012d53ea0e5e70d07369a5993615e2f9b331b783302813520686d48709de53a0

Analysis

max time kernel
147s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 15:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d248ead1805bbdcef7c43990353ad3d3_JaffaCakes118.html
Size

94KB
MD5

d248ead1805bbdcef7c43990353ad3d3
SHA1

f212271c3c8cc7449863ea475a43c1daa456f3fb
SHA256

012d53ea0e5e70d07369a5993615e2f9b331b783302813520686d48709de53a0
SHA512

edbb43b993020fb933d4d1bdbdda4113ddb629cd13cd3da9fc1050e4c0231c37f42cec41c1ba882d5431b362ae3c4d175e5b6dd025f74a70dd845275174a8112
SSDEEP

1536:WMLiNiI7Lil8FL4RSbieT3prluKfh4LKZFayzzGBdkrY8mgHC+qpEyW:WAiT9aBdkrY8mgHC+qpEyW

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4768	msedge.exe
4768	msedge.exe
3984	msedge.exe
3984	msedge.exe
3840	identity_helper.exe
3840	identity_helper.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 3508	3984	msedge.exe	83
PID 3984 wrote to memory of 3508	3984	msedge.exe	83
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 2992	3984	msedge.exe	84
PID 3984 wrote to memory of 4768	3984	msedge.exe	85
PID 3984 wrote to memory of 4768	3984	msedge.exe	85
PID 3984 wrote to memory of 3452	3984	msedge.exe	86
PID 3984 wrote to memory of 3452	3984	msedge.exe	86
PID 3984 wrote to memory of 3452	3984	msedge.exe	86
PID 3984 wrote to memory of 3452	3984	msedge.exe	86
PID 3984 wrote to memory of 3452	3984	msedge.exe	86
PID 3984 wrote to memory of 3452	3984	msedge.exe	86
PID 3984 wrote to memory of 3452	3984	msedge.exe	86
PID 3984 wrote to memory of 3452	3984	msedge.exe	86
PID 3984 wrote to memory of 3452	3984	msedge.exe	86
PID 3984 wrote to memory of 3452	3984	msedge.exe	86
PID 3984 wrote to memory of 3452	3984	msedge.exe	86
PID 3984 wrote to memory of 3452	3984	msedge.exe	86
PID 3984 wrote to memory of 3452	3984	msedge.exe	86
PID 3984 wrote to memory of 3452	3984	msedge.exe	86
PID 3984 wrote to memory of 3452	3984	msedge.exe	86
PID 3984 wrote to memory of 3452	3984	msedge.exe	86
PID 3984 wrote to memory of 3452	3984	msedge.exe	86
PID 3984 wrote to memory of 3452	3984	msedge.exe	86
PID 3984 wrote to memory of 3452	3984	msedge.exe	86
PID 3984 wrote to memory of 3452	3984	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d248ead1805bbdcef7c43990353ad3d3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe661546f8,0x7ffe66154708,0x7ffe66154718
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,10421230973754602262,7458547176094819129,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,10421230973754602262,7458547176094819129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,10421230973754602262,7458547176094819129,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10421230973754602262,7458547176094819129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10421230973754602262,7458547176094819129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,10421230973754602262,7458547176094819129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,10421230973754602262,7458547176094819129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10421230973754602262,7458547176094819129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10421230973754602262,7458547176094819129,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10421230973754602262,7458547176094819129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10421230973754602262,7458547176094819129,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,10421230973754602262,7458547176094819129,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4752 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
178B

MD5
efb3e41ddcb00d4e436d59962fe73c4d

SHA1
4b9f2cbd664cf2136cd6966774f9ee04b4efa46a

SHA256
edc776d59064e412098066a07cba55cbabb1e7d18534e1292d34003961ad3bb6

SHA512
85a53139125a0e589b222ebee00d1c593eb24c8059b9f3f86196f8ef346cf7fc988493bb6f5cebf7aec2d0debc5017eff291b04e8aa37180d1ec5a6e2bb362ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
709a415741232b82cba9d1385bae213a

SHA1
ba25a4029f43042230bb7f335c121af05181b20c

SHA256
b98ad24020d0143077dd7f23f405bbba3435e9496d4c9c4a9b40124214ddbcf1

SHA512
d2e07f559fb68591304e97e78d50cc45c60f82210a23705843ffc6142bb314a99e105a182a5198ff548c0726b422724af135cf9d942f043bc0ba21f54227b165

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
edcb4fefa97a2573bd3871b4e84708fa

SHA1
63f021dac3f4b0fafd3ebe483252a4866ec59b5a

SHA256
dec340ee1b3a54702406839cf8746b4739b69745206a9fce14ea499390b579ef

SHA512
0f8d9dac9ae7c7cde2e8af32ca4c279ff4c4189ecfc98868fed13e9e01d0f1f1f1cf7342e49bbc6c3f9bd632f3d68c649d05541e4994b31730114039092a2701

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2aab345bdb0823601520cb37e04aa3ad

SHA1
753b08d55e312da6d588a283aa6f0baea7f4b568

SHA256
6c48096b276a18278a2e74814e30899a2dabddd6c09659bf7b98c97f4e5fb065

SHA512
85d1ff272e6bc23be7b728b8d7decd14b505cc1d31724bbd586f7daa2ff875af010b166641c2ccea0a7ba57db70cb555990b667b998a58f13a4773d5bf784022

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
edeb289d7223445842f229d062e8711f

SHA1
dd79623a0ca9578c049ae051695101dc82367de5

SHA256
4e32be372b23814ae1eab786f84246e98ec70b0e94c8db9e33105ebb09275c80

SHA512
b777df768d72669e6e85a3a18820c1da3ba4fde27dce423a2d3a8343983b2faa2831ec672a2d6d5cc2998f87248f07a97ecec11a08082c99296c94ce0b19a0c4

Download Submit