992bd8544215cff312b5911848fbd3c141d1f2759856a8f7c2fb9ea709ae6c29

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 13:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d47d3d4016563c12c8eec4a52182adaf_JaffaCakes118.html
Size

18KB
MD5

d47d3d4016563c12c8eec4a52182adaf
SHA1

14f2ebebdecf41587803991f97f51bba4a45c176
SHA256

992bd8544215cff312b5911848fbd3c141d1f2759856a8f7c2fb9ea709ae6c29
SHA512

123e89801f0797acd446ac849e4709e541e77c22e0cdbb613c327ebcd813925f341801286b8161e6f3b06d02c4cb419324cd1805892900aec6524526df2687fc
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIR4FzUnjBhTl82qDB8:SIMd0I5nO9H5svT+xDB8

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
456	msedge.exe
456	msedge.exe
2236	msedge.exe
2236	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2236	msedge.exe
2236	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1228	2236	msedge.exe	83
PID 2236 wrote to memory of 1228	2236	msedge.exe	83
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 4852	2236	msedge.exe	84
PID 2236 wrote to memory of 456	2236	msedge.exe	85
PID 2236 wrote to memory of 456	2236	msedge.exe	85
PID 2236 wrote to memory of 1800	2236	msedge.exe	86
PID 2236 wrote to memory of 1800	2236	msedge.exe	86
PID 2236 wrote to memory of 1800	2236	msedge.exe	86
PID 2236 wrote to memory of 1800	2236	msedge.exe	86
PID 2236 wrote to memory of 1800	2236	msedge.exe	86
PID 2236 wrote to memory of 1800	2236	msedge.exe	86
PID 2236 wrote to memory of 1800	2236	msedge.exe	86
PID 2236 wrote to memory of 1800	2236	msedge.exe	86
PID 2236 wrote to memory of 1800	2236	msedge.exe	86
PID 2236 wrote to memory of 1800	2236	msedge.exe	86
PID 2236 wrote to memory of 1800	2236	msedge.exe	86
PID 2236 wrote to memory of 1800	2236	msedge.exe	86
PID 2236 wrote to memory of 1800	2236	msedge.exe	86
PID 2236 wrote to memory of 1800	2236	msedge.exe	86
PID 2236 wrote to memory of 1800	2236	msedge.exe	86
PID 2236 wrote to memory of 1800	2236	msedge.exe	86
PID 2236 wrote to memory of 1800	2236	msedge.exe	86
PID 2236 wrote to memory of 1800	2236	msedge.exe	86
PID 2236 wrote to memory of 1800	2236	msedge.exe	86
PID 2236 wrote to memory of 1800	2236	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d47d3d4016563c12c8eec4a52182adaf_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeebe946f8,0x7ffeebe94708,0x7ffeebe94718
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,6828813760807991963,1762137261490144317,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,6828813760807991963,1762137261490144317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,6828813760807991963,1762137261490144317,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6828813760807991963,1762137261490144317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6828813760807991963,1762137261490144317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,6828813760807991963,1762137261490144317,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4920 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7a520f2d946bd52b5e44be3c2aea7919

SHA1
6d520aa81afb9487fed4e0a5e271264ce66955cd

SHA256
b5131c0d4b09a66b900a7586db0927872d12f62d91940d80a93b078a41b4fc76

SHA512
fee732499f37a48750e15d9ed4926564b1dd70af704266071595817d326d3377f81fc1ef0d2319d24f78d1d117760f86a7ee0dca11237d72db457aba7ffe8acc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
726c5876628822fc6741835f66da83d5

SHA1
e640c126dd42a78c6b0e4611c55b99bf7a3b7901

SHA256
612431715a3ae5849e9560b216f93e26d5f7fb2f94809a2b7357319b55dfe947

SHA512
038bd53b668606854619e27f9995355ca552216b675600fbea336567b11172f0895208edbb6884e90c2595fd8ae19e5117c5812756c100bea9600d314e15d1e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e074ae019fc75a43de8aafef54d8f220

SHA1
74473cc65c51d2524c3fd4216c96c95e62e626ea

SHA256
4174e3924d00c6616579ea0b034b86b0204820b95604b4dd55ee38fc1036950b

SHA512
cd8556e8628437ce27146450559740b35205fba7b82b8b1d3d79b263d010e474260ba8066da07d67fb32a61d00a750b4d2bfbe3599f8c0e6eceb16160509a9e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cbd5e851-8784-4809-a970-37ab189fd86b.tmp

Filesize
10KB

MD5
bca5ac120f8b6cdccd46f3bf68751ad7

SHA1
904e5424f9b008e7668104e97b9201e4aa7e7236

SHA256
1f5bb6a5d21e6047499308799c72542dce4510f4788d3d849ad9d2961886dbb6

SHA512
49d4b0e3c55159829310437104d646656e495bc5f5a177e5f087d3793a810cf49cba8b8aeaa6bd319c18d104e825ed3ee1bef086ffbca0f43b6f33237f7b6c35

Download Submit