dd2b88b43804bded1e8de075b67bdf1c58f54f493402a22ed587bf37848196e5

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 23:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

154561e5e26e35829d962a51d6bba610_JaffaCakes118.html
Size

17KB
MD5

154561e5e26e35829d962a51d6bba610
SHA1

a1cf942c419ac173096092fee803803949e15566
SHA256

dd2b88b43804bded1e8de075b67bdf1c58f54f493402a22ed587bf37848196e5
SHA512

abdab2c6e8a9da303b11748e5d321a1666f4095b6b607c9dfd4b46174e63b2fd48895eee4ca32712b461202c87eba3ecaf16c7f8a14995a91a78f6157f156835
SSDEEP

192:6V2FB0de/0+m2lUw+Whe1N4buQ07mQ9m8uBJP3uV/xknNEErVap:VFB0de/0+Iwnhe1N4buQNQ9m8urCG7rG

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3272	msedge.exe
3272	msedge.exe
2080	msedge.exe
2080	msedge.exe
1632	identity_helper.exe
1632	identity_helper.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 4164	2080	msedge.exe	82
PID 2080 wrote to memory of 4164	2080	msedge.exe	82
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 1380	2080	msedge.exe	83
PID 2080 wrote to memory of 3272	2080	msedge.exe	84
PID 2080 wrote to memory of 3272	2080	msedge.exe	84
PID 2080 wrote to memory of 448	2080	msedge.exe	85
PID 2080 wrote to memory of 448	2080	msedge.exe	85
PID 2080 wrote to memory of 448	2080	msedge.exe	85
PID 2080 wrote to memory of 448	2080	msedge.exe	85
PID 2080 wrote to memory of 448	2080	msedge.exe	85
PID 2080 wrote to memory of 448	2080	msedge.exe	85
PID 2080 wrote to memory of 448	2080	msedge.exe	85
PID 2080 wrote to memory of 448	2080	msedge.exe	85
PID 2080 wrote to memory of 448	2080	msedge.exe	85
PID 2080 wrote to memory of 448	2080	msedge.exe	85
PID 2080 wrote to memory of 448	2080	msedge.exe	85
PID 2080 wrote to memory of 448	2080	msedge.exe	85
PID 2080 wrote to memory of 448	2080	msedge.exe	85
PID 2080 wrote to memory of 448	2080	msedge.exe	85
PID 2080 wrote to memory of 448	2080	msedge.exe	85
PID 2080 wrote to memory of 448	2080	msedge.exe	85
PID 2080 wrote to memory of 448	2080	msedge.exe	85
PID 2080 wrote to memory of 448	2080	msedge.exe	85
PID 2080 wrote to memory of 448	2080	msedge.exe	85
PID 2080 wrote to memory of 448	2080	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\154561e5e26e35829d962a51d6bba610_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe9f4046f8,0x7ffe9f404708,0x7ffe9f404718
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,14344232610805691662,14654280099892591416,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,14344232610805691662,14654280099892591416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,14344232610805691662,14654280099892591416,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14344232610805691662,14654280099892591416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14344232610805691662,14654280099892591416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14344232610805691662,14654280099892591416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,14344232610805691662,14654280099892591416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,14344232610805691662,14654280099892591416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14344232610805691662,14654280099892591416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14344232610805691662,14654280099892591416,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14344232610805691662,14654280099892591416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14344232610805691662,14654280099892591416,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,14344232610805691662,14654280099892591416,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
35fea4c364709ea75fb81d7690b97ca3

SHA1
2ee9f3c5553cd0cf723cbde6fce15d7fc9427d30

SHA256
8a3002722e646daf9053596898a422832233afc2cafb3394e498fcf23672c62a

SHA512
93f9149b946d15863f0c5d723e6d29e97b9562ac2e5350b6d0bf65ac66706275c4b8e27d5e712cd9cf38b8574c45bc7beb6a56522561a6612c3d245d6d8e46c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
46e9b0cf753b485dd65c8e353bfeea6a

SHA1
5ee385289592359ce7261633373b104be922db8d

SHA256
bbd0cf61d5d3f8dfe4cdffe665ee6ca25a88818cd921f90850667ff59eb2c48a

SHA512
299cce20cd9526f62925ec9c997e478c7bf92129f3434ac5e39aabf09a32c52abf09fcdcf6fd00253e45e0c1a88803339e0c4bacae50d29a0f10f5cc0cf0a286

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
97c7bed2d4fb4fcd724b3184ce267590

SHA1
311f9c6ddb1ed44b0d19c4723df11bcce2d73283

SHA256
df62b2df9b615ef0559da9f116744c9fa21c3603dcc4e5b4425ba827934abf4e

SHA512
0325cfc8ff6c87e8e4fa9cf93f7b75ae31100e1ed2e573202778e247ae473625d5481813f37acdf0dae93c5d7359360c64bebdea76dc9cebd5759e2d78c4eae6

Download Submit