876b350a866ee8cf83f6b203ffe50bebae5a81b928098903ddebbbaea9630b18

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0606908ee6621b470ec7a8c6f5720dee_JaffaCakes118.html
Size

57KB
MD5

0606908ee6621b470ec7a8c6f5720dee
SHA1

e9a867a97ddc7aff329eef89ec9b14beb21f325a
SHA256

876b350a866ee8cf83f6b203ffe50bebae5a81b928098903ddebbbaea9630b18
SHA512

cf3097686128150e3360b1279b26122da0ec49cbb8d2351ed52de1661a8f5d6e52b639fa1b4df6bb3f99f48d0b99b0e80a6bbd76bf04581ca1c1b774376ce663
SSDEEP

1536:tdEQ4g9qP+Sa20HHtPx/52lCnTp0q6R8VGuh6:MQQPQ20HHtPx/52lCnTp0q6R8VGX

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
664	msedge.exe
664	msedge.exe
4884	msedge.exe
4884	msedge.exe
3232	identity_helper.exe
3232	identity_helper.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 3468	4884	msedge.exe	82
PID 4884 wrote to memory of 3468	4884	msedge.exe	82
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 2256	4884	msedge.exe	83
PID 4884 wrote to memory of 664	4884	msedge.exe	84
PID 4884 wrote to memory of 664	4884	msedge.exe	84
PID 4884 wrote to memory of 364	4884	msedge.exe	85
PID 4884 wrote to memory of 364	4884	msedge.exe	85
PID 4884 wrote to memory of 364	4884	msedge.exe	85
PID 4884 wrote to memory of 364	4884	msedge.exe	85
PID 4884 wrote to memory of 364	4884	msedge.exe	85
PID 4884 wrote to memory of 364	4884	msedge.exe	85
PID 4884 wrote to memory of 364	4884	msedge.exe	85
PID 4884 wrote to memory of 364	4884	msedge.exe	85
PID 4884 wrote to memory of 364	4884	msedge.exe	85
PID 4884 wrote to memory of 364	4884	msedge.exe	85
PID 4884 wrote to memory of 364	4884	msedge.exe	85
PID 4884 wrote to memory of 364	4884	msedge.exe	85
PID 4884 wrote to memory of 364	4884	msedge.exe	85
PID 4884 wrote to memory of 364	4884	msedge.exe	85
PID 4884 wrote to memory of 364	4884	msedge.exe	85
PID 4884 wrote to memory of 364	4884	msedge.exe	85
PID 4884 wrote to memory of 364	4884	msedge.exe	85
PID 4884 wrote to memory of 364	4884	msedge.exe	85
PID 4884 wrote to memory of 364	4884	msedge.exe	85
PID 4884 wrote to memory of 364	4884	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0606908ee6621b470ec7a8c6f5720dee_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff96f5846f8,0x7ff96f584708,0x7ff96f584718
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,613395006159370276,5946849210563309948,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,613395006159370276,5946849210563309948,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,613395006159370276,5946849210563309948,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,613395006159370276,5946849210563309948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,613395006159370276,5946849210563309948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,613395006159370276,5946849210563309948,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,613395006159370276,5946849210563309948,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,613395006159370276,5946849210563309948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,613395006159370276,5946849210563309948,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,613395006159370276,5946849210563309948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4352 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,613395006159370276,5946849210563309948,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,613395006159370276,5946849210563309948,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5776 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
03a6ee06dcbddb6ed0ac1979620cfde1

SHA1
6d93905f34095d7ca8c8e766173fbc692a4b0a49

SHA256
e7f22f9f17043d9894c287b01eb8635e94da80362ddd76638220af38a06cbf68

SHA512
3e25dfb7878e2d3de511adce6aaa0b0bce1a1fb165bc05d88d1c40441c3c50456500e8cc9ba6aecf1881be6940e5b7ef9de0ff515673891031a3d965e8411342

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d5367abe3a64fe735fa7afbe0f3039c7

SHA1
300d14c7c6073142a5857734139c00644f78e7ee

SHA256
c01ee9f20fb4cb5132bd8d974f164216ffc4c2b58cffff40243a8de4a3b99437

SHA512
ea6d1073a4889f9ecf26e0b4efd35890da787bf4b16f929c6590703093603722dfcbdcb5b6e8aa788d4086d809356875cfc7b6ab7c21afc9e3cd7cd1b4491ca4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d90f7dc71c74fbeebdc515e56cd24776

SHA1
8f88edf5c4fb192991a9e857874c410e27fa5af6

SHA256
02866979469a9420a85cd01a12c76a6a108e770b79ebc9ac2e1fc80556c7e806

SHA512
1d90b40f68b53a95f84c5e4297ade0060b2a253ee7b25fbc6711dab1b4adfe403342de27332400fedb21ca4bd8636987827de2394f3b1d288ff766826c18ec7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
db2a16e3292f88925b5df65a9cba4e9d

SHA1
be725e7dd6ac3b5394a6fde2953e72c76f2738d1

SHA256
490a841864c374d35d0e650a67334c2a5bba695bec4341484f7aaf68b881b38b

SHA512
89cc36b5ad680caf6de809f89c034c3e2f00bb4444adb41f1cd86342c670864efea93691b51d4c5a3f3e0815b7bde2f38e53fb1d40d5e211f8f2462a60a471d3

Download Submit