38527365ed26fd2a2e7f9d62cd597bd7df7930730d3758d371b32bb821b0545e

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 13:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4724e59c50cf80c82683d199151e22a_JaffaCakes118.html
Size

225KB
MD5

d4724e59c50cf80c82683d199151e22a
SHA1

9c58cbe615b3339e3848c04a7967def5981c766a
SHA256

38527365ed26fd2a2e7f9d62cd597bd7df7930730d3758d371b32bb821b0545e
SHA512

1ef7c4f56ce165e3db71381d2bcabca4733b8c2e94109943108da9f8e575e106e132055099233b699f74911500e6c6e712bfce8f65a0609a0a75f9f3ef96863a
SSDEEP

6144:tYXqktVO3HXmcuomf5R+t8s2sLRGXMf6TQO2GnDOHnO8X:tYhVOXXmVomf5R+t8KEXphI

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1572	msedge.exe
1572	msedge.exe
4464	msedge.exe
4464	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
3224	identity_helper.exe
3224	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 2096	4464	msedge.exe	84
PID 4464 wrote to memory of 2096	4464	msedge.exe	84
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1372	4464	msedge.exe	85
PID 4464 wrote to memory of 1572	4464	msedge.exe	86
PID 4464 wrote to memory of 1572	4464	msedge.exe	86
PID 4464 wrote to memory of 4764	4464	msedge.exe	87
PID 4464 wrote to memory of 4764	4464	msedge.exe	87
PID 4464 wrote to memory of 4764	4464	msedge.exe	87
PID 4464 wrote to memory of 4764	4464	msedge.exe	87
PID 4464 wrote to memory of 4764	4464	msedge.exe	87
PID 4464 wrote to memory of 4764	4464	msedge.exe	87
PID 4464 wrote to memory of 4764	4464	msedge.exe	87
PID 4464 wrote to memory of 4764	4464	msedge.exe	87
PID 4464 wrote to memory of 4764	4464	msedge.exe	87
PID 4464 wrote to memory of 4764	4464	msedge.exe	87
PID 4464 wrote to memory of 4764	4464	msedge.exe	87
PID 4464 wrote to memory of 4764	4464	msedge.exe	87
PID 4464 wrote to memory of 4764	4464	msedge.exe	87
PID 4464 wrote to memory of 4764	4464	msedge.exe	87
PID 4464 wrote to memory of 4764	4464	msedge.exe	87
PID 4464 wrote to memory of 4764	4464	msedge.exe	87
PID 4464 wrote to memory of 4764	4464	msedge.exe	87
PID 4464 wrote to memory of 4764	4464	msedge.exe	87
PID 4464 wrote to memory of 4764	4464	msedge.exe	87
PID 4464 wrote to memory of 4764	4464	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d4724e59c50cf80c82683d199151e22a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9835546f8,0x7ff983554708,0x7ff983554718
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,15139230098302516678,13075100771304533140,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,15139230098302516678,13075100771304533140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,15139230098302516678,13075100771304533140,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2472 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,15139230098302516678,13075100771304533140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,15139230098302516678,13075100771304533140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,15139230098302516678,13075100771304533140,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,15139230098302516678,13075100771304533140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1720 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,15139230098302516678,13075100771304533140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1720 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,15139230098302516678,13075100771304533140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,15139230098302516678,13075100771304533140,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,15139230098302516678,13075100771304533140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,15139230098302516678,13075100771304533140,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:3468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
784a7499a259a62aba250a7317ffb1a9

SHA1
51e0ae0a0615dd91e695bf473ba988c8f744be7f

SHA256
4800ae49983aec9817f5e2da8e7c87ffa41e261e4254cb5782230444b957ca35

SHA512
23d8ef5e79be514348aa2a3426cbbdc6eb4fba2d1303aea501120b9f9e819cb4576fe471ec379d1f57b006cf37a6b6554c71f80311c08465f5b51bf3a27b575d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f91a649f086f70a83a3519ee9df3116c

SHA1
5b4c2a03a4ea9650f398bf17e1a79e6a5f902f95

SHA256
beea735fca0b66ff9095ac06456cbc4c0857019943b34e64f8308b2b5f2ad0f8

SHA512
e210e3c9de375b12adef4e0c79b508d0b3bcc19aadca4666fc62032ebb82c5a388b51a595baac043b6bc8bafd2079ec9074b0e0d0d98096b42a02d6933d73aa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
97082d64a3abd990912683234ed663c6

SHA1
daf01899bff2404ae3b8a06bb5aa3783138c353d

SHA256
195a2e1879f5a94863cc1adf0bd71df932ab0c1ccbeb819ea5533b58ab98d0eb

SHA512
162e0b02fa79adff2b79985beb2df7cc5ada74d9d9506eb8ad48c4c9fa85676021055e9a662c51474f30b1d1a28a9d08ce578c8befb91ea0df7b52776823e51f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3d4f42bf6ab4c67d0562c130fd7bd722

SHA1
fac35812094db3c9adaeebed2b9eb024e351718e

SHA256
b87fc19df65f54569266259469468126393ccefc3f6ac8419b2940db67d36c84

SHA512
95e70bf90c5b7d55c56b420a9d37df9b8445d4f5b2b35c9ac9ddb2d2db23db1dad28071ef3bb52a0e7bd5f8a00b29041feef912be4b3a0b850a8ccbaebf9f2ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e790b9b6efb1a82233483ec1757ff8c4

SHA1
8f8426a6eba19665e1677d4cac6f727f78acf040

SHA256
431c4454aca1124168f037abad53d4fa54182523086427114e852e56f25d75ea

SHA512
2a7fe317d40b4312b6a484ca110c479c61dfa75f0a8cc60591af4c563b19b5f63d53163e8c0b8afffb77ebe3a5877866473699df69b609942a86cdf40e886f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
60648c819d51c518801f06ddc0ff5f91

SHA1
f7dddb4ffd2c639b82a49b36dc5e9292151a6be3

SHA256
94fa54a3220179a1106ec8d5d31db10a80dd3b768ad346fd2017af2833a3dbcf

SHA512
6da3f2bc630e443e540cac96ca002f60908ead766aaeb24043a9019b85b6d246909d16fbb3e61ebe2d2669e9b81041de4deb74ee407f94d47482ecb12d751735

Download Submit