74c2ed83f358eb64137b8c9f54807d081f5ac48b9aa8a362d78528d91813d6ab

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 00:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d20b30b78b87b716b4440cd40dcb587_JaffaCakes118.html
Size

139KB
MD5

0d20b30b78b87b716b4440cd40dcb587
SHA1

35355d95119f0ab77b251cfc45cfa6435afe187e
SHA256

74c2ed83f358eb64137b8c9f54807d081f5ac48b9aa8a362d78528d91813d6ab
SHA512

d36487bdb3e2126f04361984b448b5f18bf7e9f1c41b77a6c6cb48929555d519fe20f7af7dcc73fee7f1531f784c896731d40bbbc399ae46332355466f490d56
SSDEEP

1536:Scuv8cxA3AHYa2lgyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3om:Scu7htyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3768	msedge.exe
3768	msedge.exe
3168	msedge.exe
3168	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 2912	3168	msedge.exe	82
PID 3168 wrote to memory of 2912	3168	msedge.exe	82
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3500	3168	msedge.exe	83
PID 3168 wrote to memory of 3768	3168	msedge.exe	84
PID 3168 wrote to memory of 3768	3168	msedge.exe	84
PID 3168 wrote to memory of 1324	3168	msedge.exe	85
PID 3168 wrote to memory of 1324	3168	msedge.exe	85
PID 3168 wrote to memory of 1324	3168	msedge.exe	85
PID 3168 wrote to memory of 1324	3168	msedge.exe	85
PID 3168 wrote to memory of 1324	3168	msedge.exe	85
PID 3168 wrote to memory of 1324	3168	msedge.exe	85
PID 3168 wrote to memory of 1324	3168	msedge.exe	85
PID 3168 wrote to memory of 1324	3168	msedge.exe	85
PID 3168 wrote to memory of 1324	3168	msedge.exe	85
PID 3168 wrote to memory of 1324	3168	msedge.exe	85
PID 3168 wrote to memory of 1324	3168	msedge.exe	85
PID 3168 wrote to memory of 1324	3168	msedge.exe	85
PID 3168 wrote to memory of 1324	3168	msedge.exe	85
PID 3168 wrote to memory of 1324	3168	msedge.exe	85
PID 3168 wrote to memory of 1324	3168	msedge.exe	85
PID 3168 wrote to memory of 1324	3168	msedge.exe	85
PID 3168 wrote to memory of 1324	3168	msedge.exe	85
PID 3168 wrote to memory of 1324	3168	msedge.exe	85
PID 3168 wrote to memory of 1324	3168	msedge.exe	85
PID 3168 wrote to memory of 1324	3168	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0d20b30b78b87b716b4440cd40dcb587_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5f9846f8,0x7ffe5f984708,0x7ffe5f984718
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,842625424327886005,14266754779522692236,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,842625424327886005,14266754779522692236,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,842625424327886005,14266754779522692236,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,842625424327886005,14266754779522692236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,842625424327886005,14266754779522692236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,842625424327886005,14266754779522692236,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
477B

MD5
7e0fa789566b39ad9649bca558bbe771

SHA1
28a3665f6008b6503b930d51e8136ea0d7c7b090

SHA256
3c71a9c22e7ca35e6152e41248b416daebaa298a04b479338db4ec56fbdd11a0

SHA512
b9dd0a72bb0d88694ad17924d5fa84e352cb618be95d0788962290cde49d05251164d4f6ed64f81e0c2fb279302ee5b14248f082e8912a67a8cd46407c72c1a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6e37654b84054627563db38b8cb972fb

SHA1
a48418242ad8143329c92dcfcbc046ed19d64068

SHA256
14a310437c2d0a32016abe1d5b35ac5cd16191502cf1fdbfedd3856b696efa2c

SHA512
9953828c5d5a40bccffe635a3e2438e1116b006bd9af8d1dc91351b6d88a321e1f030a25b06afe03b9b6935063b6de63c66b427d31f51e93cbe4facd7557b1b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a9aa446c2a21a773af199376ccd926bb

SHA1
ce1d5c2ad18539d7210331ba6fcaba4f3296bb8c

SHA256
358604341fcd9e504c70a35c9f544086a5af006e9e8ed29c2918cd49a68b0903

SHA512
938212798778c121e79de38231b09eb89a9c0fc232b5ea69c99475547b81873358dfc086923f8358383cdf7b41a8153b57bfbb136a67f94cfda993382fdee7ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1da4a732c34f5f93db329d80653e9633

SHA1
d4e82c6bb7e14c29e606179b68c0705bfcbea3f9

SHA256
7b0807ccf8b436c88388471ab04a25cef890338189b50510c3e42fc5bba125eb

SHA512
e74d37f8b11516ad0a808af4999bfc5da61415cb4424f8eb3b31e3dfa0cc2351f8cb818119031d275bd78092de9a0e796970140c7692c9bc7238f88f039b3a1b

Download Submit