d5d9d694b88cc49babe728208bcd366598b4bbf5247e3030494d2bd67f5c93c8

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 02:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd7f2dd1d81db0b24300861865a825d8_JaffaCakes118.html
Size

40KB
MD5

dd7f2dd1d81db0b24300861865a825d8
SHA1

0837d409f4e4a7a0f235aaeed8d637a45e99f3d4
SHA256

d5d9d694b88cc49babe728208bcd366598b4bbf5247e3030494d2bd67f5c93c8
SHA512

71200a3af50308385e1cb4c43957a2e90de3acb20c81da5bb101a00cc5494651cbf73752d47868e149328a4de3993e4d5a98e5107ab0110e25ec05224acd2170
SSDEEP

768:TLen8TC2v3gEPyTY++pnO/vxLG8+ndC3XRwX1mAi+TeHHv7yZ4dNlTeSWiDsUg1w:Tan8TC2vRm+pnO/vxLG8KdmXRymP+iHZ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2772	msedge.exe
2772	msedge.exe
1528	msedge.exe
1528	msedge.exe
3648	identity_helper.exe
3648	identity_helper.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 4548	1528	msedge.exe	83
PID 1528 wrote to memory of 4548	1528	msedge.exe	83
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 636	1528	msedge.exe	84
PID 1528 wrote to memory of 2772	1528	msedge.exe	85
PID 1528 wrote to memory of 2772	1528	msedge.exe	85
PID 1528 wrote to memory of 2292	1528	msedge.exe	86
PID 1528 wrote to memory of 2292	1528	msedge.exe	86
PID 1528 wrote to memory of 2292	1528	msedge.exe	86
PID 1528 wrote to memory of 2292	1528	msedge.exe	86
PID 1528 wrote to memory of 2292	1528	msedge.exe	86
PID 1528 wrote to memory of 2292	1528	msedge.exe	86
PID 1528 wrote to memory of 2292	1528	msedge.exe	86
PID 1528 wrote to memory of 2292	1528	msedge.exe	86
PID 1528 wrote to memory of 2292	1528	msedge.exe	86
PID 1528 wrote to memory of 2292	1528	msedge.exe	86
PID 1528 wrote to memory of 2292	1528	msedge.exe	86
PID 1528 wrote to memory of 2292	1528	msedge.exe	86
PID 1528 wrote to memory of 2292	1528	msedge.exe	86
PID 1528 wrote to memory of 2292	1528	msedge.exe	86
PID 1528 wrote to memory of 2292	1528	msedge.exe	86
PID 1528 wrote to memory of 2292	1528	msedge.exe	86
PID 1528 wrote to memory of 2292	1528	msedge.exe	86
PID 1528 wrote to memory of 2292	1528	msedge.exe	86
PID 1528 wrote to memory of 2292	1528	msedge.exe	86
PID 1528 wrote to memory of 2292	1528	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dd7f2dd1d81db0b24300861865a825d8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcc5046f8,0x7ffdcc504708,0x7ffdcc504718
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2288,5996061394596338681,10550543930196182798,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2288,5996061394596338681,10550543930196182798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2288,5996061394596338681,10550543930196182798,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,5996061394596338681,10550543930196182798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,5996061394596338681,10550543930196182798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,5996061394596338681,10550543930196182798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,5996061394596338681,10550543930196182798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2288,5996061394596338681,10550543930196182798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3372 /prefetch:8
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2288,5996061394596338681,10550543930196182798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,5996061394596338681,10550543930196182798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,5996061394596338681,10550543930196182798,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,5996061394596338681,10550543930196182798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,5996061394596338681,10550543930196182798,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2288,5996061394596338681,10550543930196182798,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2936 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
c7030a1968d0a86de4ceabbfb5e86aa4

SHA1
fd4b90544206846b4628df19be034511fe1973ab

SHA256
de304c9cc2f2f401d5febc9378617d283ade1736e42e02b70d4d3c4a0958aaee

SHA512
ecc0889bf2f22f45e3fd5ceafd89859d7030e0761a72d9db89ca572381247d161131049b2afdc25a984d37b9e5fa2b87c6c81920437d1e4280ff4a8b5a958f03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
335B

MD5
e859366f01d3d5e62da61322ef123bad

SHA1
ca70dc37f5eda3b9c5320349533e0d34cdb4e2e6

SHA256
e4aa775cc9ed620a225c6ed1b51f382cf01eef6cc93efa6cabaf722c9b37109d

SHA512
4596d2f411a7e139293a84dcb1b24701b749a6afef38898688ec0d227d18a368674abd38094b415b3d30fa7da07bad6bb1678d063072cc9adf9cc8ed941177f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
55d6d4284d8e5f54ea313f1109a0209d

SHA1
ff2910583c4593d7461cefdecbda5a3e7001406c

SHA256
fd766b53d3102b73bfbe19b0cda974b3a7e3685262acf3b4333e3d04d8b41a99

SHA512
20bd11364b4a4fc26d3133c599f49b0a8267aa65f6ae4088f39e9b98821cbd30eea0bfa565cbc2c2adb6e5a847fc8ce95461e1a8cfa56e72204b5998b7a88930

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
877460b711f46fda1bdda6a96efb5055

SHA1
52736155c4a9060c279645ad6d457dca9037cc89

SHA256
7ca21ee0ccce1f462930f0a1d89fbf3de265ee5aee401fd67d14b56c2d0f76e3

SHA512
2c48056a8bb6cac939bf03a7ec68b894b785078386933e43895a666fefcf48ff2ade54c1dd6d58ef1cc1c90534f64fb48ea19b1e1e8e7e30e4333180467f1e18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a79d83b564b697266e753948d4176cf7

SHA1
c75ff0d0b3f971d3ed17010b973375391ddf9acc

SHA256
6728f457aef2c87d319cd0c78c5336d3036209e24181f53c79f81c8e97f471d7

SHA512
56bd08a922e782275a900c32c57e7b046c24b42d6362a5b1823a1e856ddc54a4083c138bfb4e009bb998160562bc97be4ffbfe152c7f440e479dda19be761137

Download Submit