9b22be54a71c42b3386c20719128b367f370e27ee19563e86ba9c1abc934c280

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 17:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

144328c1f97b1bc8702d75767c24ef01_JaffaCakes118.html
Size

139KB
MD5

144328c1f97b1bc8702d75767c24ef01
SHA1

cf6945fcb097e40f150a9f78abdfd18cc18fb09c
SHA256

9b22be54a71c42b3386c20719128b367f370e27ee19563e86ba9c1abc934c280
SHA512

70bedc5d55bf3a753cb20ade7760022432288961570c2f412663a10174174b3fb9aad73e93746083974e3a06edc4bc7894933c8103678d008e9e91720e2aafee
SSDEEP

1536:S6p9nIheDUhlV4/yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJA:S6H/yfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3304	msedge.exe
3304	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3304	msedge.exe
3304	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 4680	3304	msedge.exe	82
PID 3304 wrote to memory of 4680	3304	msedge.exe	82
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 1144	3304	msedge.exe	83
PID 3304 wrote to memory of 3872	3304	msedge.exe	84
PID 3304 wrote to memory of 3872	3304	msedge.exe	84
PID 3304 wrote to memory of 3660	3304	msedge.exe	85
PID 3304 wrote to memory of 3660	3304	msedge.exe	85
PID 3304 wrote to memory of 3660	3304	msedge.exe	85
PID 3304 wrote to memory of 3660	3304	msedge.exe	85
PID 3304 wrote to memory of 3660	3304	msedge.exe	85
PID 3304 wrote to memory of 3660	3304	msedge.exe	85
PID 3304 wrote to memory of 3660	3304	msedge.exe	85
PID 3304 wrote to memory of 3660	3304	msedge.exe	85
PID 3304 wrote to memory of 3660	3304	msedge.exe	85
PID 3304 wrote to memory of 3660	3304	msedge.exe	85
PID 3304 wrote to memory of 3660	3304	msedge.exe	85
PID 3304 wrote to memory of 3660	3304	msedge.exe	85
PID 3304 wrote to memory of 3660	3304	msedge.exe	85
PID 3304 wrote to memory of 3660	3304	msedge.exe	85
PID 3304 wrote to memory of 3660	3304	msedge.exe	85
PID 3304 wrote to memory of 3660	3304	msedge.exe	85
PID 3304 wrote to memory of 3660	3304	msedge.exe	85
PID 3304 wrote to memory of 3660	3304	msedge.exe	85
PID 3304 wrote to memory of 3660	3304	msedge.exe	85
PID 3304 wrote to memory of 3660	3304	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\144328c1f97b1bc8702d75767c24ef01_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff807f246f8,0x7ff807f24708,0x7ff807f24718
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,1948752960190283965,11390267973319362750,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,1948752960190283965,11390267973319362750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1712 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,1948752960190283965,11390267973319362750,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1948752960190283965,11390267973319362750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1948752960190283965,11390267973319362750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,1948752960190283965,11390267973319362750,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4944 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f0b45e79f356e45fb108f7caba812f92

SHA1
1cb7f843d826e0a7737c327475fc3e8fc642f0db

SHA256
eda19d2ad273f7394fbcaa454633e537e8954baffe26955d8a2d59b8c3476512

SHA512
87ef713a711672a21fe5b01ae7264e7c90b0e1a7c6658404903958056e81a0235a41c5e6a962ef6e8b165b73fb4e86f01b2a3e0d87ac7498749269fada00ae20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8407053eb9d03cf2e6e0f03c36aadf12

SHA1
3bd3dfad925d6230638f453ce00551ddf9dc8e69

SHA256
8e70ba73f9645eb7e508116030bbca1fe38af81fa47805e17a84f5694d2c102d

SHA512
92e83e59c95cab9751d9984c85b10a60d3535139991fd0c00142397ab93a722dc05d8a09e93b94c718328428218da0b32b43e005c6d071cb7286c151954db136

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d0525546f40b806b817f38dffeb2ce66

SHA1
642c36343a7deffd3d656c4f86ad09df54e450c3

SHA256
262e62a877e8823b90b7b21ed3f46fb9fd903f29911da961cafa90ae7ba92d99

SHA512
241876f505af8a69ad591ccbea7a85018a6cdeb5cd5c0366927be4dca5e9869cfd84224d4dd67cab69b35aecc8fb4d5b5cc43c12a203382f187d730455cfeae9

Download Submit