8fbeacd32bc94b91014d4860843d169796d62c64c9da04befa7c4cc293ec69bb

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 21:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d071e60440e19829bb1edb34470575f5_JaffaCakes118.html
Size

77KB
MD5

d071e60440e19829bb1edb34470575f5
SHA1

47751eda045a0bd558ff280d7197aad3596d7076
SHA256

8fbeacd32bc94b91014d4860843d169796d62c64c9da04befa7c4cc293ec69bb
SHA512

d6618c04219aaa8184877d8d64abe2068bb9358c1f381cc64a45b29067f78baed132f1bf5ff506be0aa34cdfc908c34365879903317245773e50a0e7be2547c1
SSDEEP

1536:kCC+yfE+tJ/Z976uWxY5eiICz5ozPSlmGUe55EOFCP/9CC/LS6+e2yOc+wX2OQiL:S/FKcQ8m3J

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
704	msedge.exe
704	msedge.exe
4752	identity_helper.exe
4752	identity_helper.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 704 wrote to memory of 816	704	msedge.exe	83
PID 704 wrote to memory of 816	704	msedge.exe	83
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4428	704	msedge.exe	84
PID 704 wrote to memory of 4572	704	msedge.exe	85
PID 704 wrote to memory of 4572	704	msedge.exe	85
PID 704 wrote to memory of 2272	704	msedge.exe	86
PID 704 wrote to memory of 2272	704	msedge.exe	86
PID 704 wrote to memory of 2272	704	msedge.exe	86
PID 704 wrote to memory of 2272	704	msedge.exe	86
PID 704 wrote to memory of 2272	704	msedge.exe	86
PID 704 wrote to memory of 2272	704	msedge.exe	86
PID 704 wrote to memory of 2272	704	msedge.exe	86
PID 704 wrote to memory of 2272	704	msedge.exe	86
PID 704 wrote to memory of 2272	704	msedge.exe	86
PID 704 wrote to memory of 2272	704	msedge.exe	86
PID 704 wrote to memory of 2272	704	msedge.exe	86
PID 704 wrote to memory of 2272	704	msedge.exe	86
PID 704 wrote to memory of 2272	704	msedge.exe	86
PID 704 wrote to memory of 2272	704	msedge.exe	86
PID 704 wrote to memory of 2272	704	msedge.exe	86
PID 704 wrote to memory of 2272	704	msedge.exe	86
PID 704 wrote to memory of 2272	704	msedge.exe	86
PID 704 wrote to memory of 2272	704	msedge.exe	86
PID 704 wrote to memory of 2272	704	msedge.exe	86
PID 704 wrote to memory of 2272	704	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d071e60440e19829bb1edb34470575f5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff073846f8,0x7fff07384708,0x7fff07384718
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,15277227145954240802,1789899444997624308,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,15277227145954240802,1789899444997624308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,15277227145954240802,1789899444997624308,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15277227145954240802,1789899444997624308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15277227145954240802,1789899444997624308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15277227145954240802,1789899444997624308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,15277227145954240802,1789899444997624308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,15277227145954240802,1789899444997624308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15277227145954240802,1789899444997624308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15277227145954240802,1789899444997624308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15277227145954240802,1789899444997624308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15277227145954240802,1789899444997624308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,15277227145954240802,1789899444997624308,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
694e1f97dc7d8ba9ba8a9d66b3ec313a

SHA1
e918ff892b359f4e4573044ac91a8365661b38bb

SHA256
39915aa1ab4b3649db0b285f1a2068380645f2eeee303d6c6e7c34605c9b1137

SHA512
736525a2773854727830c31d3c1c491bc8af008206d8ab511023c01e8f6adef06abcf9bce201eb8b33e89fdf1d7044354a0ac5f8a6138147faf7ccee6694613e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
63e3fe210019e85d3d327bd6e45923ee

SHA1
490400a6303674a833bff6ff3a5ee5ffd6a379a7

SHA256
63de607943120c4f7f8e0241594737fb583b740b07ed0bba644fe3a11c151bdd

SHA512
c5253fd24a3b26ade27f224f4a39e3954e039c613dc50196c8bf274521588b1ea0c8ee2d00aae7c935fb59307421c1ae37b96398f81890f905de2a469afeb422

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
10986d91fec9622adf3f1649af4a3ecf

SHA1
2b8ac0e04cf9e7302cca5a6dc413381ffda6518a

SHA256
49fcfe914452d2bc50436cc6139fb1b9f477a4d647439fbd1267a318a81f9777

SHA512
2dfdcfe617c153eca5cf1a3bd502721a07449b213a21ce2e6b1e40d2929fb73103f453bcc0cd763559ad99eea859bdcd3e1362d732c47e97360e3363bcabb228

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
49d7ef3acc3ee7a26fdf604a41d670e5

SHA1
a723b13303804703401f75359f6fcbf6e899e6b4

SHA256
2facce2714957d9706a60d2044ece5252294704c5b80092e5e55725749122bc0

SHA512
341214ea9aa92dc4b92742b539671c004eb1eb0cbd4dbf6dbb7b213ed85d3ec377c461ee2c659cc95daa6d110ce503b949fe3f4b3f11c7c3ab4f6e8d90a756a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1ec7040d6000b06512f0d2af52b4c64a

SHA1
37568eef1a3f9376361b3dbfbce59a793623b31e

SHA256
283747d7ffb06df61d99af41c70c6079c33bfe69f89f99f378a823e20a0c4141

SHA512
10f21fac6b6e93678ec7120cdc90bb75ff7b98c002f1eee83d0af367215e1120b1870d7febefda9fd0ca1940c2f4c47323854a71447118b385abbb0ee8bdd43d

Download Submit