aa72507281aae6bd1ac9bb3aab80d4e133ad6e69084e1e0dfb346490cea5bd3c

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 03:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d0f8c70a1e2e83b5b7c52f96f834bdc8_JaffaCakes118.html
Size

201KB
MD5

d0f8c70a1e2e83b5b7c52f96f834bdc8
SHA1

c2cab491084b6395e532d015266a4daec60dde05
SHA256

aa72507281aae6bd1ac9bb3aab80d4e133ad6e69084e1e0dfb346490cea5bd3c
SHA512

1715b80db6a724bac105b70ca3dbb6cb0f33b4a6dbcb5481b3a8d8b52148133f0d879c4a41b8c64fafc4ee18c6e83e1dfa2d1ea235cdceb8757770338987f21c
SSDEEP

1536:kaKj288Q4GkZkGs/E5I5UtWObbs3G2nNbyEF3Ns/GvM:dKfhe

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
740	msedge.exe
740	msedge.exe
4792	identity_helper.exe
4792	identity_helper.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe
1892	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 2636	740	msedge.exe	82
PID 740 wrote to memory of 2636	740	msedge.exe	82
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 3184	740	msedge.exe	83
PID 740 wrote to memory of 1784	740	msedge.exe	84
PID 740 wrote to memory of 1784	740	msedge.exe	84
PID 740 wrote to memory of 316	740	msedge.exe	85
PID 740 wrote to memory of 316	740	msedge.exe	85
PID 740 wrote to memory of 316	740	msedge.exe	85
PID 740 wrote to memory of 316	740	msedge.exe	85
PID 740 wrote to memory of 316	740	msedge.exe	85
PID 740 wrote to memory of 316	740	msedge.exe	85
PID 740 wrote to memory of 316	740	msedge.exe	85
PID 740 wrote to memory of 316	740	msedge.exe	85
PID 740 wrote to memory of 316	740	msedge.exe	85
PID 740 wrote to memory of 316	740	msedge.exe	85
PID 740 wrote to memory of 316	740	msedge.exe	85
PID 740 wrote to memory of 316	740	msedge.exe	85
PID 740 wrote to memory of 316	740	msedge.exe	85
PID 740 wrote to memory of 316	740	msedge.exe	85
PID 740 wrote to memory of 316	740	msedge.exe	85
PID 740 wrote to memory of 316	740	msedge.exe	85
PID 740 wrote to memory of 316	740	msedge.exe	85
PID 740 wrote to memory of 316	740	msedge.exe	85
PID 740 wrote to memory of 316	740	msedge.exe	85
PID 740 wrote to memory of 316	740	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d0f8c70a1e2e83b5b7c52f96f834bdc8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbc77b46f8,0x7ffbc77b4708,0x7ffbc77b4718
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,14510051800889043720,6333242271050548969,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,14510051800889043720,6333242271050548969,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,14510051800889043720,6333242271050548969,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14510051800889043720,6333242271050548969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14510051800889043720,6333242271050548969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14510051800889043720,6333242271050548969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,14510051800889043720,6333242271050548969,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,14510051800889043720,6333242271050548969,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14510051800889043720,6333242271050548969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14510051800889043720,6333242271050548969,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14510051800889043720,6333242271050548969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14510051800889043720,6333242271050548969,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,14510051800889043720,6333242271050548969,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5080 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
255B

MD5
84b28e8ffed9fa0b8f6a91b5b31b308d

SHA1
efaf4dff37c34966c481eef0caf7dacee9e2a78c

SHA256
cf81f066b1ba1e869f5551bbc61c497d91035e2afcb750c3e63d5c7644b0b29c

SHA512
a838f81d13c5ecf02aedcdc60159f4b3f6e22e1f14c566ee3b2765e5645fe0eebabe24124ac018ea64986261c904e5bb50512708babe39bde76d7a5ab9280ea9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f2703a7fc87404ddfa6fefb1b7eb2b39

SHA1
abe9b09ce215857f227501e9ae1a48332abf14f4

SHA256
308076d66c6ac4ce69af0734951fc073ce9df2833106139d6ac86de237b15f24

SHA512
6f1dfbf836644e8590e304e8e6ac8f9ca86ea86d9196f1194d1fa4b4307a842d19efe9a182dd850cdf525007a41bcd53e9c72e5817ae25b9884caefaab00000e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5a3b117e5e96cd6c3d4a29aaa285aac0

SHA1
06f4fc2ef52acaf44c34a336c8f817e167dca0af

SHA256
7176ee35891abb1e6351c4612a608d0e75eda1cd6c42b8a4eacd18c1b0225839

SHA512
b463220840c268d2b2798035a85fcea1f224dff64ea42fefe0b33184908e54ea62cb7e2334d9c62495057a4e9fe0edac442c7016797fd95165f3b57339e92e27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a01f5aa16c0b3b284079fe87ddb752bf

SHA1
e58c95467bcbdecbcc627c515ac859389e6021b0

SHA256
37bca2d9546b5cf3eaccc6237cfaefaa9b193bcccb4d95b20511a3d662028ea2

SHA512
354085df023285a2ce1101eb34417ad70607ff5b543ce1932bd7c7d3de0a2b92fe28bae47053ba60fd5a1de3d43840621fe48332df6f74eb67a62b3b5e6b9bf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
67ff28f15bd8f2bfb0aede9c3e3c9e53

SHA1
f10d5a6ab52917541c0d9180b583fd8986bdfc22

SHA256
1fe5b6fc16861af1016e4cc73e8c26131004d9e5ab38c991bd87b567d6a6aea6

SHA512
e1eefd50568c28b4e27810ab4e86f2be59ba6158bd3c6bc71a59b81d7b07718f92ac2beee9da7bd0e173b529a229ca14ebee9ee4bfb0a1cf4b66bd958f858099

Download Submit