a08bfaffdfc4be38a43e9f92eb60fad0e6db3df631d437ca56b931f227f30d09

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 01:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0d6537f44c40a81501c00dd88438a94_JaffaCakes118.html
Size

155KB
MD5

d0d6537f44c40a81501c00dd88438a94
SHA1

4a3c9f8f334a36127d7825bc35d4cb942188bf7f
SHA256

a08bfaffdfc4be38a43e9f92eb60fad0e6db3df631d437ca56b931f227f30d09
SHA512

84883502b136e8a78f1a48c177ca30388ebde8d986959c67cfd040e7bbe030d3466ccc996e165781cbd128be374c0055b5d4c9e7324b0add6288f67331adf2ca
SSDEEP

3072:UZb24yfkMY+BES09JXAnyrZalI+YfArtApV7:5sMYod+X3oI+YCAX7

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4532	msedge.exe
4532	msedge.exe
224	msedge.exe
224	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
224	msedge.exe
224	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 4220	224	msedge.exe	83
PID 224 wrote to memory of 4220	224	msedge.exe	83
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 1380	224	msedge.exe	84
PID 224 wrote to memory of 4532	224	msedge.exe	85
PID 224 wrote to memory of 4532	224	msedge.exe	85
PID 224 wrote to memory of 3760	224	msedge.exe	86
PID 224 wrote to memory of 3760	224	msedge.exe	86
PID 224 wrote to memory of 3760	224	msedge.exe	86
PID 224 wrote to memory of 3760	224	msedge.exe	86
PID 224 wrote to memory of 3760	224	msedge.exe	86
PID 224 wrote to memory of 3760	224	msedge.exe	86
PID 224 wrote to memory of 3760	224	msedge.exe	86
PID 224 wrote to memory of 3760	224	msedge.exe	86
PID 224 wrote to memory of 3760	224	msedge.exe	86
PID 224 wrote to memory of 3760	224	msedge.exe	86
PID 224 wrote to memory of 3760	224	msedge.exe	86
PID 224 wrote to memory of 3760	224	msedge.exe	86
PID 224 wrote to memory of 3760	224	msedge.exe	86
PID 224 wrote to memory of 3760	224	msedge.exe	86
PID 224 wrote to memory of 3760	224	msedge.exe	86
PID 224 wrote to memory of 3760	224	msedge.exe	86
PID 224 wrote to memory of 3760	224	msedge.exe	86
PID 224 wrote to memory of 3760	224	msedge.exe	86
PID 224 wrote to memory of 3760	224	msedge.exe	86
PID 224 wrote to memory of 3760	224	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d0d6537f44c40a81501c00dd88438a94_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8d7d46f8,0x7ffd8d7d4708,0x7ffd8d7d4718
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,3684177592333941175,9210931515069679326,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,3684177592333941175,9210931515069679326,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,3684177592333941175,9210931515069679326,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3684177592333941175,9210931515069679326,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3684177592333941175,9210931515069679326,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,3684177592333941175,9210931515069679326,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
336B

MD5
9200db55cd887bbe3693c92df582970c

SHA1
3361a016a4855c6ab006bea7232978228fb1c206

SHA256
7bb1084d9c560abdcd81fc3a39af314e79f73f4184a073143d2a69c02d434718

SHA512
f81c9e0001644526b02648ae6923d1c923c44d61f896fe7e3f6e15eba9d04feb32c92a03e200d39381cf1e45f0dbcfdfc1564cb8617d3cd7fbd2a18d06f05844

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
336B

MD5
38864ec41c9c0ba7cfab6d8cafa0aab0

SHA1
ea991f986aba05050c8d3a41e581a4116a59b357

SHA256
77d1896393324dc1d712d9d5e80a14e7e6031532bce25b2c4c689500d4cfbf4c

SHA512
1a7c00042dddfd2e3a96220adfe9cbd70204263faf8ab07114898d3761e104702daf566104e53c40c6a464c8a0e3641f81a6cf3d8dbddd26e0e1b124ec4fc504

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
116B

MD5
a4241c693fbb0890faa305764d6cf50d

SHA1
e856d3421567a3cfd8d790825d6952ba524fe463

SHA256
197eaf026300dfbba19cdaa31982c92741d973f655d875b6362246d6f89d07df

SHA512
7e9cdeb74e86bbb4afcf620a148f82a03f38d3a0d370ea37143e7cffce45109b5bb7638aaa77c97505d046a8ac4ec6f9e4dd630c54ffb44b57296d066d308bd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c3a7229ac59aeb2edb00e39e9bfae7fe

SHA1
ea8b79ef5acc3e5f273c1ea119aaddc86d2eb389

SHA256
4199384687104def450df8613d344916fa98b86adcb8f5dfd270ee395b06045c

SHA512
e4f2d5b47ac60067b4f66fa09aea1144306f7c28c9851a74b29f869574af30f53d1e5b845a6a963100da8738ddf7e45f534d6315dbc8f1cb172a2bb8b6fea1b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ec160ac554bd632977f2f4658a05f6b6

SHA1
4579a205180b8547182dc42ffc5e8553dccece5c

SHA256
7b6e2c2d120d248c84bc905bc4aec901f4cf9bf0438e38045a9f6c13ec7fed2c

SHA512
5799dd6e4aa4ba701f74e72413842ce61a03921f546cdabc7519d315ab34ea0161eb7160ebab1557f2bbca93b7862bc62c4a3dfc4e0689598e07dd75011deb28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
1c182c0b7cb23b0c4875ece6a1774cc2

SHA1
695935582a6f983ca1fa3c610793bf78f79a798a

SHA256
6339fbf1d7aa198ccd9ae1c9bf27ea6396990a721285ced2e748e62a12b5eb50

SHA512
bd256bb83525950e70580120d8d0f0c7fc03c561dd049dc9ea8b31d8e8d453afe667db828d64c20eb3126fcf0b9ef22bfa9cc270b7980c238e0f764ef2a47cc7

Download Submit