fb0d635f19ce121de048fb5113cdded8957ab5c9200308d3bd0d1b5064ac5108

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 08:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d181f5872bf9150633e8c15c0715642b_JaffaCakes118.html
Size

27KB
MD5

d181f5872bf9150633e8c15c0715642b
SHA1

0e0ade41aa12a3dee1ebc297fbbe981d5a91b271
SHA256

fb0d635f19ce121de048fb5113cdded8957ab5c9200308d3bd0d1b5064ac5108
SHA512

89f9d6eb3815d47e53765815bbd0e9f601f31704829d4eee56d36d29a428a56ccaeedfb17623b7afb5377f1df4a6c17df04b70ee9fc7a6bc3887154faf8b8ea8
SSDEEP

192:uwnYb5nHGnQjxn5Q/tUnQieNNnqnQOkEntnWAHnQTbnRnQ9eBhm60TTlQl7MBtqO:2Q/GT8LwTkSXgm

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1972	msedge.exe
1972	msedge.exe
4432	msedge.exe
4432	msedge.exe
3680	identity_helper.exe
3680	identity_helper.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 2096	4432	msedge.exe	86
PID 4432 wrote to memory of 2096	4432	msedge.exe	86
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 4780	4432	msedge.exe	87
PID 4432 wrote to memory of 1972	4432	msedge.exe	88
PID 4432 wrote to memory of 1972	4432	msedge.exe	88
PID 4432 wrote to memory of 2456	4432	msedge.exe	89
PID 4432 wrote to memory of 2456	4432	msedge.exe	89
PID 4432 wrote to memory of 2456	4432	msedge.exe	89
PID 4432 wrote to memory of 2456	4432	msedge.exe	89
PID 4432 wrote to memory of 2456	4432	msedge.exe	89
PID 4432 wrote to memory of 2456	4432	msedge.exe	89
PID 4432 wrote to memory of 2456	4432	msedge.exe	89
PID 4432 wrote to memory of 2456	4432	msedge.exe	89
PID 4432 wrote to memory of 2456	4432	msedge.exe	89
PID 4432 wrote to memory of 2456	4432	msedge.exe	89
PID 4432 wrote to memory of 2456	4432	msedge.exe	89
PID 4432 wrote to memory of 2456	4432	msedge.exe	89
PID 4432 wrote to memory of 2456	4432	msedge.exe	89
PID 4432 wrote to memory of 2456	4432	msedge.exe	89
PID 4432 wrote to memory of 2456	4432	msedge.exe	89
PID 4432 wrote to memory of 2456	4432	msedge.exe	89
PID 4432 wrote to memory of 2456	4432	msedge.exe	89
PID 4432 wrote to memory of 2456	4432	msedge.exe	89
PID 4432 wrote to memory of 2456	4432	msedge.exe	89
PID 4432 wrote to memory of 2456	4432	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d181f5872bf9150633e8c15c0715642b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb979446f8,0x7ffb97944708,0x7ffb97944718
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,9136385266180865599,2946202069174230161,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,9136385266180865599,2946202069174230161,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,9136385266180865599,2946202069174230161,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9136385266180865599,2946202069174230161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9136385266180865599,2946202069174230161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,9136385266180865599,2946202069174230161,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,9136385266180865599,2946202069174230161,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9136385266180865599,2946202069174230161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9136385266180865599,2946202069174230161,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9136385266180865599,2946202069174230161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,9136385266180865599,2946202069174230161,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,9136385266180865599,2946202069174230161,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5448 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a512e16c2d6a17e9c29b3c7f2d599566

SHA1
f0d690e398b2758eaf604eb84a9d995357c436dd

SHA256
35276d4adc05b32596e85564d63db5ee6ac366fb8ba5de765a1c3d8fbfe8395a

SHA512
1f5476941f04471f0291ecb99484c8f0924bd54f69d02879f014932d093931af6ac752e9d419b3a2209bd2d5349a4a4f9f42ac25c78c6c17aa7144bcf94e478a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
821283217444d03c92e0d1b9bfdc02a2

SHA1
cfba096da9d75796f4bbed1aba3f0dfcb193eb0c

SHA256
209f2617bf4c3b77290625156e6246f9461443cb44691c6347ffb686000b9ce4

SHA512
09958c78661428598145c771a08e4b781eb3c5df402d045fce8b8ab18c75d4a4337af70f16ca0e6c2fc4ede8c2bb4e0d914d6fa9a685e815ed648fe400dc3844

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1af5878018b9b3ad98e71239ff5127ed

SHA1
35411a2acbf126c078ee6be85475cb22fecee26f

SHA256
19ee7efee775a3eb8e7f8bbbcb7173240d74f9c3a30c32bbdb170da209acc905

SHA512
42d4a6501bf8a577196b877ccfe7108fdf0d5ca17976ea345544e9fd2f1f8643aaf9599f6a3ba27b844c7f497120bff0c7a47abd0ff08c293a06f78e2befcc05

Download Submit