96a1a1e85247bdc78c14d8bd399aed904b475d756a7dcc6e3a70bdd6aa29f57b

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08356ce389fda90d2ae99fda063f4016_JaffaCakes118.html
Size

138KB
MD5

08356ce389fda90d2ae99fda063f4016
SHA1

ebc5f890ddaf49bd11c1f6956fa989c55e03408e
SHA256

96a1a1e85247bdc78c14d8bd399aed904b475d756a7dcc6e3a70bdd6aa29f57b
SHA512

38064e82792a04ad082498f40fc4eb8390c43f169d99d2d933f9edc8edaaf8f26887edfb476f5b9760f852e60bbe5072b2316a80999ab97236e8efcc17270aea
SSDEEP

1536:SxDphAjYi26BBS5Pq/5lnhdyyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP9:SxudyyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
4064	msedge.exe
4064	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 2528	4064	msedge.exe	84
PID 4064 wrote to memory of 2528	4064	msedge.exe	84
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 400	4064	msedge.exe	85
PID 4064 wrote to memory of 3644	4064	msedge.exe	86
PID 4064 wrote to memory of 3644	4064	msedge.exe	86
PID 4064 wrote to memory of 3632	4064	msedge.exe	87
PID 4064 wrote to memory of 3632	4064	msedge.exe	87
PID 4064 wrote to memory of 3632	4064	msedge.exe	87
PID 4064 wrote to memory of 3632	4064	msedge.exe	87
PID 4064 wrote to memory of 3632	4064	msedge.exe	87
PID 4064 wrote to memory of 3632	4064	msedge.exe	87
PID 4064 wrote to memory of 3632	4064	msedge.exe	87
PID 4064 wrote to memory of 3632	4064	msedge.exe	87
PID 4064 wrote to memory of 3632	4064	msedge.exe	87
PID 4064 wrote to memory of 3632	4064	msedge.exe	87
PID 4064 wrote to memory of 3632	4064	msedge.exe	87
PID 4064 wrote to memory of 3632	4064	msedge.exe	87
PID 4064 wrote to memory of 3632	4064	msedge.exe	87
PID 4064 wrote to memory of 3632	4064	msedge.exe	87
PID 4064 wrote to memory of 3632	4064	msedge.exe	87
PID 4064 wrote to memory of 3632	4064	msedge.exe	87
PID 4064 wrote to memory of 3632	4064	msedge.exe	87
PID 4064 wrote to memory of 3632	4064	msedge.exe	87
PID 4064 wrote to memory of 3632	4064	msedge.exe	87
PID 4064 wrote to memory of 3632	4064	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\08356ce389fda90d2ae99fda063f4016_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe9a5946f8,0x7ffe9a594708,0x7ffe9a594718
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,8075021017905708495,15087476116594074811,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,8075021017905708495,15087476116594074811,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,8075021017905708495,15087476116594074811,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8075021017905708495,15087476116594074811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,8075021017905708495,15087476116594074811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,8075021017905708495,15087476116594074811,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2760 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7006aacd11b992cd29fca21e619e86ea

SHA1
f224b726a114d4c73d7379236739d5fbb8e7f7b7

SHA256
3c434b96841d5a0fa0a04a6b503c3c4d46f1c4e3a1be77853175e5680e182814

SHA512
6de169882c0e01217c4ca01f6ead8e5ebb316a77558e51cd862532dbf9147d9e267f8db667ff6e9fa33164243724f5e437cb882392382f3cae1072dadb762c1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b80cf20d9e8cf6a579981bfaab1bdce2

SHA1
171a886be3a882bd04206295ce7f1db5b8b7035e

SHA256
10d995b136b604440ac4033b2222543975779068a321d7bddf675d0cb2a4c2b1

SHA512
0233b34866be1afd214a1c8a9dcf8328d16246b3a5ef142295333547b4cfdc787c8627439a2ca03c20cb49107f7428d39696143b71f56b7f1f05029b3a14376a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e5eaed1d915d9cc40948ba0c6f51a0f3

SHA1
61f61917375cabc83af97661bba5414237a604c1

SHA256
7431fbd9b0224a8f0fe52e11fd260e83cdeadd305dc9c826e374b2ec28e1222d

SHA512
518c2ba2f2766d92d8c8d4c9eb444644dfb8249de5543b922a3f0306333b63defd881761a34482dc0adcbb70691f95bd5867ecd61f5b07e75486bc01b1e8fdda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cd51e45902c874ac0db00144e9182bbb

SHA1
c466f8fcccfdce462010528487290591f4adc8fd

SHA256
a1ac38c03ccb7c232179b2ccb404c0701b8ca9852b32a9437dea65d77d3aab0c

SHA512
08323331a5c1821ab22852ee544965cdba304ac54d723c5c0c68e2c12921d6b667879f45acde2b105755b80246ee2b43045d7cd0155cab3ff84582cb06fe0c32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a212e4e28ccc532e33d209d7bae3634c

SHA1
8bed3552a6e8de44f3ff5fe2ee21b35a638c765d

SHA256
c1cc84f7ef80c93b1f620f61330e7cb7b28b7a5ffc07ed158ed7a5c3fa86c8ba

SHA512
99854f56f300b642a1cf5ffbdbc4ac9eab3d8e9cea7d89d76366c8bb178f1ef547f0415cba04d5fa58e77b06175f82684d6879c30e891bd084e1394251ced9e8

Download Submit