213b93912db73dbb483f0dd7fef6b95d8e9eb31b55f4cb0466c75baf2ad29271

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 13:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d46c5298a4dc08880f4a643310702e2a_JaffaCakes118.html
Size

268KB
MD5

d46c5298a4dc08880f4a643310702e2a
SHA1

94d851e639fefe758bea3421932fa000c0a10677
SHA256

213b93912db73dbb483f0dd7fef6b95d8e9eb31b55f4cb0466c75baf2ad29271
SHA512

63ecf52b8a642acb7367e2bd550bf976722bc288c7579d42c24625bd2b26fd983defad121173668f42dab7f02d103256fbedffd73b5b150eec7dfbc7d21cefcb
SSDEEP

3072:qxDNvG8emAGXmNJUzqbiBDIwBuo8rbNE+FcObaBU8wDuichED4QY7n0e3y:MfXmNJTNE+FcOmO8s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1920	msedge.exe
1920	msedge.exe
4560	msedge.exe
4560	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	456	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	456	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 4712	4560	msedge.exe	83
PID 4560 wrote to memory of 4712	4560	msedge.exe	83
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 4836	4560	msedge.exe	84
PID 4560 wrote to memory of 1920	4560	msedge.exe	85
PID 4560 wrote to memory of 1920	4560	msedge.exe	85
PID 4560 wrote to memory of 940	4560	msedge.exe	86
PID 4560 wrote to memory of 940	4560	msedge.exe	86
PID 4560 wrote to memory of 940	4560	msedge.exe	86
PID 4560 wrote to memory of 940	4560	msedge.exe	86
PID 4560 wrote to memory of 940	4560	msedge.exe	86
PID 4560 wrote to memory of 940	4560	msedge.exe	86
PID 4560 wrote to memory of 940	4560	msedge.exe	86
PID 4560 wrote to memory of 940	4560	msedge.exe	86
PID 4560 wrote to memory of 940	4560	msedge.exe	86
PID 4560 wrote to memory of 940	4560	msedge.exe	86
PID 4560 wrote to memory of 940	4560	msedge.exe	86
PID 4560 wrote to memory of 940	4560	msedge.exe	86
PID 4560 wrote to memory of 940	4560	msedge.exe	86
PID 4560 wrote to memory of 940	4560	msedge.exe	86
PID 4560 wrote to memory of 940	4560	msedge.exe	86
PID 4560 wrote to memory of 940	4560	msedge.exe	86
PID 4560 wrote to memory of 940	4560	msedge.exe	86
PID 4560 wrote to memory of 940	4560	msedge.exe	86
PID 4560 wrote to memory of 940	4560	msedge.exe	86
PID 4560 wrote to memory of 940	4560	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d46c5298a4dc08880f4a643310702e2a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa4b2446f8,0x7ffa4b244708,0x7ffa4b244718
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,388099235733583641,15358281851540764862,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,388099235733583641,15358281851540764862,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,388099235733583641,15358281851540764862,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,388099235733583641,15358281851540764862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,388099235733583641,15358281851540764862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,388099235733583641,15358281851540764862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2292 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,388099235733583641,15358281851540764862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1368 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2028,388099235733583641,15358281851540764862,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,388099235733583641,15358281851540764862,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4880 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:852

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x47c 0x2ec
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5404cf63-9e50-44f3-94e7-15fb55f23872.tmp

Filesize
2KB

MD5
0aba8e5788f3f615090581d3292971da

SHA1
b933f4b15bccf9ebb3d4c98d110f0843ed403d52

SHA256
146395a7ec8716c4cd33b952016b85c75718d44691d8333e742cd90b381e78c0

SHA512
3e92216b13f549d7509b0e2e0a7b235e89b63117c39f4ed6754ea9aa0d511afa20a399bf26bd93cf502c78ddab8c9b398d48a347cde1209826e813be9d34f04b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
4e869ca91b4520dce308a2ad0a10e331

SHA1
b8278135eecb86b3655f1cbb81d61da2680ebf48

SHA256
98518a512bb2887e7adfeee7b5a576b959eb27f053b30206b25b900a9090590c

SHA512
e455c27c1b9bdfece5591ba1a0b005efe3fd56f562a8aac130398c59b0358dd9ed29a10c4c9267eca79b89cbe8883b8cf334e92b45003afb7b363a708084b29a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6a669720143f6e423cccbf132a61bf0c

SHA1
0ee8b198f20b90ef1c526ebf01e2d195cd7334d8

SHA256
43ae8af2dcb10dd4114c9052b96f6c7dbff44142b123e68b0245dc1b808d585b

SHA512
cdc606619d2bec2c140f89e43498e2b3ebfec9eeb4471bd24cfee4866ddcd3ab3d790c8b8c5a79cd5a8531d92e7a7d7efea1863ea2c2fdf1882625cad2ff69d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e27dd93a1abce9c2a1207a3a99599515

SHA1
acc70410fac009b32708d798c16671522fbf39f5

SHA256
aa06a3c4d20bac34558c1227fa6da34c3cfc56010570fa129f899be699e7f774

SHA512
13c52be52655832fa9868a357ccca27629f80035e1e3fd442b6aecc62719844f9dad10b133e31bed445d0c71d84290c4a49b25d4dc210f4b7e341d1de7d1e30a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7126f2321a0dd2e105fd91d5a31bbdd6

SHA1
518f6d6aa2167deccac55c012d6a86c8e8042d67

SHA256
89c363b4439ff621cd472a5eb4140c062ac26b024d4dab1a1a02211da2168f85

SHA512
12eacaf17daf52a516d4320a6d6d0a1f241f17e8275133ccfc38bdd93e4e9daa70d6ec9923d57ad8022246f44a8c24ec89a03cf01c065a6ad4c8ef5a09c96fcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
b11daad2f6377f51c68bfb46b69f4608

SHA1
102e402ad9620be736ac813f167b1089f654f34e

SHA256
43574ce0d8655035438f0d0106642a0f8f63245c64a28651883318ea3074dbb7

SHA512
787d28af69a511891c868986b407af1e2e8364468845df06eccd21beff8c569c406fb4af3b84245a7caaddfbc69323dc633659a33ef449e0bb31a2d04f42c807

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5899da.TMP

Filesize
204B

MD5
cddc1d381ba7c12d9502f2b3291a3afa

SHA1
a28c4abf535059de43fdb6db0b569ed196d05fc0

SHA256
31d6cae4fcf9a812737726e20b68249f766d11ed998007df290c3fe9784fed63

SHA512
18cc89d110d840173a7ccc208b5b922b30363ac68a5a8efe3d4f1ec743453a8e6dc509bdc09d5fc2b4b20ba366e7959f314e5cbc9716173f0e60aa51a7d46e2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d9c4454fa65079a2008177afd866acc7

SHA1
a9e6316ffb2037ea2a36a5ad7c7f1f51239575ae

SHA256
f7531cded5cf94a2b30907aaf9b0a9dcd822bd2e5d2882b4b2f84b18a2122f85

SHA512
58cf64880b5222ecc4895ca954e6dc8eeb83dd12ff704076d46b7b64b88816d4a04c85a780fc7e3fd05b819be6fdbfb0dc091779e76f3965ecb2a083826cfa10

Download Submit