60e3c723649029aa955a2ac9b11ed35e158655920df282c304446093614a7d60

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 22:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d73b11a8a5aa69f8a66c134ea165d109_JaffaCakes118.html
Size

121KB
MD5

d73b11a8a5aa69f8a66c134ea165d109
SHA1

8f5a3c6399f6e741c37b38f99995011d837dba32
SHA256

60e3c723649029aa955a2ac9b11ed35e158655920df282c304446093614a7d60
SHA512

fac589e1fcae2bf777a0d4a7fc9810acb78f60482e8a9fd98c68222a5ced092013c42ce85237b441f3ceaf7fa78c50f13846da52375b76101a3f5729c2dd6001
SSDEEP

1536:R5S+KBRTP/1KWA+WRV+Pt+RQD5aOvkum8wHf1bbKZ4:2bRTP/4Rw95aQqf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
4456	msedge.exe
4456	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 3540	4456	msedge.exe	83
PID 4456 wrote to memory of 3540	4456	msedge.exe	83
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1220	4456	msedge.exe	84
PID 4456 wrote to memory of 1004	4456	msedge.exe	85
PID 4456 wrote to memory of 1004	4456	msedge.exe	85
PID 4456 wrote to memory of 5004	4456	msedge.exe	86
PID 4456 wrote to memory of 5004	4456	msedge.exe	86
PID 4456 wrote to memory of 5004	4456	msedge.exe	86
PID 4456 wrote to memory of 5004	4456	msedge.exe	86
PID 4456 wrote to memory of 5004	4456	msedge.exe	86
PID 4456 wrote to memory of 5004	4456	msedge.exe	86
PID 4456 wrote to memory of 5004	4456	msedge.exe	86
PID 4456 wrote to memory of 5004	4456	msedge.exe	86
PID 4456 wrote to memory of 5004	4456	msedge.exe	86
PID 4456 wrote to memory of 5004	4456	msedge.exe	86
PID 4456 wrote to memory of 5004	4456	msedge.exe	86
PID 4456 wrote to memory of 5004	4456	msedge.exe	86
PID 4456 wrote to memory of 5004	4456	msedge.exe	86
PID 4456 wrote to memory of 5004	4456	msedge.exe	86
PID 4456 wrote to memory of 5004	4456	msedge.exe	86
PID 4456 wrote to memory of 5004	4456	msedge.exe	86
PID 4456 wrote to memory of 5004	4456	msedge.exe	86
PID 4456 wrote to memory of 5004	4456	msedge.exe	86
PID 4456 wrote to memory of 5004	4456	msedge.exe	86
PID 4456 wrote to memory of 5004	4456	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d73b11a8a5aa69f8a66c134ea165d109_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe664d46f8,0x7ffe664d4708,0x7ffe664d4718
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,13881672901292801416,9247955574015815221,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,13881672901292801416,9247955574015815221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,13881672901292801416,9247955574015815221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13881672901292801416,9247955574015815221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13881672901292801416,9247955574015815221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13881672901292801416,9247955574015815221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13881672901292801416,9247955574015815221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13881672901292801416,9247955574015815221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,13881672901292801416,9247955574015815221,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5004 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c24d531ac807b073d362a446b19ccc54

SHA1
9d19fc56989fec6702da1ecb93b566e123df5754

SHA256
818196c10475a0e99ddd622801f92c3114b623dd493c4c366589c61fbc0958b8

SHA512
c026bebaeed001b905fbd9168d5510a8da3acb16503f8ed25e24db4e074d7c81c85f1d4d07d44fd6f5555c0364f4370fab731dada5de04c3e77b033aaa728bc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6f0f79e0801a22ce782645697ec8c969

SHA1
cd98924ca6a09e43a24271d72209c80aeaa4d5bd

SHA256
2d3ed631b744e660ef9906b93482ba30683cbf9a500e7bbae07cbda78ca4831d

SHA512
29c89656b891130208fc946f1aa4f2cfdfff427e08f07e2668c1b2413a64aa6398caf2c7a8c68ad90bd90818709c9cf0f0a25887af51b7ef27245f471b829387

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7871d1c59d0c5fd1dfe2cdc286cec2a5

SHA1
1516d559fcbae14c2ba328ea223158ddfa1e874d

SHA256
adb69c318e95462ac2c2ef301d8cc0493f10b9dc6d83c9ce66d845386c84cdb4

SHA512
0aeab623dcdb29a531353fc2cbba9e04ad713933d76b9c5adb27554587c8bc22e30ea380de96826c935b2842bb80a724261f92a56c79ef648ab6d74016e6841e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6ad95a6e0d73e5a516a3e4c10c2703b8

SHA1
fc24f28cd882bdebcbe060b865676af7fa08cfe9

SHA256
50f94596ec5a735e772694a243209873c102897f6bef0e56eb3a397319d3edac

SHA512
9ea882fb265bb472c295b20ac9f63d83b6b3628ec65f78c8675aa22f722980ab60293cca9e5fefda7c8eca0c8a6adf8039a3800db97f640a33da0eeea1d02c03

Download Submit