51ab8fe98c9ffb942af9069b64f8297b0afdd35fe9ba2c6368c36fdc41bebbf2

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d41b15fbed4532d0bba7ce2f649b72d6_JaffaCakes118.html
Size

18KB
MD5

d41b15fbed4532d0bba7ce2f649b72d6
SHA1

6d20e84b4b4166bc23a523f9a6c0e30a7e59c604
SHA256

51ab8fe98c9ffb942af9069b64f8297b0afdd35fe9ba2c6368c36fdc41bebbf2
SHA512

9ffa781f40fdeb9b18cc2452f04bd028537c99f4cb3c9beef5b3ed5e8fed45fafc32abfd0590ad7397fb3085e67ea821c2060e00a57c1a5b7e8f8808136a3d0f
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIMOqeit458cksaxK/GzUnjBhxKpk82qDB8:SIMd0I5nO9HvsvE9xDB8

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1916	msedge.exe
1916	msedge.exe
4704	msedge.exe
4704	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 4824	4704	msedge.exe	83
PID 4704 wrote to memory of 4824	4704	msedge.exe	83
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 3588	4704	msedge.exe	84
PID 4704 wrote to memory of 1916	4704	msedge.exe	85
PID 4704 wrote to memory of 1916	4704	msedge.exe	85
PID 4704 wrote to memory of 3920	4704	msedge.exe	86
PID 4704 wrote to memory of 3920	4704	msedge.exe	86
PID 4704 wrote to memory of 3920	4704	msedge.exe	86
PID 4704 wrote to memory of 3920	4704	msedge.exe	86
PID 4704 wrote to memory of 3920	4704	msedge.exe	86
PID 4704 wrote to memory of 3920	4704	msedge.exe	86
PID 4704 wrote to memory of 3920	4704	msedge.exe	86
PID 4704 wrote to memory of 3920	4704	msedge.exe	86
PID 4704 wrote to memory of 3920	4704	msedge.exe	86
PID 4704 wrote to memory of 3920	4704	msedge.exe	86
PID 4704 wrote to memory of 3920	4704	msedge.exe	86
PID 4704 wrote to memory of 3920	4704	msedge.exe	86
PID 4704 wrote to memory of 3920	4704	msedge.exe	86
PID 4704 wrote to memory of 3920	4704	msedge.exe	86
PID 4704 wrote to memory of 3920	4704	msedge.exe	86
PID 4704 wrote to memory of 3920	4704	msedge.exe	86
PID 4704 wrote to memory of 3920	4704	msedge.exe	86
PID 4704 wrote to memory of 3920	4704	msedge.exe	86
PID 4704 wrote to memory of 3920	4704	msedge.exe	86
PID 4704 wrote to memory of 3920	4704	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d41b15fbed4532d0bba7ce2f649b72d6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffee3946f8,0x7fffee394708,0x7fffee394718
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,12562605935310920391,16347794285391469729,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,12562605935310920391,16347794285391469729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,12562605935310920391,16347794285391469729,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12562605935310920391,16347794285391469729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12562605935310920391,16347794285391469729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,12562605935310920391,16347794285391469729,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8b3a4660-1f7c-454b-a76b-e483bc99207f.tmp

Filesize
6KB

MD5
2cda289727a8518c2353d0603bb34554

SHA1
c094649531de5a8a6a87550a0df2b06e46e251ae

SHA256
4f4f3690d9b9080edf69b28f6ff0b2b5df7f8dcbc5f09863d14bd1cd57c1d0b8

SHA512
db0b14a1d1d3f9ea8601ac97feb490ab169a92607c305ad05a03e59284f692d413515ed008074d33446794c4498b80584ab4f699e9f1b50fa1e65a71207a3001

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9cbd953f949391415a0fc95dffba654c

SHA1
eb4320e8307071379775ae754976301f19294ba9

SHA256
23d3fa236fcee99500bd3f8bccfbbe3c5cc8a7fc4555d679a6ccd47585878f17

SHA512
4b188c5023eddfc7dd6a6388c276569d0935df57b1f2941af7b21ba3e7386b9939115bb97d04a29101339f9296f3553e7263b6324ead2f39cc83f472eb162fe4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
85a272bf512ae437dfd506c1998472cd

SHA1
5341dc44ab0e722af61ca55e06a41eab738af4f2

SHA256
816af87050d3c4d791a1340ce9c3606cc510b89bff82570160b98972bfcfeccc

SHA512
7a6801bb15de723911878ecafa65c286088616d42455649561c4009c75a2fd7b1d05f664fdb63577d317d1396921207dfb369e205515fa8d80cc8bc2113443cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ba808d19e446d5bfc39f0de094911a8d

SHA1
6c3f0ba7814fba765f9cbb8fd7cf0f0f62ffdd71

SHA256
73521e7f53d30bba0c5bddfb0263dc311be679b61a97298c0ed0491397ab4a88

SHA512
44f7cbd02cc05571ad4c5c9a247a18562abe646a5d5e2e0bed66fcca062c5b91c2bb10d5fc33e2990e621158c928afef4cc04d65754c0a4c8c0e19b3111507ef

Download Submit