620994056deeb132eb791c74b9f51b05886420210a1f4ed48e52641c62b5b98a

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 21:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd1348e0d73b038cb646215a0e2c38b5_JaffaCakes118.html
Size

35KB
MD5

dd1348e0d73b038cb646215a0e2c38b5
SHA1

1c1a09231d697aa60c2ab74b642be86d07e6764e
SHA256

620994056deeb132eb791c74b9f51b05886420210a1f4ed48e52641c62b5b98a
SHA512

17c917509a0bf474690bf24a4f15272e167f45592e90a8539bea115bc1f41f4a33b5ff316eba0b22cbbfcd23f720c12042b0c374cd5ef40b90d55c6c1933d544
SSDEEP

768:zwx/MDTHAa88hARQZPXvE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TIZOW6DJtxo6lLi:Q/LbJxNVWu0Sb/38zK

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2948	msedge.exe
2948	msedge.exe
3880	msedge.exe
3880	msedge.exe
4012	identity_helper.exe
4012	identity_helper.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 3140	3880	msedge.exe	83
PID 3880 wrote to memory of 3140	3880	msedge.exe	83
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 4732	3880	msedge.exe	84
PID 3880 wrote to memory of 2948	3880	msedge.exe	85
PID 3880 wrote to memory of 2948	3880	msedge.exe	85
PID 3880 wrote to memory of 3732	3880	msedge.exe	86
PID 3880 wrote to memory of 3732	3880	msedge.exe	86
PID 3880 wrote to memory of 3732	3880	msedge.exe	86
PID 3880 wrote to memory of 3732	3880	msedge.exe	86
PID 3880 wrote to memory of 3732	3880	msedge.exe	86
PID 3880 wrote to memory of 3732	3880	msedge.exe	86
PID 3880 wrote to memory of 3732	3880	msedge.exe	86
PID 3880 wrote to memory of 3732	3880	msedge.exe	86
PID 3880 wrote to memory of 3732	3880	msedge.exe	86
PID 3880 wrote to memory of 3732	3880	msedge.exe	86
PID 3880 wrote to memory of 3732	3880	msedge.exe	86
PID 3880 wrote to memory of 3732	3880	msedge.exe	86
PID 3880 wrote to memory of 3732	3880	msedge.exe	86
PID 3880 wrote to memory of 3732	3880	msedge.exe	86
PID 3880 wrote to memory of 3732	3880	msedge.exe	86
PID 3880 wrote to memory of 3732	3880	msedge.exe	86
PID 3880 wrote to memory of 3732	3880	msedge.exe	86
PID 3880 wrote to memory of 3732	3880	msedge.exe	86
PID 3880 wrote to memory of 3732	3880	msedge.exe	86
PID 3880 wrote to memory of 3732	3880	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dd1348e0d73b038cb646215a0e2c38b5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca88e46f8,0x7ffca88e4708,0x7ffca88e4718
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,4456933718592681577,4256778135474196652,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,4456933718592681577,4256778135474196652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,4456933718592681577,4256778135474196652,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,4456933718592681577,4256778135474196652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,4456933718592681577,4256778135474196652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,4456933718592681577,4256778135474196652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,4456933718592681577,4256778135474196652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,4456933718592681577,4256778135474196652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,4456933718592681577,4256778135474196652,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,4456933718592681577,4256778135474196652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,4456933718592681577,4256778135474196652,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,4456933718592681577,4256778135474196652,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3128 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
614B

MD5
93e7c1d0796b728984e8ec08a689f27a

SHA1
e399c47a27e9a294b0088b214e286538101b53c6

SHA256
5069003aa37119b44fa0e7e3572292e19955ff25f8a9c77f7fe1e5f1e51a087c

SHA512
9cb5e1d19ed0036541d84858bc647f98189a63c66d30722c45fea3a2aa48f741a92eaded3a62f375533a90422950bbc2e86c18e55dcd94343d0f35c508114eae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ed94aaaa9a385d19f33070e7485781c1

SHA1
d7916dc2824e4c07898fc0641a2a08570ac21534

SHA256
ce113a1857976445653e9531ef72cc10fd9382a3dc5b4fb14f83f7c663891c9b

SHA512
ff0eda189eb2d0bb4c5e0ff376afadd00fa5dcf6f9e935a1f8a4fd925f5a8ab4ee4e1c0a04269ac0313daf4b03421bef355673563d4ef449641f3e9623aadc34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
17be5997211e1ff1fe41f5cff8394f1b

SHA1
2687c53d84d0e1cabe94f9a3c04319aedf450e21

SHA256
5bdbc9ed2d00122fde09fd8c5c85d347b6f8c3d04e72aeef36181c5289762475

SHA512
5d03366afa41d78958045a0e17ec839ca20cb28ccda0eb37461091b252c92542b3e22f194e1d0f438c866b1864f5ddcd96e5a68d2724b62ad0b8438f0a0d11c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
72e490fca9422e84b6191758ca9a2a04

SHA1
507100dc8a8970269bde961887608f28408a8703

SHA256
b20b8d7d50f4401d4e23d908b0085e23392f6d9530cbf51f5774be9920f8c8ee

SHA512
7a2a83426fcef460eded03209a0262568fe32b23743d6f9f8447199c946bf91c027185052df19728be1916be58947bb564214e94d8d87f40c71e3dfd875afb23

Download Submit