7baf6e0ed76f3718e0d2f0940b04f2a080a01e19e06543e7763e6ec7f4bcd189

Analysis

max time kernel
145s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-10-2024 06:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1673af0ca617029c0fc88d7ce407f465_JaffaCakes118.html
Size

53KB
MD5

1673af0ca617029c0fc88d7ce407f465
SHA1

fd7cbc69c29352c54135ac2efb90b1e906f39309
SHA256

7baf6e0ed76f3718e0d2f0940b04f2a080a01e19e06543e7763e6ec7f4bcd189
SHA512

060e1e6bb9b8e67715be66db1978b09927f1fb4de06890058dd2ced7bdd070f1fbf9cef6fb40cdf48fbf45fc2598254cfed501c7f06ab9b2f8b98cbf7977fdcc
SSDEEP

1536:CkgUiIakTqGivi+PyUBrunlYm63Nj+q5VyvR0w2AzTICbbBoL/t9M/dNwIUTDmDg:CkgUiIakTqGivi+PyUBrunlYm63Nj+qN

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
3468	msedge.exe
3468	msedge.exe
336	identity_helper.exe
336	identity_helper.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 1400	3468	msedge.exe	82
PID 3468 wrote to memory of 1400	3468	msedge.exe	82
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 3516	3468	msedge.exe	83
PID 3468 wrote to memory of 1528	3468	msedge.exe	84
PID 3468 wrote to memory of 1528	3468	msedge.exe	84
PID 3468 wrote to memory of 4364	3468	msedge.exe	85
PID 3468 wrote to memory of 4364	3468	msedge.exe	85
PID 3468 wrote to memory of 4364	3468	msedge.exe	85
PID 3468 wrote to memory of 4364	3468	msedge.exe	85
PID 3468 wrote to memory of 4364	3468	msedge.exe	85
PID 3468 wrote to memory of 4364	3468	msedge.exe	85
PID 3468 wrote to memory of 4364	3468	msedge.exe	85
PID 3468 wrote to memory of 4364	3468	msedge.exe	85
PID 3468 wrote to memory of 4364	3468	msedge.exe	85
PID 3468 wrote to memory of 4364	3468	msedge.exe	85
PID 3468 wrote to memory of 4364	3468	msedge.exe	85
PID 3468 wrote to memory of 4364	3468	msedge.exe	85
PID 3468 wrote to memory of 4364	3468	msedge.exe	85
PID 3468 wrote to memory of 4364	3468	msedge.exe	85
PID 3468 wrote to memory of 4364	3468	msedge.exe	85
PID 3468 wrote to memory of 4364	3468	msedge.exe	85
PID 3468 wrote to memory of 4364	3468	msedge.exe	85
PID 3468 wrote to memory of 4364	3468	msedge.exe	85
PID 3468 wrote to memory of 4364	3468	msedge.exe	85
PID 3468 wrote to memory of 4364	3468	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1673af0ca617029c0fc88d7ce407f465_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9addf46f8,0x7ff9addf4708,0x7ff9addf4718
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,3924499485735205361,91081544179742327,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,3924499485735205361,91081544179742327,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,3924499485735205361,91081544179742327,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3924499485735205361,91081544179742327,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3924499485735205361,91081544179742327,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3924499485735205361,91081544179742327,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,3924499485735205361,91081544179742327,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,3924499485735205361,91081544179742327,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3924499485735205361,91081544179742327,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3924499485735205361,91081544179742327,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3924499485735205361,91081544179742327,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3924499485735205361,91081544179742327,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,3924499485735205361,91081544179742327,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5572 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
91de6e045b057d857a75d36244e6c865

SHA1
52f8de202dc8d217468c2bf668cb17ca42ef87e8

SHA256
986a5231b1c52f0e9430a96b8b4c8cc203ce997f63aa7816a032182b2ce1f665

SHA512
5ea0559b4bd318495e4318c0b733dabbf6561088ec692e095c14d725d6728fedd5353b84f0ca9c8f826d0b5caa392fa1f1cf93e319078d42d6e9d638e58c6769

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
188ffa62b9d960839bb2763c85c490f5

SHA1
08c5fa885ddf5e13b9844eb13efeaf13c84f0156

SHA256
e1b070271f83b9f0b02d1f0639e053f3279b666fe04c4ceaece6ab08a324f962

SHA512
414514c2aefb556a22a9fa287331ab52dc5e9011cb28f51db7504dbd90d14943c2a70a1dab96ba0aaa0dbac32827035e75d66670a53342214fcef42d16896fcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3e03d0df06f3420976ab214205c6f6ce

SHA1
e39fb1baa10c2f980833d44c1e0da606795fd598

SHA256
55431d3fcec40b2b5ac6a219f0541af3cb2670cd44171661e125919ae2969625

SHA512
2121aa9135c099dfbcbb3a3bb5793c5a365848a57530edf9333fcdeae7089107a67b5837972be83b0b96eade25517310bcc8f44496fc0be032a02eb1fa584554

Download Submit