1613ce964fab218b1236709d58ba548f91949ac9870d4e35cf6aef6686f885c9

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09-09-2024 01:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5729957e4042b28859a26ba208b1919_JaffaCakes118.html
Size

9KB
MD5

d5729957e4042b28859a26ba208b1919
SHA1

d8f6847aa484c3930773905dfb9a8e64b5809e8c
SHA256

1613ce964fab218b1236709d58ba548f91949ac9870d4e35cf6aef6686f885c9
SHA512

b894c09f0da36b26078035868479d51f711791b221aac847fbfcb1d07d1128acccaffcc67cf84bae59dc95d13ae121f3ae9b78110de9092679336d1c2424f542
SSDEEP

96:uzVs+ux74OLLY1k9o84d12ef7CSTUzGT/kd6pNQlVHcEZ7ru7f:csz74OAYS/mONQPHb76f

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1388	msedge.exe
1388	msedge.exe
3200	msedge.exe
3200	msedge.exe
4240	identity_helper.exe
4240	identity_helper.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 2988	3200	msedge.exe	86
PID 3200 wrote to memory of 2988	3200	msedge.exe	86
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 3500	3200	msedge.exe	87
PID 3200 wrote to memory of 1388	3200	msedge.exe	88
PID 3200 wrote to memory of 1388	3200	msedge.exe	88
PID 3200 wrote to memory of 2896	3200	msedge.exe	89
PID 3200 wrote to memory of 2896	3200	msedge.exe	89
PID 3200 wrote to memory of 2896	3200	msedge.exe	89
PID 3200 wrote to memory of 2896	3200	msedge.exe	89
PID 3200 wrote to memory of 2896	3200	msedge.exe	89
PID 3200 wrote to memory of 2896	3200	msedge.exe	89
PID 3200 wrote to memory of 2896	3200	msedge.exe	89
PID 3200 wrote to memory of 2896	3200	msedge.exe	89
PID 3200 wrote to memory of 2896	3200	msedge.exe	89
PID 3200 wrote to memory of 2896	3200	msedge.exe	89
PID 3200 wrote to memory of 2896	3200	msedge.exe	89
PID 3200 wrote to memory of 2896	3200	msedge.exe	89
PID 3200 wrote to memory of 2896	3200	msedge.exe	89
PID 3200 wrote to memory of 2896	3200	msedge.exe	89
PID 3200 wrote to memory of 2896	3200	msedge.exe	89
PID 3200 wrote to memory of 2896	3200	msedge.exe	89
PID 3200 wrote to memory of 2896	3200	msedge.exe	89
PID 3200 wrote to memory of 2896	3200	msedge.exe	89
PID 3200 wrote to memory of 2896	3200	msedge.exe	89
PID 3200 wrote to memory of 2896	3200	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d5729957e4042b28859a26ba208b1919_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe5ba46f8,0x7ffbe5ba4708,0x7ffbe5ba4718
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,14797672261476319304,14066416070890742348,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,14797672261476319304,14066416070890742348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,14797672261476319304,14066416070890742348,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14797672261476319304,14066416070890742348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14797672261476319304,14066416070890742348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,14797672261476319304,14066416070890742348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,14797672261476319304,14066416070890742348,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14797672261476319304,14066416070890742348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14797672261476319304,14066416070890742348,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14797672261476319304,14066416070890742348,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14797672261476319304,14066416070890742348,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,14797672261476319304,14066416070890742348,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3008 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
709c6f4a32b317f6487b598788b6353d

SHA1
50f44d43be9630018f0bd2acb1528df07cd05b7f

SHA256
353aff71e8cf078c88c836e66d86be266ddbe36496a597b9b5a5a87d21eae83b

SHA512
4f33792eb73a792c88e8e2dc8bef7b00a2af7b1b91f4bab0cd5076dd2cb9abbb752eb7e60a4c6204d15f9bca1562915f2468b94e5f01f79279e1e7469055f0a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ebc024cdb324eb41f33c6ec63d1458d

SHA1
f623e96981ee63c1b6879f682c4364fd5c2265e5

SHA256
23b9bd7316816043f42a80784e7f247f3afebd3dbe370fbc702189a6a0dddb1f

SHA512
6971b6430bc01a36c48bc1e41cf8c4bed65a2890837f7778a896072159940ae739d11834176cc7be6cf6fa0f2ea9e6764c30cd23beadcc88c390e5573bbad097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f0718b0308ce800bf8c2f99798d0f964

SHA1
44a1069f80fadb33f88f110064e35569082c9393

SHA256
63141bfa1a2fa0e8b7f8961c298292360e5b6d7ffe7bdeb3d785d9e18b92eebc

SHA512
891021550b7adf10cc87e3ccf991cfb17673a775afe264352a73d53300be3ca2e7e0f18c3419ea80d922dc7d7dfee41d2d305a25cad7ed0d6ec60a58ccee5f72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5dcf670dd0d9d313acfe469aa48f5646

SHA1
5ba1c74136cb9e546f5541ca04c98f254c5808fb

SHA256
092e285122cb0c8993a488ae451031dc897d8fdb3d3865a79f4a13567d8e43a8

SHA512
fb87b982dfc8f9b66e5adfda6194bf50c51fd47f8dabbb2cba5a84fa4d40d5f8694dab1f812c6345080bf318fbd28ed395ba07c1c8c7a256a58781698a735d76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
5KB

MD5
d9c8e36629d89e856c488d9ab67f84bf

SHA1
84c28e9fd459559fa41f73a5bdf9dd7d2d9f42d9

SHA256
1cefe36d7b8b061c7d6ea6542f83aecf715da2646eccc57889ae81bb217b642a

SHA512
034f0064d661156c85655d4e2e781d4d8d1a2f8348f3fda54446f7244031c3a57e17ebdbd8d210780adccb173694f3c16abbb3644562f15e1644b0eb46b574ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
b7eb577b329ce3619c960c1881daa310

SHA1
19a2e3947f30197e840150adecec1ad144dd92e5

SHA256
b8a2ed31e757a173a7a53dd2dad24638085001255b27fa321149ebbdb94bcf81

SHA512
e78995159da9d6e86227c311d6b128840bd41da6a9c61df8803a356b8be839d7caca08aa5d8d5b4d5a04afab97691d869bf19b1dfc86f9a589d29accf4d0dafd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
0bdb2d5a24309fa5b9b1879493fb6e34

SHA1
ebd2cee9c2b968394b8b5f014c50303a102b4e18

SHA256
35b08baa8d172b8bca7d4ffc60ea5454001f0dfecdc56a4648a03d05a7a17a68

SHA512
835cebbe6cfeb7b56c529de0640f807be59eb69ea12a549412cde0938fcd36d546ea64ce00796b8f841cd2456d8a155167c6c25da56d2ca9bfdad50b0d83d087

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
1ca8054eb8e37bdcbd3119fb1823b42f

SHA1
dce56681605eb58bac918d196cb8293bb8654b5f

SHA256
303722700c100f141cd3cc024578107404c6cd9ff0ddd20c8e53d49fc29c03eb

SHA512
e0d30219eb4fa17156e84902be605af8fa954bbedec29dded6852bf41a32b28f5d1f2a6291a78f1a952c963b13c0b4ca48c93282fd635516539896a900712208

Download Submit