a1b6c03555d2352d129502ce806fe357732d39bcb87075daef03254b6adfbddb

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09-09-2024 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6c416260f648771613fc9707b209e4a_JaffaCakes118.html
Size

30KB
MD5

d6c416260f648771613fc9707b209e4a
SHA1

1b2c9effc215bc0d70bf8072f720a97485b74d18
SHA256

a1b6c03555d2352d129502ce806fe357732d39bcb87075daef03254b6adfbddb
SHA512

c2c153342d131c69be04e2ab63c9bb087a637c105af0beb721386ef4e2b9fb1bbd1ec470034735d6d1046fdcf78f3721fea048d48a2e7472673283561e3ce03e
SSDEEP

768:ST3EjIMfmp102xRq0r1qXO22RxO22awgz6pIe7/X/hDQtr:ST3EjIMfmp10SRq0r1qXO22RxO22awgh

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3912	msedge.exe
3912	msedge.exe
1772	msedge.exe
1772	msedge.exe
556	identity_helper.exe
556	identity_helper.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 4412	1772	msedge.exe	85
PID 1772 wrote to memory of 4412	1772	msedge.exe	85
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 1496	1772	msedge.exe	86
PID 1772 wrote to memory of 3912	1772	msedge.exe	87
PID 1772 wrote to memory of 3912	1772	msedge.exe	87
PID 1772 wrote to memory of 2688	1772	msedge.exe	88
PID 1772 wrote to memory of 2688	1772	msedge.exe	88
PID 1772 wrote to memory of 2688	1772	msedge.exe	88
PID 1772 wrote to memory of 2688	1772	msedge.exe	88
PID 1772 wrote to memory of 2688	1772	msedge.exe	88
PID 1772 wrote to memory of 2688	1772	msedge.exe	88
PID 1772 wrote to memory of 2688	1772	msedge.exe	88
PID 1772 wrote to memory of 2688	1772	msedge.exe	88
PID 1772 wrote to memory of 2688	1772	msedge.exe	88
PID 1772 wrote to memory of 2688	1772	msedge.exe	88
PID 1772 wrote to memory of 2688	1772	msedge.exe	88
PID 1772 wrote to memory of 2688	1772	msedge.exe	88
PID 1772 wrote to memory of 2688	1772	msedge.exe	88
PID 1772 wrote to memory of 2688	1772	msedge.exe	88
PID 1772 wrote to memory of 2688	1772	msedge.exe	88
PID 1772 wrote to memory of 2688	1772	msedge.exe	88
PID 1772 wrote to memory of 2688	1772	msedge.exe	88
PID 1772 wrote to memory of 2688	1772	msedge.exe	88
PID 1772 wrote to memory of 2688	1772	msedge.exe	88
PID 1772 wrote to memory of 2688	1772	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d6c416260f648771613fc9707b209e4a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82b2d46f8,0x7ff82b2d4708,0x7ff82b2d4718
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,141060473474657294,11020248950681741450,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,141060473474657294,11020248950681741450,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,141060473474657294,11020248950681741450,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,141060473474657294,11020248950681741450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,141060473474657294,11020248950681741450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,141060473474657294,11020248950681741450,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,141060473474657294,11020248950681741450,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,141060473474657294,11020248950681741450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,141060473474657294,11020248950681741450,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,141060473474657294,11020248950681741450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,141060473474657294,11020248950681741450,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,141060473474657294,11020248950681741450,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5576 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fe205db5e096437333edfe586c51377b

SHA1
94aa8438ce77f44e83000516246c4df51bd645bf

SHA256
3ba165bef97ac43bba0b2f7d281ab756f1e6e2b4aa50b976a2c2ca3e0f00431c

SHA512
68ee9e25cf02db686c544b73ba9a7aab4f01e8ce7c1c41397842718e86093c3bed335fa8a17b73f34878f47acc2bbc78bff81544839d1729ddf23db552f90677

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
17b65657e8d60184e73cfae6d09b91c3

SHA1
7f1cd7a19dd055bbb05d388f57db27feea9e2e65

SHA256
9bf78c87c064c10e0afdbacda5566e1c97144afefbcc4e8edb5d96711cdf065b

SHA512
8845e2d5cc5f3e15de93985c5ab1ff9c78376440b2284c3829ba97ee85261f8f6d4066d52edc0629aa2ce5b8ca0f7598f7b5116b879ac455e894ce7353baa2a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1d3790b2ad983b903b2e72610779ebf5

SHA1
39512bad3fd3529d6b612584905f19b8392965b4

SHA256
66eb9e3797f3cdfdc5896232bbd7325d951d25c7da84d687701e0d7b0526961e

SHA512
17e4010a5ff27dda5f85689efd231c2e0ac62c09bcf18839223eb2703a9c20dce26bdb92397c4be75cda684636adce9697c2bd7dd7790508433f1d732f5b166a

Download Submit