784cffed66ef74cca8fd081a09ee9d2014bf037a93d4d0c6a6bd5d0205915478

Analysis

max time kernel
146s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6e393c0b89f73fb4222418c32d8765d_JaffaCakes118.html
Size

467KB
MD5

d6e393c0b89f73fb4222418c32d8765d
SHA1

ebd5fa621fb342e1bc90f9aa8b0a90ec185dc585
SHA256

784cffed66ef74cca8fd081a09ee9d2014bf037a93d4d0c6a6bd5d0205915478
SHA512

84855934f4606478eff96f2a4a76ae0be7fe8fe814dd35535c02f4f2696380559aa29e332b2527fa691179842c431e7df2bdbdb5cb41e818cb9566ddfa0cbcfc
SSDEEP

6144:SxsMYod+X3oI+Y6tvu6xAmzM86P5sZpMFzBtug4r1GcFBU/b:A5d+X3poCPuzmrugwG2qz

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
4132	msedge.exe
4132	msedge.exe
4768	identity_helper.exe
4768	identity_helper.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 1380	4132	msedge.exe	84
PID 4132 wrote to memory of 1380	4132	msedge.exe	84
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3512	4132	msedge.exe	85
PID 4132 wrote to memory of 3980	4132	msedge.exe	86
PID 4132 wrote to memory of 3980	4132	msedge.exe	86
PID 4132 wrote to memory of 2528	4132	msedge.exe	87
PID 4132 wrote to memory of 2528	4132	msedge.exe	87
PID 4132 wrote to memory of 2528	4132	msedge.exe	87
PID 4132 wrote to memory of 2528	4132	msedge.exe	87
PID 4132 wrote to memory of 2528	4132	msedge.exe	87
PID 4132 wrote to memory of 2528	4132	msedge.exe	87
PID 4132 wrote to memory of 2528	4132	msedge.exe	87
PID 4132 wrote to memory of 2528	4132	msedge.exe	87
PID 4132 wrote to memory of 2528	4132	msedge.exe	87
PID 4132 wrote to memory of 2528	4132	msedge.exe	87
PID 4132 wrote to memory of 2528	4132	msedge.exe	87
PID 4132 wrote to memory of 2528	4132	msedge.exe	87
PID 4132 wrote to memory of 2528	4132	msedge.exe	87
PID 4132 wrote to memory of 2528	4132	msedge.exe	87
PID 4132 wrote to memory of 2528	4132	msedge.exe	87
PID 4132 wrote to memory of 2528	4132	msedge.exe	87
PID 4132 wrote to memory of 2528	4132	msedge.exe	87
PID 4132 wrote to memory of 2528	4132	msedge.exe	87
PID 4132 wrote to memory of 2528	4132	msedge.exe	87
PID 4132 wrote to memory of 2528	4132	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d6e393c0b89f73fb4222418c32d8765d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f57d46f8,0x7ff9f57d4708,0x7ff9f57d4718
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,12261159091955979400,3896019645216391639,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,12261159091955979400,3896019645216391639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,12261159091955979400,3896019645216391639,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,12261159091955979400,3896019645216391639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,12261159091955979400,3896019645216391639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,12261159091955979400,3896019645216391639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,12261159091955979400,3896019645216391639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,12261159091955979400,3896019645216391639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,12261159091955979400,3896019645216391639,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,12261159091955979400,3896019645216391639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,12261159091955979400,3896019645216391639,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3048 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,12261159091955979400,3896019645216391639,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
93c223ee069359c1d8dcac7e0450ca88

SHA1
67289c51293e5a0981a53e9826d4a0c8e6cb30b6

SHA256
2cfa68513f05d7e70b213c08813d8e296210c9902d0b12c55f3332755e70eec1

SHA512
ba33a033a0a0a2dd17369f60f6e4142b8e7537bb196e09c23b96e352dd9a044da69bc40fc5b57a7a3881d1ae35394ef41cc9ae624ea49abe7fb3ad80d72182d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c3bed55c97af890c072f0d9ff160df9a

SHA1
3740b532d8960f413ef4c188d1e85b33fb0b3732

SHA256
aaf80fbca55c98e46fca7f5a3769d6aab1e0ab8392a9c07bddd6a52d4fef48b7

SHA512
091350ef26d3d0cdc0762c752f1a00e8b9b439784e85d6ba8c0e0aad85f09d1f59c0a25e48cc2fa0b8b6b631881a010f87c8bda7b919f6253ff2fa82293ea79d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4e64be6609989946cfb8f13ebd76e4c2

SHA1
36a31b5b6cf2137e33351973d4293dc6c06f3671

SHA256
96e54161bd7dc288895da8054865026880c70934f8ee125bd72e5060e2fa518c

SHA512
5d65fdf628ae261e5681641cc01377f6354578ecd41f1e1e7264113e00dca63d36dd74e55f19b077670490fe6b1e82497a887576554e3847bb459e486d9a7cc7

Download Submit