a0604d77070f2bb8b8211a5a04591624af8d9c08da84058b19d808ce51010a8a

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2024 07:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dfbbc230b40e7ea1eb44b5cc7edb685a_JaffaCakes118.html
Size

23KB
MD5

dfbbc230b40e7ea1eb44b5cc7edb685a
SHA1

e6697b4afa6678eb89141857252a0642f6efe867
SHA256

a0604d77070f2bb8b8211a5a04591624af8d9c08da84058b19d808ce51010a8a
SHA512

6f252a05c3f18332e79219342a21e64734632a197ead12e1e5ba4b0260342bef24811eb0e6493248e7efdb5029b0c196761a87517944eebd73e0c05b57558e3b
SSDEEP

192:RiQoIhPJb5nGnQjLntQ/pnQie9nAnQOkrntn0nQTbnSnQfnnwJnQtMMjnFnQ7XnN:UQoQPZQ/cFK

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
1484	msedge.exe
1484	msedge.exe
2872	identity_helper.exe
2872	identity_helper.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 4348	1484	msedge.exe	85
PID 1484 wrote to memory of 4348	1484	msedge.exe	85
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 1972	1484	msedge.exe	86
PID 1484 wrote to memory of 4716	1484	msedge.exe	87
PID 1484 wrote to memory of 4716	1484	msedge.exe	87
PID 1484 wrote to memory of 1572	1484	msedge.exe	88
PID 1484 wrote to memory of 1572	1484	msedge.exe	88
PID 1484 wrote to memory of 1572	1484	msedge.exe	88
PID 1484 wrote to memory of 1572	1484	msedge.exe	88
PID 1484 wrote to memory of 1572	1484	msedge.exe	88
PID 1484 wrote to memory of 1572	1484	msedge.exe	88
PID 1484 wrote to memory of 1572	1484	msedge.exe	88
PID 1484 wrote to memory of 1572	1484	msedge.exe	88
PID 1484 wrote to memory of 1572	1484	msedge.exe	88
PID 1484 wrote to memory of 1572	1484	msedge.exe	88
PID 1484 wrote to memory of 1572	1484	msedge.exe	88
PID 1484 wrote to memory of 1572	1484	msedge.exe	88
PID 1484 wrote to memory of 1572	1484	msedge.exe	88
PID 1484 wrote to memory of 1572	1484	msedge.exe	88
PID 1484 wrote to memory of 1572	1484	msedge.exe	88
PID 1484 wrote to memory of 1572	1484	msedge.exe	88
PID 1484 wrote to memory of 1572	1484	msedge.exe	88
PID 1484 wrote to memory of 1572	1484	msedge.exe	88
PID 1484 wrote to memory of 1572	1484	msedge.exe	88
PID 1484 wrote to memory of 1572	1484	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dfbbc230b40e7ea1eb44b5cc7edb685a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd99e846f8,0x7ffd99e84708,0x7ffd99e84718
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,5406983788620606385,4783332453464411085,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,5406983788620606385,4783332453464411085,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,5406983788620606385,4783332453464411085,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,5406983788620606385,4783332453464411085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,5406983788620606385,4783332453464411085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,5406983788620606385,4783332453464411085,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,5406983788620606385,4783332453464411085,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,5406983788620606385,4783332453464411085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,5406983788620606385,4783332453464411085,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,5406983788620606385,4783332453464411085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,5406983788620606385,4783332453464411085,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,5406983788620606385,4783332453464411085,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
88190d84ddae6fba61c5465d6e381640

SHA1
83e236c9cbbfd8f6ebda75f812bc3d34967a4a2f

SHA256
1e6fd1721b34259e2624c6e22cb6fd22b9dc58620441eedf32aee12ab94f236b

SHA512
6ab558f1c32dd7a1fd0022f5faf6b9e2f7019a078701c33df87cf9b1f118353ef462678d549a81d01a3c25645a134292fc8ca73163818bdee18b22d1f5fc55b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2da27c7d685214225713708c1ac225f6

SHA1
d6919e64dc5b0d1daacb10b80ba56194f4fb8c37

SHA256
5599ed952327c3f76bee16ae49a4ca439688b26137506a1c53042449f90b60b5

SHA512
e6bca443b1576bfa196fe9a8f9de7ceef322aeaa960eb680d7328bf0da45682c857173dd3dc05f0118040bff535d7a9d57f6e0235260691afdbea143fe465e0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4c5c11934b8c63606c6eb4764f5850eb

SHA1
8f648a5bf388f510e9058da54280f56c3771764c

SHA256
af09cd13ff3ac4df3378d1089d14eefe388c1a4cd0b58aab4acd87d328e9a776

SHA512
f31b9a314374fac2708f914a98b6f5c48ceffdfccb9e18659d9625110b25b61480a190c4ff5579a564689ded0175006e5f1896fa6a5f337a2c401382a463d444

Download Submit