d96a54b38c9575512e3a804fb034491718cf1171e2fcc5439574e063b0b0d751

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 19:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2a8d56ed8996407dd0248f8f2fc78cf_JaffaCakes118.html
Size

229KB
MD5

d2a8d56ed8996407dd0248f8f2fc78cf
SHA1

cd519541817fff46065207531761ef1c9043fa1d
SHA256

d96a54b38c9575512e3a804fb034491718cf1171e2fcc5439574e063b0b0d751
SHA512

126b8aa5d1f18185be279b9b2fe29a67ff896fd44dda39779ce0ae987397d9e84531afa6a1339484abc8e2c9bd90911e82fd931466ac40d4cf4cf9dd257a8353
SSDEEP

1536:d8Ex0ZUfW0BmFZO0JMopcZKjoJphlLYt0ZkADbWCFZR1MTu5qNvzJXL+mHwV:11MI3sOzx5qNvzJXL+mHI

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4564	msedge.exe
4564	msedge.exe
2792	msedge.exe
2792	msedge.exe
3836	identity_helper.exe
3836	identity_helper.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 996	2792	msedge.exe	83
PID 2792 wrote to memory of 996	2792	msedge.exe	83
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 3100	2792	msedge.exe	87
PID 2792 wrote to memory of 4564	2792	msedge.exe	88
PID 2792 wrote to memory of 4564	2792	msedge.exe	88
PID 2792 wrote to memory of 2168	2792	msedge.exe	89
PID 2792 wrote to memory of 2168	2792	msedge.exe	89
PID 2792 wrote to memory of 2168	2792	msedge.exe	89
PID 2792 wrote to memory of 2168	2792	msedge.exe	89
PID 2792 wrote to memory of 2168	2792	msedge.exe	89
PID 2792 wrote to memory of 2168	2792	msedge.exe	89
PID 2792 wrote to memory of 2168	2792	msedge.exe	89
PID 2792 wrote to memory of 2168	2792	msedge.exe	89
PID 2792 wrote to memory of 2168	2792	msedge.exe	89
PID 2792 wrote to memory of 2168	2792	msedge.exe	89
PID 2792 wrote to memory of 2168	2792	msedge.exe	89
PID 2792 wrote to memory of 2168	2792	msedge.exe	89
PID 2792 wrote to memory of 2168	2792	msedge.exe	89
PID 2792 wrote to memory of 2168	2792	msedge.exe	89
PID 2792 wrote to memory of 2168	2792	msedge.exe	89
PID 2792 wrote to memory of 2168	2792	msedge.exe	89
PID 2792 wrote to memory of 2168	2792	msedge.exe	89
PID 2792 wrote to memory of 2168	2792	msedge.exe	89
PID 2792 wrote to memory of 2168	2792	msedge.exe	89
PID 2792 wrote to memory of 2168	2792	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d2a8d56ed8996407dd0248f8f2fc78cf_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90e1f46f8,0x7ff90e1f4708,0x7ff90e1f4718
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,15375516575534812040,4305984829109800617,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,15375516575534812040,4305984829109800617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,15375516575534812040,4305984829109800617,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,15375516575534812040,4305984829109800617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,15375516575534812040,4305984829109800617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,15375516575534812040,4305984829109800617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,15375516575534812040,4305984829109800617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,15375516575534812040,4305984829109800617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,15375516575534812040,4305984829109800617,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,15375516575534812040,4305984829109800617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,15375516575534812040,4305984829109800617,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,15375516575534812040,4305984829109800617,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
934d537209c6dc010120062136441caf

SHA1
b329449d65bb6a5b85729f58c460885b2814b9b3

SHA256
ec78a41b307a9646839af4e64b3f67e7ee35622f0f907c1f6a0f671f528b71ab

SHA512
a0502795b79a83403b996c6e2b756695e640778796b951a2405f3faec9e6b734bd8ac3d54d74d4d4a2dd07be22e3ae458a2b4144dad49b4d0c2ca51e04dffc51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8d9691b58e745676f38707f0fe01677e

SHA1
7d39254a2d48a97eb091b05f836c05a6b9dc0887

SHA256
2728647e6b6dcc3c43c04c8126693f1f01dcb0fc404c2193304ae769ae973b32

SHA512
4c7631cc8b38ab863c9882e6bcebbb39078732fce042abf95042134870c12a6a9b440a2a127982d906f524c632490687d89d861af72d6113f6ee009a648e7496

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dca1ea5e9a8fd2f12e757f1700809fba

SHA1
b6a1130746d5df3d4ab08f6b19c6e081287125aa

SHA256
14c414c701f33521d93d5b80e04a0d0be65c36ca997bc87979af9e1686281639

SHA512
3f85ca8069494236c4b6e3b0f5b1ed7b45be024ba9c3e16c8af7874aabb4ef143d0a30688fbf68b573b735882aee127398704bd99bd9805da47e732132f4e98d

Download Submit