b065e23ae696d180cdaba9ef9f7e11e9d11ddf043f5be156de8394f5af0557cf

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 02:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0e67268f02775230c296cbdfd50ba46_JaffaCakes118.html
Size

37KB
MD5

d0e67268f02775230c296cbdfd50ba46
SHA1

bbf4f62c2d641f7015ddfcd2e6c6e9741fcff433
SHA256

b065e23ae696d180cdaba9ef9f7e11e9d11ddf043f5be156de8394f5af0557cf
SHA512

dd9373f338897aa585a1fe2dea1523292bc053c0b3037381b2961cff9906612e094d7b11b62afafcd88aab721a3009f8dc40cf94ea168dfc7a6503d595d79da1
SSDEEP

768:hJ5021Ls0Oxzoz2aOyJkAIq466hGGHM2DrqE:hJ50QOxEz2aXh466hTM2DrqE

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1164	msedge.exe
1164	msedge.exe
620	msedge.exe
620	msedge.exe
3640	identity_helper.exe
3640	identity_helper.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 4116	620	msedge.exe	83
PID 620 wrote to memory of 4116	620	msedge.exe	83
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 2644	620	msedge.exe	84
PID 620 wrote to memory of 1164	620	msedge.exe	85
PID 620 wrote to memory of 1164	620	msedge.exe	85
PID 620 wrote to memory of 3340	620	msedge.exe	86
PID 620 wrote to memory of 3340	620	msedge.exe	86
PID 620 wrote to memory of 3340	620	msedge.exe	86
PID 620 wrote to memory of 3340	620	msedge.exe	86
PID 620 wrote to memory of 3340	620	msedge.exe	86
PID 620 wrote to memory of 3340	620	msedge.exe	86
PID 620 wrote to memory of 3340	620	msedge.exe	86
PID 620 wrote to memory of 3340	620	msedge.exe	86
PID 620 wrote to memory of 3340	620	msedge.exe	86
PID 620 wrote to memory of 3340	620	msedge.exe	86
PID 620 wrote to memory of 3340	620	msedge.exe	86
PID 620 wrote to memory of 3340	620	msedge.exe	86
PID 620 wrote to memory of 3340	620	msedge.exe	86
PID 620 wrote to memory of 3340	620	msedge.exe	86
PID 620 wrote to memory of 3340	620	msedge.exe	86
PID 620 wrote to memory of 3340	620	msedge.exe	86
PID 620 wrote to memory of 3340	620	msedge.exe	86
PID 620 wrote to memory of 3340	620	msedge.exe	86
PID 620 wrote to memory of 3340	620	msedge.exe	86
PID 620 wrote to memory of 3340	620	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d0e67268f02775230c296cbdfd50ba46_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa159846f8,0x7ffa15984708,0x7ffa15984718
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12962101137964061744,11820274813650336380,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,12962101137964061744,11820274813650336380,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,12962101137964061744,11820274813650336380,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12962101137964061744,11820274813650336380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12962101137964061744,11820274813650336380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12962101137964061744,11820274813650336380,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12962101137964061744,11820274813650336380,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12962101137964061744,11820274813650336380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12962101137964061744,11820274813650336380,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12962101137964061744,11820274813650336380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12962101137964061744,11820274813650336380,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12962101137964061744,11820274813650336380,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4984 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
475B

MD5
fa6c0d05ac948576b1de9a07db040d2b

SHA1
76a62f197b9e1408a5a7243c47d0a294037203de

SHA256
13842f7c2f86cbe5d1d6661b88b01e1599cd908eb77c9cff66d6edb057e2c8e4

SHA512
31ac1f86db983f4f86a3a998f1cdec5cd4d23ab9c723eab82e33395276a6f812c35b8cbb1d4ad9837e8a439129b27bf07045757748b12dd8e88e75a5f9397718

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7ab5caff033bcae5ff721c32f0325c9e

SHA1
b12b853fc46b4206fc6bf6fb0e1c4a6e8a7a7fdd

SHA256
30363ecdc2bc1c7665b75da9310aa470f8d60cfe92cf4c19d7dea0f4bd87389c

SHA512
86f1749b5d7d4cb0cf8149e10f3fabf25474560791ace97087a9065cab83c6e31e289c294092f1f42d79ddb2c5d91784fe3fec32952c7654994fbd65eec6c72d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
52246ac1835926d92b86b779e0f5cd82

SHA1
b1bdfb3fa78c87c751d62a9d320ff006a3990def

SHA256
3229485a81f4004a49fb3c08feb654c73a31df5f809628e1966be13323eaad9e

SHA512
384b40b30f023dc5f07772e65aea056bbcb2118ad260e5258967fdb5cfe38f9a84d5f7a06cd7e0aee3d4ab735d1382af703b6713b90e3415fd2e6a8a5eabb654

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
af4dcb6d3bf5891c1f1bfbd0194fd4bc

SHA1
39be738bef653475a29365eb5fa02f9fc0554132

SHA256
b4aaeaae9a46c88a2da8eb72a28528ffa9ab8bde1b203654eae07d5c4385503d

SHA512
a90db724cf518baca90d7c37c5aaa0852e9018775f4050080e7ef6fa1e4f987fb2870ecd6c0743ab2f5582bdebe20f9bcdc2a7c938e2f4a7436af618ff669851

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
46b80d61efeb402c73fb20f41e621539

SHA1
222b3835bfd6e2e96dfdab2dba982d5bafe65bdb

SHA256
5e71783d7a9d1de322754fc15d3f7f664c58ac11e74190f6d53668501215379f

SHA512
195fc79f52efd3d478eb7339f50394f884d59d375ed967ae4bc1362b975ea2e87ca7ef63fc46b1b96d229e9d92060631c3bd88d430278d3b55e59e6f5fd29330

Download Submit