5bb879612c52031ca8dcef7d8c67e61db8cf57ce02b622b1a0e00b507f2fbf47

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 11:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1df0e75072b249b798544f1a0bbb5e1_JaffaCakes118.html
Size

66KB
MD5

d1df0e75072b249b798544f1a0bbb5e1
SHA1

9315505a60399e81a6311910e1938ac92f25a0dd
SHA256

5bb879612c52031ca8dcef7d8c67e61db8cf57ce02b622b1a0e00b507f2fbf47
SHA512

1583940e74584ac86797c2730741698a40ef2d481dd6751e2ab404bb92cc06363de3c7806bc60f08a85d39fd5ca24f51e597a11caf7ac529a566cefbc5bd089c
SSDEEP

768:JizDgcM0St8tN99OIs8RFEgFOhCoTyOqhCZkoTnMdtbBnfBgN8/oycc8QFVG8sPq:JGM+PmgAhLTIgec0tbrgaCcFNnzAC

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe
4356	msedge.exe
4356	msedge.exe
4504	identity_helper.exe
4504	identity_helper.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 3272	4356	msedge.exe	87
PID 4356 wrote to memory of 3272	4356	msedge.exe	87
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2716	4356	msedge.exe	88
PID 4356 wrote to memory of 2804	4356	msedge.exe	89
PID 4356 wrote to memory of 2804	4356	msedge.exe	89
PID 4356 wrote to memory of 3156	4356	msedge.exe	90
PID 4356 wrote to memory of 3156	4356	msedge.exe	90
PID 4356 wrote to memory of 3156	4356	msedge.exe	90
PID 4356 wrote to memory of 3156	4356	msedge.exe	90
PID 4356 wrote to memory of 3156	4356	msedge.exe	90
PID 4356 wrote to memory of 3156	4356	msedge.exe	90
PID 4356 wrote to memory of 3156	4356	msedge.exe	90
PID 4356 wrote to memory of 3156	4356	msedge.exe	90
PID 4356 wrote to memory of 3156	4356	msedge.exe	90
PID 4356 wrote to memory of 3156	4356	msedge.exe	90
PID 4356 wrote to memory of 3156	4356	msedge.exe	90
PID 4356 wrote to memory of 3156	4356	msedge.exe	90
PID 4356 wrote to memory of 3156	4356	msedge.exe	90
PID 4356 wrote to memory of 3156	4356	msedge.exe	90
PID 4356 wrote to memory of 3156	4356	msedge.exe	90
PID 4356 wrote to memory of 3156	4356	msedge.exe	90
PID 4356 wrote to memory of 3156	4356	msedge.exe	90
PID 4356 wrote to memory of 3156	4356	msedge.exe	90
PID 4356 wrote to memory of 3156	4356	msedge.exe	90
PID 4356 wrote to memory of 3156	4356	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d1df0e75072b249b798544f1a0bbb5e1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb2b9046f8,0x7ffb2b904708,0x7ffb2b904718
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,14538428522164269448,653554018107062320,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1932,14538428522164269448,653554018107062320,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1932,14538428522164269448,653554018107062320,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,14538428522164269448,653554018107062320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,14538428522164269448,653554018107062320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1932,14538428522164269448,653554018107062320,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1932,14538428522164269448,653554018107062320,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,14538428522164269448,653554018107062320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,14538428522164269448,653554018107062320,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,14538428522164269448,653554018107062320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,14538428522164269448,653554018107062320,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,14538428522164269448,653554018107062320,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f662a5bcdfbd43a0427a4ec71c6d5cca

SHA1
a89b997551e45fe2040bf0251bd42502ced468c1

SHA256
8f7c19645bf68ff78b80ceb0e705d5f59236a118ea0f2514d25a0c5c5e59a484

SHA512
c1eb002c616ff3945beade8f4189f8063875d452b396ef3b060cfbbeb9e37803a86417fe830685c558ba6173dca688fe45a4103135d037d993fff8817648c9a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6d1d265fcc67757e5c966daa859656d9

SHA1
70414a2836efeba8972a62e7d3994466dcd2cdf1

SHA256
6dcf993d28782e024d3533c1611656add7902a62e69281e34c6c47346c432a94

SHA512
8e014db76d58124c39b422620186800b657fb9dbc4f09b8a31ad450087ef419ca2ce0bf86f812c4ab7491077f21b40478cef68f33c4bd707a9e2af68ecbfad8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e2c1447bb3becedd603f4989a1ad6924

SHA1
933b518d717bdc010fe6c57d4731ccf1869b8f21

SHA256
4303a5658bd529262175b6810e3d23b7607c31bc5dd9c10ee6e9f6d77917585e

SHA512
f0271c538808cf805094e41caf208e171d1f8b16b749312a3ed7aff6401c916a687c28a00931fd55512c4b49e879d495471c444e91fbf30d05989df69c14bb56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\efb5c6b6-6f4f-4dbd-958f-bbbf9659f7ad.tmp

Filesize
10KB

MD5
7ad57a7ce6ec30cc6466b55c8bf84867

SHA1
2e06cd4cda15632bdcd690650959c16fdbb10997

SHA256
acf429bb715bfbabf9caafadca46f41224e103659e07e41fe8b025cfcac4b6f4

SHA512
25696e754e70a70797577c1eca3f915d63bc42eec022ac52ca280a663562ac8feff8b80cae6bdf0bb3c3ccddc1c1f28a451df81beea884a59d0fbce0af510948

Download Submit