cc6109818d4e19119dc04b1908db514060248ca3a6b37f8975ce3a2535594954387

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
189ddce1775f576c86629bb8a8b8ee92

SHA1
8dfb1c49bb1b4a4bdef73908289c3cbacbe2cb01

SHA256
20cc3c2bbbaf35f7c644c547ac4eb50639f86a0ac77b82d239174ad889dda5dc

SHA512
8c89d339f9eeb81a81b7c97e2654ec12b9354289576b7fb769ee650facc2a19822de8ab8bb875cbdf3a4642f51922ec8f26d4bf9626561fbfd0f9eb04f5bb60e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
44a45d7ac1d83ec22d5660cef2f55a6c

SHA1
b0c05525cd5a1a21e9c8e92a1c7b4dedbe129653

SHA256
5c69d07e90d52e849ae42670d8bfaa0e0cbea9dce82b67cce022f3bb0b4947ef

SHA512
cef0baac5c714a1473dcb225cd24ba11fc08ba11561ef1311294551871ab05995bd9fa96933cc27f15d18afd44b5a237ebac5c412e2608e8526d606931505c15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
f8cad958974567bb832c2caec4ba28dc

SHA1
0d977383efb1b4300d674b4b224992c77ff644b6

SHA256
ed7a16abf110fa2ce14235ebc07693c66a43bd6484361b166eddf6b7596e7977

SHA512
193ceafa61270ac8d6b81ff3ec0a7ec3d432d303dd9f772df72fbe19ac2bb4c34c529cbd81ac61822f0338e59dcc84e45271954394c56f9c7aef9873629547ef

Download Submit