d3409191ad318435bd6cb604bc11fc13a76c430031c6350baac7efda4f9fb7f9

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 13:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

de55e95f760a60d3494bd212283584bb_JaffaCakes118.html
Size

45KB
MD5

de55e95f760a60d3494bd212283584bb
SHA1

d44be0ab373ba0f123d6dadd09b62f22580d1a78
SHA256

d3409191ad318435bd6cb604bc11fc13a76c430031c6350baac7efda4f9fb7f9
SHA512

ea9ad0e6f3b787c21ee329b649124307878d15f5dd476f3762aba7ffa4a428cdebe1b1917ec3a2870745ea392267c1fd6fd6a13731a2b7a99f1380c96b698427
SSDEEP

768:SGKM+BvLIACkCQCuCPCSCaChCNCf3xmSxFcBqBS3cwQOMvx6JaE/00z/QEAJmb3p:SGKM+BvZLxd2DNuK43xmSxFcBqBGcwhz

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1508	msedge.exe
1508	msedge.exe
4720	msedge.exe
4720	msedge.exe
3200	identity_helper.exe
3200	identity_helper.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 2820	4720	msedge.exe	83
PID 4720 wrote to memory of 2820	4720	msedge.exe	83
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 3536	4720	msedge.exe	84
PID 4720 wrote to memory of 1508	4720	msedge.exe	85
PID 4720 wrote to memory of 1508	4720	msedge.exe	85
PID 4720 wrote to memory of 4928	4720	msedge.exe	86
PID 4720 wrote to memory of 4928	4720	msedge.exe	86
PID 4720 wrote to memory of 4928	4720	msedge.exe	86
PID 4720 wrote to memory of 4928	4720	msedge.exe	86
PID 4720 wrote to memory of 4928	4720	msedge.exe	86
PID 4720 wrote to memory of 4928	4720	msedge.exe	86
PID 4720 wrote to memory of 4928	4720	msedge.exe	86
PID 4720 wrote to memory of 4928	4720	msedge.exe	86
PID 4720 wrote to memory of 4928	4720	msedge.exe	86
PID 4720 wrote to memory of 4928	4720	msedge.exe	86
PID 4720 wrote to memory of 4928	4720	msedge.exe	86
PID 4720 wrote to memory of 4928	4720	msedge.exe	86
PID 4720 wrote to memory of 4928	4720	msedge.exe	86
PID 4720 wrote to memory of 4928	4720	msedge.exe	86
PID 4720 wrote to memory of 4928	4720	msedge.exe	86
PID 4720 wrote to memory of 4928	4720	msedge.exe	86
PID 4720 wrote to memory of 4928	4720	msedge.exe	86
PID 4720 wrote to memory of 4928	4720	msedge.exe	86
PID 4720 wrote to memory of 4928	4720	msedge.exe	86
PID 4720 wrote to memory of 4928	4720	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\de55e95f760a60d3494bd212283584bb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe746446f8,0x7ffe74644708,0x7ffe74644718
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,1204305411697760581,14080169260855583595,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,1204305411697760581,14080169260855583595,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,1204305411697760581,14080169260855583595,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1204305411697760581,14080169260855583595,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1204305411697760581,14080169260855583595,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,1204305411697760581,14080169260855583595,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,1204305411697760581,14080169260855583595,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1204305411697760581,14080169260855583595,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1204305411697760581,14080169260855583595,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1204305411697760581,14080169260855583595,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1204305411697760581,14080169260855583595,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,1204305411697760581,14080169260855583595,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
309B

MD5
e72f072f2e244575b5b60df88632eebd

SHA1
8d50d0a16539a658a3848065531b36e3634a3f34

SHA256
c484a17504a58e56dadfb1f869a7763ede542d4a20ab177853b44e03830f3644

SHA512
a13388800d05025ffe313abf0b7f0594678daf3584df8eb6a4665141a4d16d577ec50f7034eec6644d199a3537cb51f034e5b5e4ca8392ec5014275be2f1e133

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a5e513a9bd53db7982f31168611ed7fc

SHA1
b6e77df00f35cf96d93d80fd7a6efbc05d0bb427

SHA256
725029666312b2da4575708f825235742d5d05f28541abaa1583af10c9d8348f

SHA512
a8a04d083ea5cf95aafed77a1c78e02b388ac01c08e19570cd4fba11966df7dfbce05611669d8cadac6a32e1ba0af2310881e25e44abc3bc5b5a4435c5394bee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0b494e236ef8787154c21fdd6e901167

SHA1
caa79fe92d43b53407b8e74095a49e5929bc59d7

SHA256
859566f10d1fab8c4cda073818d781d5104499a6e3bbb791c476dee171f00f89

SHA512
ce3e579127bb304bed83eec95789de36a9e2da7b44562ef0160febaf9cfa82a82ec31999b4d2876a5fd7b7ad4a59f6ae95f9105b9979e8fe9ffe9c07d6944e28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b312c3ec8181990261e01952f166b0f8

SHA1
811b76f545805d42b8c4b1fe1b928b9be27caf2b

SHA256
c795101df9a561f6c1006f62004c1cecdefe06057f74cb8f1782670d6381b66f

SHA512
902936e79b36069627330ee113a500a2eccb4f18043d096ed5dc24ce90849161ddb02321352d697e4767362a63c840609392193201d1d46366c610731ee9d940

Download Submit