929220b237852056efc6add22c1508f78a497bc9df25269972b48708db0ff3d9

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 07:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3d3b32901563fc75499ac0b7771cac6_JaffaCakes118.html
Size

56KB
MD5

d3d3b32901563fc75499ac0b7771cac6
SHA1

fde2f32a6a69d3d3e8cebd33196808a869ab8400
SHA256

929220b237852056efc6add22c1508f78a497bc9df25269972b48708db0ff3d9
SHA512

2cbf56e3483a2c07fead43e6d198cc299668500b001e849fb0ba025a07ace5ae6d7040550f4f36be0a39fdc766db48ebb2685616a158f89091aa2a2da0b8c4ed
SSDEEP

768:Zcd9QZBC7mOdM8VpC5I9nC4B0obKVi/HUlMPd:gQZBCCOdl0IxCK1x/gMPd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
2664	msedge.exe
2664	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 3184	2664	msedge.exe	83
PID 2664 wrote to memory of 3184	2664	msedge.exe	83
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 2360	2664	msedge.exe	84
PID 2664 wrote to memory of 1864	2664	msedge.exe	85
PID 2664 wrote to memory of 1864	2664	msedge.exe	85
PID 2664 wrote to memory of 2960	2664	msedge.exe	86
PID 2664 wrote to memory of 2960	2664	msedge.exe	86
PID 2664 wrote to memory of 2960	2664	msedge.exe	86
PID 2664 wrote to memory of 2960	2664	msedge.exe	86
PID 2664 wrote to memory of 2960	2664	msedge.exe	86
PID 2664 wrote to memory of 2960	2664	msedge.exe	86
PID 2664 wrote to memory of 2960	2664	msedge.exe	86
PID 2664 wrote to memory of 2960	2664	msedge.exe	86
PID 2664 wrote to memory of 2960	2664	msedge.exe	86
PID 2664 wrote to memory of 2960	2664	msedge.exe	86
PID 2664 wrote to memory of 2960	2664	msedge.exe	86
PID 2664 wrote to memory of 2960	2664	msedge.exe	86
PID 2664 wrote to memory of 2960	2664	msedge.exe	86
PID 2664 wrote to memory of 2960	2664	msedge.exe	86
PID 2664 wrote to memory of 2960	2664	msedge.exe	86
PID 2664 wrote to memory of 2960	2664	msedge.exe	86
PID 2664 wrote to memory of 2960	2664	msedge.exe	86
PID 2664 wrote to memory of 2960	2664	msedge.exe	86
PID 2664 wrote to memory of 2960	2664	msedge.exe	86
PID 2664 wrote to memory of 2960	2664	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d3d3b32901563fc75499ac0b7771cac6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd956346f8,0x7ffd95634708,0x7ffd95634718
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7347562110487528898,723694520460119682,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,7347562110487528898,723694520460119682,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,7347562110487528898,723694520460119682,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7347562110487528898,723694520460119682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7347562110487528898,723694520460119682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7347562110487528898,723694520460119682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7347562110487528898,723694520460119682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7347562110487528898,723694520460119682,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
d2c4312fe230397702e599298203a9f1

SHA1
a459966c949cc9a68a7fa4daa2a36c1c900c1a99

SHA256
1f81802e7d52eb477dc0cfbf1efbb2e4feb20b8ad02deb76fe8f8b6d3b004de8

SHA512
d529f55ac501b75bc27309f34eb972d238e38abe9aa20eab251c5b3e18b288a6556c2e793809796a35d56e5d8d63628250e3608d75f86cb2bd922081387cb5ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
1decc75363bb6e8b40f9ad1edf8bbb22

SHA1
eb49300095e5d403bad6d52a851e03f19bc2313d

SHA256
f61f4c094b3be511e9a46ad7fdfd82f2c6dde9c800fd8fddcd11741d5f3a9385

SHA512
1a0a9545cfc3b6f6c7aa120b6a28e3b19ef0037781440a035adecd72565bc7d9f11f7f6bbcb64efdd0f77229eed81cbd9fb2af06955caa05649f4e22402a234a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
497B

MD5
18613c62b07df6174599d9bd3f25a1ab

SHA1
eef88ce7b1362197bcef3d10add6e8e8dea443b6

SHA256
3f7081e62fb6fc7429131514467114647b6360ff06af68b494d69a9f7ece09ef

SHA512
a2733d73d6e3e6439e91439a880dd0e70410fafee4ea6930ed9142fc30422a041b166c16a6df544b5472348619399bd6599b1b5db934c9ff13db063669a89b7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
164c43841bad1e464ee58b0cc1eed519

SHA1
47e79ac8e555bef93510bbb980f0034cc9c362ad

SHA256
af2a8dde6889d0339c2e2c23b4fab1f14845d2463c8841ae5e4d1ad249609d73

SHA512
6bbc73f48da4d33bacb80e5c08f99808d2e06a0f7863819703a3fe45a760c7a62fa40cff862a9b2ed73c94e023c9d159280c927d54005a24f591fcb2774f1a21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5a39f7a74fd5b5c67ee57b797c718869

SHA1
6a6e4712c867904bed31d92655fa6dbb9c715b0e

SHA256
2f0c76555c5fbc1fcfdcad61d173adfc5604ebd458cc44f5759a821127b28992

SHA512
b7f0651c3be4407abd83e634d8984257c3a8542ef3fa2b7d5825816c79d3db4e2408e29323496f9efeba670805021d9271c0def9faec7190de02a4730cf499e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
482dfc25c979420d1e7c8ff7d146ffb5

SHA1
f22019c0ca8462d5a45807cbb1f6eb87aba5ec2f

SHA256
0f8bf96851bb2686cbcb4b005fb3596ebc6441dd6ba25b39ebf36ae37d3042e2

SHA512
426056d54f78dce4c185948b1362eef99892775c6f31ad4162260f901fe88f8d6cbb04f0d14334125e800ae352de7938ab5c3bd8d492ef3967de2f9c166a1462

Download Submit