7839cdf87b2b593bc4cdf78313e8b086dffc1aebaf6fa879aa77b9f9dd74af84

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-09-2024 00:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d31d2b853bf1b2ac91ca628e1b074e3a_JaffaCakes118.html
Size

213KB
MD5

d31d2b853bf1b2ac91ca628e1b074e3a
SHA1

8195672f70296002c2ec6bf5daf3d7b3a6d9d374
SHA256

7839cdf87b2b593bc4cdf78313e8b086dffc1aebaf6fa879aa77b9f9dd74af84
SHA512

ac41a6d9e28dd25f52de84385e3bf14267dd4f70548ecae0dc04ed365e4f2a9fe2a0c7773a53d76bf9479649245ff2beaedcbc461070091b8ce016e5c455b6e9
SSDEEP

3072:SRy8ZbjZXpSyfkMY+BES09JXAnyrZalI+YQ:SRxXXsMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2220	msedge.exe
2220	msedge.exe
4388	msedge.exe
4388	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 4924	4388	msedge.exe	85
PID 4388 wrote to memory of 4924	4388	msedge.exe	85
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 1300	4388	msedge.exe	86
PID 4388 wrote to memory of 2220	4388	msedge.exe	87
PID 4388 wrote to memory of 2220	4388	msedge.exe	87
PID 4388 wrote to memory of 5068	4388	msedge.exe	88
PID 4388 wrote to memory of 5068	4388	msedge.exe	88
PID 4388 wrote to memory of 5068	4388	msedge.exe	88
PID 4388 wrote to memory of 5068	4388	msedge.exe	88
PID 4388 wrote to memory of 5068	4388	msedge.exe	88
PID 4388 wrote to memory of 5068	4388	msedge.exe	88
PID 4388 wrote to memory of 5068	4388	msedge.exe	88
PID 4388 wrote to memory of 5068	4388	msedge.exe	88
PID 4388 wrote to memory of 5068	4388	msedge.exe	88
PID 4388 wrote to memory of 5068	4388	msedge.exe	88
PID 4388 wrote to memory of 5068	4388	msedge.exe	88
PID 4388 wrote to memory of 5068	4388	msedge.exe	88
PID 4388 wrote to memory of 5068	4388	msedge.exe	88
PID 4388 wrote to memory of 5068	4388	msedge.exe	88
PID 4388 wrote to memory of 5068	4388	msedge.exe	88
PID 4388 wrote to memory of 5068	4388	msedge.exe	88
PID 4388 wrote to memory of 5068	4388	msedge.exe	88
PID 4388 wrote to memory of 5068	4388	msedge.exe	88
PID 4388 wrote to memory of 5068	4388	msedge.exe	88
PID 4388 wrote to memory of 5068	4388	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d31d2b853bf1b2ac91ca628e1b074e3a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5fbc46f8,0x7ffe5fbc4708,0x7ffe5fbc4718
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,16736125899196752355,17688531017108980101,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,16736125899196752355,17688531017108980101,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,16736125899196752355,17688531017108980101,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16736125899196752355,17688531017108980101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16736125899196752355,17688531017108980101,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,16736125899196752355,17688531017108980101,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5008 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9a86629115834df15926cbf0e249a514

SHA1
fce29aa0880148eade16c79dd911e4444cf714f4

SHA256
4087aa25f40db8b007a31a952dd23b0d48a1947900f4f76e38cfdf576757f176

SHA512
4343d43361e9b4b2a1bc895a42399aecf31a4ebb8c24da2b3e00da48ce75360b77ea8b9fadb8a5c31d0ed1c303aac3d0a566cbc57ac53e92c5df3c6958a1eeea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f8b6002c3376559ac8ad88067c17b351

SHA1
83aad1439ec1942e48e7100d156356a1c9c02012

SHA256
23834d2888239147e54606baf1699d3c5ce2fd3333f7e8cd44c3e8160a3bb033

SHA512
c284db954ce099ad5d4a70fc5d183ba73640aed5fb9801465654722419fefb45ca678a51869ffdfda6dbae840efd1112e375f516ac583c7318578930d4c0fdb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8927142ba93cdbfe6cbfb76abc564ce8

SHA1
c3ef63a7ccd5f8a4d5e00e0e32debdbc369d08a8

SHA256
5e8ff55dd384b6f861ef24588e9c57f768b374cd53ef886338f3627ae5d79496

SHA512
e13d96e3fad158479c4c8f31217ec78b6471e24cb962773d1fa11c8aeb408b3a10a2431ff807d76fb97f3859f72f1b56513a7a56c170a0db15f3d00e245c6936

Download Submit