8b489e89becc01e19710b1abbc62339409b2c933737c70a42f8031353c02abad

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2024 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dff3dd91b1a63d7b491753308dc6e975_JaffaCakes118.html
Size

26KB
MD5

dff3dd91b1a63d7b491753308dc6e975
SHA1

f0443f9e991aaec46e630d00e92eb9ef30cae2ef
SHA256

8b489e89becc01e19710b1abbc62339409b2c933737c70a42f8031353c02abad
SHA512

29dd053cd7818c918ecc67cd7d02403b8eddd4aba7c3f8d6adf0dee4e6dc7a0a66edad38b73d8a03e34dc0e23c051eed8583d5ff2a3353e79d7d0efc48c681a6
SSDEEP

384:Ft9tVE05NxKyb6mOE7yzECNCGVVHVjx4BOutZN3xHV8lINmylcJzpmZe2UTNc6pW:/V3db3OHP4Uuboe8zibnrb1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
2332	msedge.exe
2332	msedge.exe
5364	identity_helper.exe
5364	identity_helper.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe
5428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 5028	2332	msedge.exe	85
PID 2332 wrote to memory of 5028	2332	msedge.exe	85
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4868	2332	msedge.exe	86
PID 2332 wrote to memory of 4760	2332	msedge.exe	87
PID 2332 wrote to memory of 4760	2332	msedge.exe	87
PID 2332 wrote to memory of 5272	2332	msedge.exe	88
PID 2332 wrote to memory of 5272	2332	msedge.exe	88
PID 2332 wrote to memory of 5272	2332	msedge.exe	88
PID 2332 wrote to memory of 5272	2332	msedge.exe	88
PID 2332 wrote to memory of 5272	2332	msedge.exe	88
PID 2332 wrote to memory of 5272	2332	msedge.exe	88
PID 2332 wrote to memory of 5272	2332	msedge.exe	88
PID 2332 wrote to memory of 5272	2332	msedge.exe	88
PID 2332 wrote to memory of 5272	2332	msedge.exe	88
PID 2332 wrote to memory of 5272	2332	msedge.exe	88
PID 2332 wrote to memory of 5272	2332	msedge.exe	88
PID 2332 wrote to memory of 5272	2332	msedge.exe	88
PID 2332 wrote to memory of 5272	2332	msedge.exe	88
PID 2332 wrote to memory of 5272	2332	msedge.exe	88
PID 2332 wrote to memory of 5272	2332	msedge.exe	88
PID 2332 wrote to memory of 5272	2332	msedge.exe	88
PID 2332 wrote to memory of 5272	2332	msedge.exe	88
PID 2332 wrote to memory of 5272	2332	msedge.exe	88
PID 2332 wrote to memory of 5272	2332	msedge.exe	88
PID 2332 wrote to memory of 5272	2332	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dff3dd91b1a63d7b491753308dc6e975_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8a8d346f8,0x7ff8a8d34708,0x7ff8a8d34718
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,13956971880297627478,7434808444567046838,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,13956971880297627478,7434808444567046838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,13956971880297627478,7434808444567046838,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13956971880297627478,7434808444567046838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13956971880297627478,7434808444567046838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13956971880297627478,7434808444567046838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13956971880297627478,7434808444567046838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,13956971880297627478,7434808444567046838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,13956971880297627478,7434808444567046838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13956971880297627478,7434808444567046838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13956971880297627478,7434808444567046838,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13956971880297627478,7434808444567046838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13956971880297627478,7434808444567046838,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,13956971880297627478,7434808444567046838,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5100 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
7938331a841c4e30373057ee1e81b8da

SHA1
09ca200d010eaa401805e3e5542e56cba8d4c33d

SHA256
52c271ceed3dea8ccefc115bf8c94d41ad2ca9f49c9587df4bd8374d3dfbafc0

SHA512
8271493a99f686e48640d2540f89c27639d31ed17c42c6f2719b469b83d005f47d7c6f25a96fd6ae111972a27a4d57928dff0da976e532c3363b4cf665a026e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4251de1508d3beaa485811b143efee0d

SHA1
d0c0202f56279d770b360d2596dab7eb6d742135

SHA256
a008b4b64bccc77c3bca3e44b704bb137ccf6e935b9c1000a799b9c73bbae70d

SHA512
32031da4777cc4ad91afdae1285679d9a77ee1e221957d5816656e674e8c0a991ae2895e8509c6e9fe1c58c5191600bd5de61643358ef2140734cde4f58790da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8cd5b563653285bb902dcf4e27eff7b0

SHA1
a50f167cb14c65b99f2d11a8336ccdb982de4545

SHA256
d672312bcdbd398ed7a9b370af06b74a70d798429f3c221bdd43933fc3577e57

SHA512
255fe8db8c9d36f3da80b536e4345f56304d57398bb29e2e0aef68fc6ca3d6e7a99d9399a2ca8624fba9f5806058e1316e161c7d4607736dc32ad4badad02fd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b2159ad4-e506-4eb5-8233-44b1965022ef.tmp

Filesize
5KB

MD5
74dcda29ad8151bb5c6064c7b0d557c3

SHA1
f51d4f7f5189b71e7761ab284759ca28315dd1e7

SHA256
01532d3b6689948b920634d5e90556212001799b88497a0a44fac104e68740bd

SHA512
d084e728a49323af323807e82efea99e5f6319be50a3e645961b9dcdbb765344e31aba381bf1ac4792522b0dccd2eb64679e13e40cbdb12b05e12c263ee66b7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
aa735b72484307725f23a30a3fd0603b

SHA1
e24a363caf1adf81a27e903dcd586a15dd0fc3ed

SHA256
8772058797f051053ad5113b9f73b3274574f36ef127a9d73f5a8426033c090c

SHA512
2d4960bbaba4aa50f05f7c84e2e774f4cdababd7858ac3441710a179f24e35896b030fbdbe4b4d8c8d2d4f48f0da8e4fb17d09a6ec8f25eb46322192c4190e87

Download Submit