c7ec03137b48f805fded06b4ee9deb97c2b00fded50d2799d587a6f50d70786b

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 14:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2206a184b762499daa0d674262496c2_JaffaCakes118.html
Size

132KB
MD5

d2206a184b762499daa0d674262496c2
SHA1

3af0f7c6a192f1d682d5f2d1fb2b071b0003e088
SHA256

c7ec03137b48f805fded06b4ee9deb97c2b00fded50d2799d587a6f50d70786b
SHA512

35b127742511d089be5109e55a727b088418c12fa3bbaaab877c18013d02d95eb48d46b7a7bdea6ec682307dc602174c22b3c46e201a74616e51b582c56364e4
SSDEEP

3072:G9IOpiiN1iWhTzyAgJLJxD7csUFETC7R+BcmlFVLU1N00ro71Yc6D7ojznHE:UTRgJLJxD7csUFETC7R+BcmlFVLU1N0K

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
3904	msedge.exe
3904	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 3676	3904	msedge.exe	83
PID 3904 wrote to memory of 3676	3904	msedge.exe	83
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 852	3904	msedge.exe	84
PID 3904 wrote to memory of 4164	3904	msedge.exe	85
PID 3904 wrote to memory of 4164	3904	msedge.exe	85
PID 3904 wrote to memory of 3968	3904	msedge.exe	86
PID 3904 wrote to memory of 3968	3904	msedge.exe	86
PID 3904 wrote to memory of 3968	3904	msedge.exe	86
PID 3904 wrote to memory of 3968	3904	msedge.exe	86
PID 3904 wrote to memory of 3968	3904	msedge.exe	86
PID 3904 wrote to memory of 3968	3904	msedge.exe	86
PID 3904 wrote to memory of 3968	3904	msedge.exe	86
PID 3904 wrote to memory of 3968	3904	msedge.exe	86
PID 3904 wrote to memory of 3968	3904	msedge.exe	86
PID 3904 wrote to memory of 3968	3904	msedge.exe	86
PID 3904 wrote to memory of 3968	3904	msedge.exe	86
PID 3904 wrote to memory of 3968	3904	msedge.exe	86
PID 3904 wrote to memory of 3968	3904	msedge.exe	86
PID 3904 wrote to memory of 3968	3904	msedge.exe	86
PID 3904 wrote to memory of 3968	3904	msedge.exe	86
PID 3904 wrote to memory of 3968	3904	msedge.exe	86
PID 3904 wrote to memory of 3968	3904	msedge.exe	86
PID 3904 wrote to memory of 3968	3904	msedge.exe	86
PID 3904 wrote to memory of 3968	3904	msedge.exe	86
PID 3904 wrote to memory of 3968	3904	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d2206a184b762499daa0d674262496c2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9c0a46f8,0x7ffd9c0a4708,0x7ffd9c0a4718
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16162860037086913528,10741375091843265447,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,16162860037086913528,10741375091843265447,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,16162860037086913528,10741375091843265447,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16162860037086913528,10741375091843265447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16162860037086913528,10741375091843265447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16162860037086913528,10741375091843265447,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4848 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
349B

MD5
c42395990bebb9065d621a71e25614bb

SHA1
7a60f46547f50534c3336c3c1133641d0d00f5ca

SHA256
6df652f58034f6ddc9fccdd9af7fc8482131a8a83dae815fe3876bb3f2136713

SHA512
3db4f045322e55018011471a8f617768d1629972c6982d463ca2b6154188f75f34f4f0a2a29e0d824ff1c3cf2eb338ac14a783530f297b27c4ff2dee44dbf8f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3545758e047a669ae1fcb62ec897e372

SHA1
89ea6a7a3e15863857e07fde5e3c3872b186f680

SHA256
6fe1dfe8d817eb44985267493aeb5a1f870d4aa787849b6fce137df219986e9f

SHA512
bb4b84da526879468cefe9b3d6e180cfe2d38406afa30b41eeacdb4c4e44052636d1d40f0477a81c7c47e05b280ad2680d9e39eb01f80c841c91817209d831aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
092cf8de2abdf4ab308d42ba46e0b71b

SHA1
0721f7afe1dc17bc00ae6d59a5216dfa2ed82a6c

SHA256
d32ed262e4f1010b5000885271c10e4f952ecb0c16c60dead9123af34fc0facf

SHA512
63326f8ba02062ffcfac1d4ccaee03285dd7a71253acc506755aa59cd9aaa9e70cdf2f257da9cf161a217d7f90bc535b28d9f1712fd581f0a1c6bfae77c13b37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e6318809d500e54e9757c08840c62c65

SHA1
cc79aa625010e689439d0d170bd9c70323abe4e2

SHA256
ad726634f3b89a5197f29a345f744307e6f66cc283bcccf7bfebff6b177fafda

SHA512
8d7a9b81b4a5d7e45e636b9d66a07915bdecdda2b10cc66a85bf4cc2835dacf098690addb28f6603b9bd02823d8525a0ad0d24826aab8e6bb8f89cf91b1bd42c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
f83f96b3e158e1b2b4483ed077a697c0

SHA1
8ffddacb7a4a4e8bff248756faffb3209c4fe453

SHA256
fbb31987c2ea5074b2a317edd2299b4f24e77471f923da5514d6deebae7659f2

SHA512
04fd821d11b3137dbf4421c6c4295c64b91d835c95459ba9e279dc006010b768ed240108f6c057f219b7103b15275cdb3ae44109395cb484120bd558bef1f753

Download Submit