f078b3464451c0ca3e6bb2215ec8ba1194af30df089b08caab5787ddaa011d59

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 14:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6875c3f06299b25cb783feeb8b9b90e_JaffaCakes118.html
Size

15KB
MD5

d6875c3f06299b25cb783feeb8b9b90e
SHA1

1095978aa6088ec0ea1d7151e7c51748e4aea9ab
SHA256

f078b3464451c0ca3e6bb2215ec8ba1194af30df089b08caab5787ddaa011d59
SHA512

316ae2d16ce0e462ecae43052370a1e38e331c5dbac4340532072e830944c1a8f588db249e5b670f6ee5cd69c1f2c83bc38f8a29747b578ee3e94f7ff5deafa4
SSDEEP

384:/zr6mqf6EOYvIxBknV1J7IbXERXQPCDNwFLB:buzhA4V/7IrCAPCDNwFLB

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2684	msedge.exe
2684	msedge.exe
1348	msedge.exe
1348	msedge.exe
2976	identity_helper.exe
2976	identity_helper.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe
1348	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 3764	1348	msedge.exe	83
PID 1348 wrote to memory of 3764	1348	msedge.exe	83
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 1708	1348	msedge.exe	84
PID 1348 wrote to memory of 2684	1348	msedge.exe	85
PID 1348 wrote to memory of 2684	1348	msedge.exe	85
PID 1348 wrote to memory of 2940	1348	msedge.exe	86
PID 1348 wrote to memory of 2940	1348	msedge.exe	86
PID 1348 wrote to memory of 2940	1348	msedge.exe	86
PID 1348 wrote to memory of 2940	1348	msedge.exe	86
PID 1348 wrote to memory of 2940	1348	msedge.exe	86
PID 1348 wrote to memory of 2940	1348	msedge.exe	86
PID 1348 wrote to memory of 2940	1348	msedge.exe	86
PID 1348 wrote to memory of 2940	1348	msedge.exe	86
PID 1348 wrote to memory of 2940	1348	msedge.exe	86
PID 1348 wrote to memory of 2940	1348	msedge.exe	86
PID 1348 wrote to memory of 2940	1348	msedge.exe	86
PID 1348 wrote to memory of 2940	1348	msedge.exe	86
PID 1348 wrote to memory of 2940	1348	msedge.exe	86
PID 1348 wrote to memory of 2940	1348	msedge.exe	86
PID 1348 wrote to memory of 2940	1348	msedge.exe	86
PID 1348 wrote to memory of 2940	1348	msedge.exe	86
PID 1348 wrote to memory of 2940	1348	msedge.exe	86
PID 1348 wrote to memory of 2940	1348	msedge.exe	86
PID 1348 wrote to memory of 2940	1348	msedge.exe	86
PID 1348 wrote to memory of 2940	1348	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d6875c3f06299b25cb783feeb8b9b90e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc77046f8,0x7fffc7704708,0x7fffc7704718
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,6706175068077385799,10783759634060345150,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,6706175068077385799,10783759634060345150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,6706175068077385799,10783759634060345150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6706175068077385799,10783759634060345150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6706175068077385799,10783759634060345150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,6706175068077385799,10783759634060345150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,6706175068077385799,10783759634060345150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6706175068077385799,10783759634060345150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6706175068077385799,10783759634060345150,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6706175068077385799,10783759634060345150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6706175068077385799,10783759634060345150,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,6706175068077385799,10783759634060345150,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4796 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
12b62bc7e0923c57aa07c22030f4bde0

SHA1
4ef4cff52cf4b2adfd4569c16c3208ade3d8e2a6

SHA256
a469a9e5d76eff72322a329c76685af9bc279f0dcea09ee175caab064ce7057e

SHA512
4104afe59ebc96f53d2b004299a66d1b3c3c5c81b4e3a8ef398af15b2345af8dd9ef5d477f16da06fa59ecc189d372266b24b8699489f8a681dfa1721f86a3ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6e6fa28976476d4bdfd27b58abe1d2fa

SHA1
298df84caa50ef48b181dcad6a65edd6ea43124c

SHA256
30d0082a878826b780b5190113e5545a87ebe442c2aca688be6f35e3c7a781c6

SHA512
e7c053688be1ba6279a21f1d14fb9c035cd24bb1a1f003801ee79474af6dd6fee584cb746fc914c66506a61cbad0bd1f22c2bd29888f349c19dbadd3fc0c9e5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0b1a9e6be8d7dda99d22fb8de76cec2f

SHA1
f2e317a5d53b2c2d2ca546268b64ae77e47754d5

SHA256
f787b5701b933d9a31104d19eec60f850d6493aa4bf5d650beeed4c464a32c73

SHA512
427c36b8ccfee502c9fec2a5278d28eab41a88a6e3a1e1a9c18a872e5a1912aab19957ed9409789904a88fe656d4e757a061f69d7ad7d3eb953d6dd325619c5b

Download Submit