9ad3e4995094863c84336b5edd83559a09ef900f134c04eb5c4b9e32d7b35e13

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 03:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dbc18c08c845a720bf50440b2644ecb8_JaffaCakes118.html
Size

172KB
MD5

dbc18c08c845a720bf50440b2644ecb8
SHA1

c7488223a0bdaff017363e13fd63bb8ceceaeb3a
SHA256

9ad3e4995094863c84336b5edd83559a09ef900f134c04eb5c4b9e32d7b35e13
SHA512

283a871ac367f823641c76908e0629fe2bf90e6d70944f56ac7aa2ee3dfc8e3626effca55217bb4e7d3e46ec2bbba8f5113521ac3b68f475eb9ef32d686ba508
SSDEEP

3072:SoLJVCTNt2G4EKew4X6hjM8b7t+EIjYAPs5oAREh2i5WgfHyBBlnlnI3lyfkMY+V:S03CTNt2G4EKew4X6hjM8b7t+EIjYys1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
744	msedge.exe
744	msedge.exe
2172	msedge.exe
2172	msedge.exe
820	identity_helper.exe
820	identity_helper.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 4816	2172	msedge.exe	83
PID 2172 wrote to memory of 4816	2172	msedge.exe	83
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 2428	2172	msedge.exe	84
PID 2172 wrote to memory of 744	2172	msedge.exe	85
PID 2172 wrote to memory of 744	2172	msedge.exe	85
PID 2172 wrote to memory of 2752	2172	msedge.exe	86
PID 2172 wrote to memory of 2752	2172	msedge.exe	86
PID 2172 wrote to memory of 2752	2172	msedge.exe	86
PID 2172 wrote to memory of 2752	2172	msedge.exe	86
PID 2172 wrote to memory of 2752	2172	msedge.exe	86
PID 2172 wrote to memory of 2752	2172	msedge.exe	86
PID 2172 wrote to memory of 2752	2172	msedge.exe	86
PID 2172 wrote to memory of 2752	2172	msedge.exe	86
PID 2172 wrote to memory of 2752	2172	msedge.exe	86
PID 2172 wrote to memory of 2752	2172	msedge.exe	86
PID 2172 wrote to memory of 2752	2172	msedge.exe	86
PID 2172 wrote to memory of 2752	2172	msedge.exe	86
PID 2172 wrote to memory of 2752	2172	msedge.exe	86
PID 2172 wrote to memory of 2752	2172	msedge.exe	86
PID 2172 wrote to memory of 2752	2172	msedge.exe	86
PID 2172 wrote to memory of 2752	2172	msedge.exe	86
PID 2172 wrote to memory of 2752	2172	msedge.exe	86
PID 2172 wrote to memory of 2752	2172	msedge.exe	86
PID 2172 wrote to memory of 2752	2172	msedge.exe	86
PID 2172 wrote to memory of 2752	2172	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dbc18c08c845a720bf50440b2644ecb8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a90f46f8,0x7ff9a90f4708,0x7ff9a90f4718
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,18183834859870807977,1130451688661966885,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,18183834859870807977,1130451688661966885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,18183834859870807977,1130451688661966885,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,18183834859870807977,1130451688661966885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,18183834859870807977,1130451688661966885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,18183834859870807977,1130451688661966885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,18183834859870807977,1130451688661966885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,18183834859870807977,1130451688661966885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,18183834859870807977,1130451688661966885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,18183834859870807977,1130451688661966885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,18183834859870807977,1130451688661966885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,18183834859870807977,1130451688661966885,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5324 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b924f5fa71fce707f14e1fe01de39d0f

SHA1
63082b7f085942fa04c00c13e7533ce884b1b326

SHA256
9c26bf8bc14196aefccc05b9a1eb92382280843b0c580f53a05b13a09b8c1981

SHA512
2a2ff1a3464947a541d5548affc97b4a44f0e49ee6d76cc3bd8691be1c78f4e6f9371d57b09c7ac538f350e9c24f5954a8445f0bda5bb6a4356adfdffc06ddfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bdad0c790a566cde95e34761b5e92f05

SHA1
11f92f5939928e7c291f6bd3c151ceef4c105820

SHA256
af90cfbcec225b0cb3baf8f60e535449aaf53cd569ba7c6add3e2a3f1ab40656

SHA512
1bb9afdb3040f2611a4cd73d920276540f9e6b0326da9de61d0e46d6b1a4847fe3ead209fe669c3f3ea2fa0c1756fe249ab0bbb3476fd92eb870c6a4b9a067fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8174f73980eaff66ecd1887f143fc8ee

SHA1
82feafc25efcdb4cc6d01510c1e7c9b630896279

SHA256
b402bc49ad22bd9c17038b8336643a4fb8e8519f14e6fb10511e7c58ab23f794

SHA512
d83334dc93be1f18e3e9470060a1afb2be4b1bb3afff85d6cdec6dca8d520b1b1f402ddbbd5988c8f16c2429da8cdb1144d63468386a6c58980fab39a61fcde0

Download Submit