8066580167e00b809a599b01befb8fd2ad04258f48be42bcfc138ec2ce24879c

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4741e352b599d170f18663c85a4c9df_JaffaCakes118.html
Size

94KB
MD5

d4741e352b599d170f18663c85a4c9df
SHA1

3828ef2da1dcc020393026909044a015f3142ba5
SHA256

8066580167e00b809a599b01befb8fd2ad04258f48be42bcfc138ec2ce24879c
SHA512

42a5b6f66cc72a178f5c247f91fb355e755db13a543abc95294cbe8fdfebb4e2d031ade9af5766f77ac9a085ec5737e84f87df30c0cc172fee5cf3922eb93772
SSDEEP

1536:2cfB9+uP+tEBulM8LBxCFHaX1fVLe1lyPJw88/z4/EUZGTlNNK+Vg/RC0ucTu:2qBqEBulZXLPBQzMEUZYlNNdVERwcTu

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4260	msedge.exe
4260	msedge.exe
4720	msedge.exe
4720	msedge.exe
3156	identity_helper.exe
3156	identity_helper.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 2400	4720	msedge.exe	83
PID 4720 wrote to memory of 2400	4720	msedge.exe	83
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 2816	4720	msedge.exe	84
PID 4720 wrote to memory of 4260	4720	msedge.exe	85
PID 4720 wrote to memory of 4260	4720	msedge.exe	85
PID 4720 wrote to memory of 1124	4720	msedge.exe	86
PID 4720 wrote to memory of 1124	4720	msedge.exe	86
PID 4720 wrote to memory of 1124	4720	msedge.exe	86
PID 4720 wrote to memory of 1124	4720	msedge.exe	86
PID 4720 wrote to memory of 1124	4720	msedge.exe	86
PID 4720 wrote to memory of 1124	4720	msedge.exe	86
PID 4720 wrote to memory of 1124	4720	msedge.exe	86
PID 4720 wrote to memory of 1124	4720	msedge.exe	86
PID 4720 wrote to memory of 1124	4720	msedge.exe	86
PID 4720 wrote to memory of 1124	4720	msedge.exe	86
PID 4720 wrote to memory of 1124	4720	msedge.exe	86
PID 4720 wrote to memory of 1124	4720	msedge.exe	86
PID 4720 wrote to memory of 1124	4720	msedge.exe	86
PID 4720 wrote to memory of 1124	4720	msedge.exe	86
PID 4720 wrote to memory of 1124	4720	msedge.exe	86
PID 4720 wrote to memory of 1124	4720	msedge.exe	86
PID 4720 wrote to memory of 1124	4720	msedge.exe	86
PID 4720 wrote to memory of 1124	4720	msedge.exe	86
PID 4720 wrote to memory of 1124	4720	msedge.exe	86
PID 4720 wrote to memory of 1124	4720	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d4741e352b599d170f18663c85a4c9df_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa4b2446f8,0x7ffa4b244708,0x7ffa4b244718
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,13917795294660003086,3544863186955972980,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,13917795294660003086,3544863186955972980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,13917795294660003086,3544863186955972980,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13917795294660003086,3544863186955972980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13917795294660003086,3544863186955972980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,13917795294660003086,3544863186955972980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2976 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,13917795294660003086,3544863186955972980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13917795294660003086,3544863186955972980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13917795294660003086,3544863186955972980,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13917795294660003086,3544863186955972980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13917795294660003086,3544863186955972980,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,13917795294660003086,3544863186955972980,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\71d8c94d-13c0-48de-b4e0-d61862898ba1.tmp

Filesize
1KB

MD5
e1126091069dde1d08a32133a2114442

SHA1
95014a608c15621b3877014f21316fdc4bf55841

SHA256
4c19bd8ce2c76766e489aa6256cc951b271d50c2fb67a2f480a3d6657e7851c9

SHA512
ef05c30c1f2266229e9bd98841c3671009d8c814fa04dc81c7bd10baa24467439cfd5b4a9e595feb4038f7101e70962ca602074c04e719c844d6590334d4e47c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\985cc87e-feb1-43db-af68-b0b3140794d0.tmp

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2efd89c746e81b3d8eef6974e52b1847

SHA1
cc9a1ca7a964088bb64c2855f684129f3daadd81

SHA256
d5c2f570fc4a15bfd19fda486fcecfdf7471292fb7b3760a9f23976b8ab5a8ec

SHA512
8c6cd7826592578ae45c04a351569cc6d99d31928969ef7439d0a087d71d7347064cf4aacb3845f3ceebe21d36c9e4c071d563dc31cecf62e2749eff255b78d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
263e67441cae07e1cc96ce50e3266f6f

SHA1
d3ec237da1433a35001510be8ccf0833a4186cd9

SHA256
f9e9dd64f4b91798e3ed2c816a4df2b14106c125d2be5c51392fc80bec1e4e38

SHA512
a82b3d6bbd0058179c3017b909fdaa159aff4c8b0d1bb886e55c0a4c2557f32256a3375dd37ed56101a531c6441aa8fd0844955dab8fe9bda6db9d9bfd29a58c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c6f3a6da357342fe462b738095839514

SHA1
e4e533df6e0be31ca52f26d1fd4c274f6ce4e04d

SHA256
f58f6ad8f0802a362dc911c3fca8360d2866cb931592d6969054ca7cc617986b

SHA512
8d19d10907c2248fd8ddab69170f4d675cd61845fa03dc41c186463c209f1c0f716e2909bf550916a7bdb604efadb170ee28716550b2116d200694a9a30b3b67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cdc8cddc97a4eb5b86dfcb4e36bb1b85

SHA1
5548a6b2523a12f2ef41a2f00d798be2f66ab162

SHA256
7c0c7a364c869a75271c55d90d00661a6872ed44e351f7d57f24f302f1149747

SHA512
73ba355b52998deaa9963e88e2f0d82a431e394b7ed064a4b96cef91eeeab4231b869190dbaed19a50ce1e1584b4d9dae07f7207b3e32b5899328834546e58c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c231b51dc88801c42386bc6adca95a30

SHA1
37ffebcdb4350ccfae5f1e70e0ffe9d72040159d

SHA256
f5e927589779ce89806df84988a4fd1c7959a34cd67a946a72f48450816c76fa

SHA512
871ed9c7ca2ee577bdeb21ce36485dc3d76b5ee3dc2832b88255aa1ff5eb70cdf8e845a73867e0049e3f434723a5e55064da15ffbc418168826a575888a65242

Download Submit