cbd11dbe476b41101884937d0d280ff3616366a13bec60fea76163805ca7650d

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 00:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

df2dac5147a217953a52efacd0dfa99a_JaffaCakes118.html
Size

30KB
MD5

df2dac5147a217953a52efacd0dfa99a
SHA1

80fb123b65641c848ce064a6edcdb21e7a69ab73
SHA256

cbd11dbe476b41101884937d0d280ff3616366a13bec60fea76163805ca7650d
SHA512

94c6dc989ee6e0b81d6db7e17c35aad9334e792c13f90294b05135b5f4ef9e521dd2207c655748292925497dc7ae6c7b2edceeb0c8075495b83c59d30693dd83
SSDEEP

768:ivprHzCgvgUIZ+czcm5cFQ/hpXOw/dxNs:+pv/IUIZ+czcm5cFQ/hptHNs

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
1128	msedge.exe
1128	msedge.exe
5000	identity_helper.exe
5000	identity_helper.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 544	1128	msedge.exe	83
PID 1128 wrote to memory of 544	1128	msedge.exe	83
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 1108	1128	msedge.exe	84
PID 1128 wrote to memory of 4988	1128	msedge.exe	85
PID 1128 wrote to memory of 4988	1128	msedge.exe	85
PID 1128 wrote to memory of 3700	1128	msedge.exe	86
PID 1128 wrote to memory of 3700	1128	msedge.exe	86
PID 1128 wrote to memory of 3700	1128	msedge.exe	86
PID 1128 wrote to memory of 3700	1128	msedge.exe	86
PID 1128 wrote to memory of 3700	1128	msedge.exe	86
PID 1128 wrote to memory of 3700	1128	msedge.exe	86
PID 1128 wrote to memory of 3700	1128	msedge.exe	86
PID 1128 wrote to memory of 3700	1128	msedge.exe	86
PID 1128 wrote to memory of 3700	1128	msedge.exe	86
PID 1128 wrote to memory of 3700	1128	msedge.exe	86
PID 1128 wrote to memory of 3700	1128	msedge.exe	86
PID 1128 wrote to memory of 3700	1128	msedge.exe	86
PID 1128 wrote to memory of 3700	1128	msedge.exe	86
PID 1128 wrote to memory of 3700	1128	msedge.exe	86
PID 1128 wrote to memory of 3700	1128	msedge.exe	86
PID 1128 wrote to memory of 3700	1128	msedge.exe	86
PID 1128 wrote to memory of 3700	1128	msedge.exe	86
PID 1128 wrote to memory of 3700	1128	msedge.exe	86
PID 1128 wrote to memory of 3700	1128	msedge.exe	86
PID 1128 wrote to memory of 3700	1128	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\df2dac5147a217953a52efacd0dfa99a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffadbad46f8,0x7ffadbad4708,0x7ffadbad4718
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,836504530695513051,6002620483757979699,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,836504530695513051,6002620483757979699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,836504530695513051,6002620483757979699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2420 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,836504530695513051,6002620483757979699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,836504530695513051,6002620483757979699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,836504530695513051,6002620483757979699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,836504530695513051,6002620483757979699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,836504530695513051,6002620483757979699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,836504530695513051,6002620483757979699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,836504530695513051,6002620483757979699,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,836504530695513051,6002620483757979699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,836504530695513051,6002620483757979699,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2728 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,836504530695513051,6002620483757979699,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
0a7de139594c364e46f68bc71482260f

SHA1
ec89cb735ea669901a7c12279f827dbffb641eee

SHA256
6b799e2260f06227181e2168c788cff5727db3e5fe906bc9bce5638a00e64681

SHA512
891cb90a4d65b4e81b6c8cfb5b5d87d72b8c37f81fb53ca09153c2f58dbc7ab750758428bb7cb010d6817a1a70fbdef09e9e0389421a2413365bece5b2053f78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
849B

MD5
cfb5d6fb1cb9fedae355a4607649d755

SHA1
d2fd02258d2c081ceade79736a32e4b6ee07e672

SHA256
33fd29535808afebe881b29df4db07493acfa8640b10d44bba08cfe267b96096

SHA512
e7432bce2c92d92956e4f816bf9895f0ed38dbfee12222c0d6677122eed6a78fd180449567229e75c319c977e02fba16b36f42fe6f8c5e698a0f3ff54b5f0ac7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
52c64cb216f445868e4aa73d0e9f83b7

SHA1
45a8b46a069c9beee88532eca1a2d83284766ce4

SHA256
eb22d0b37ebb0514a9845f3ad9f67d952b857a4e1885560be05d4f68953ee3d6

SHA512
635f148a520ba57db70e8192b11c8f6c821446bd1d75b44c282f9bd5cc2a058f3027346be815db8065bd1ac60c920da3a5de6374df43af86168db0c48c09bfc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
484f4ae68f53ad226506b34d5919f891

SHA1
b58dff178e2df66908582a8831c09ce727c11494

SHA256
1f9534e06134d10d6819b89e9814fdc66a3cc183e4243d516ccc2b91d1b6fc9c

SHA512
538c1da60e33e75efd3805055bfee190c9dc07073a1aa77a4d4014f7f74cd7e664947a256bb2465ebd2b6b652b82b8729a3cf8ef04ee4b74f54d8d1659a16940

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a6dc9d537c575518c388102302c7083c

SHA1
2d4b1352d46119eb2a947158b17431420bb6c5f0

SHA256
02a3709eb85909cf4d7e483f2a61fdcaa882dfe25390fab47cf207196bf8882d

SHA512
70a7c148231418274fb6bc620c9783ac71077279165b478a3b742ad15f442ebddd76a45ba168d1b50429864a4d9df6ca08955d74c69618d78f5df7fff490c18c

Download Submit