620ab93cbd1bbc2b2faa3c0fa3ae6a3c2de0403fd4bcee66893735dbb43fb32d

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-10-2024 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

185afebf1d5e65f1e44bc1bbfb41285e_JaffaCakes118.html
Size

133KB
MD5

185afebf1d5e65f1e44bc1bbfb41285e
SHA1

15051781745687426c58f4b8298bc7ad81f64498
SHA256

620ab93cbd1bbc2b2faa3c0fa3ae6a3c2de0403fd4bcee66893735dbb43fb32d
SHA512

d3771ad47fa1d6485f88e7eaff153cbd0631f338b4dffe48b0f36e907986b810ff81e6edec675f3c1f0cec1ad051d19fb8190203e0020e992026b94c7ab0351a
SSDEEP

3072:nVGejtPUeUwIVGejtPUeUwMMKjxmjLZGDAMJJlzTPPA0ZLpfq8gMPhJzhkDSjE:nVGejtPUeUwIVGejtPUeUwM1iLZGDAMS

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
3240	msedge.exe
3240	msedge.exe
4008	identity_helper.exe
4008	identity_helper.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe
4400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 3968	3240	msedge.exe	82
PID 3240 wrote to memory of 3968	3240	msedge.exe	82
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4080	3240	msedge.exe	83
PID 3240 wrote to memory of 4244	3240	msedge.exe	84
PID 3240 wrote to memory of 4244	3240	msedge.exe	84
PID 3240 wrote to memory of 4064	3240	msedge.exe	85
PID 3240 wrote to memory of 4064	3240	msedge.exe	85
PID 3240 wrote to memory of 4064	3240	msedge.exe	85
PID 3240 wrote to memory of 4064	3240	msedge.exe	85
PID 3240 wrote to memory of 4064	3240	msedge.exe	85
PID 3240 wrote to memory of 4064	3240	msedge.exe	85
PID 3240 wrote to memory of 4064	3240	msedge.exe	85
PID 3240 wrote to memory of 4064	3240	msedge.exe	85
PID 3240 wrote to memory of 4064	3240	msedge.exe	85
PID 3240 wrote to memory of 4064	3240	msedge.exe	85
PID 3240 wrote to memory of 4064	3240	msedge.exe	85
PID 3240 wrote to memory of 4064	3240	msedge.exe	85
PID 3240 wrote to memory of 4064	3240	msedge.exe	85
PID 3240 wrote to memory of 4064	3240	msedge.exe	85
PID 3240 wrote to memory of 4064	3240	msedge.exe	85
PID 3240 wrote to memory of 4064	3240	msedge.exe	85
PID 3240 wrote to memory of 4064	3240	msedge.exe	85
PID 3240 wrote to memory of 4064	3240	msedge.exe	85
PID 3240 wrote to memory of 4064	3240	msedge.exe	85
PID 3240 wrote to memory of 4064	3240	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\185afebf1d5e65f1e44bc1bbfb41285e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff381446f8,0x7fff38144708,0x7fff38144718
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,7342606853538482284,9741901696424724146,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,7342606853538482284,9741901696424724146,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,7342606853538482284,9741901696424724146,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7342606853538482284,9741901696424724146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7342606853538482284,9741901696424724146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7342606853538482284,9741901696424724146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7342606853538482284,9741901696424724146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,7342606853538482284,9741901696424724146,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,7342606853538482284,9741901696424724146,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7342606853538482284,9741901696424724146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7342606853538482284,9741901696424724146,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7342606853538482284,9741901696424724146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7342606853538482284,9741901696424724146,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,7342606853538482284,9741901696424724146,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5420 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
595B

MD5
e3761e505f2bc0954e928fac7b12c417

SHA1
90b712bc3c4a5595be0682e4ababe2ea6d920154

SHA256
5e0a7443ea0ad250b3d4f7ca1c3c140b1989b07d63b6c54bd46657f9dfa06d20

SHA512
72e435947bdab15851167bf713aa15ae555eadb66b83034c6e6cce37916183a883c710bc361e04d138163b522f18b1a89bee8855da42a3a92f9fb332d819282c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2288f96df746310567b6240c20e4880a

SHA1
a0ed5e07fd445801dfc3a7ce0d1f7e28bf97829d

SHA256
c7c63467e3c1ac2639ff3c1b6a414ca3a8be36e8a53d4cb43f26b0053f041726

SHA512
ded1f51174553f9da99c8a283ac748ff0745e38193c36f9d37a5f844e0a159e2b6b61b39fe982aef588051337befe0dface3d2e34186d4e495420a4f921499b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7cba8626202c564bffead9ac0b7b619c

SHA1
b0a37fac55d7479883917f80fad3cba5bfb1606b

SHA256
b6ff363f71959e5edaee8e114e59845ba021e31b1b08626c2e496ffa0090f277

SHA512
79bafafd2ee4ce7090eeae1b0e7a1f9a64c81a63f2fd9faa81d4bee6b0bb14cff4f50be30deec1646fb4fb15122b49a0e741b0f672aa31ffc9c3ffcf5b1f324e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6d9467f537ff8e2833cee774d2ea20b9

SHA1
0c3e4a8e018fdbec1b11a8a3e96a6f9850855c44

SHA256
fe7cfac632ae2bbd62bba2aeb068f99dfa8e07e2694b23aaec3f2362021279e9

SHA512
4d0d99de98f637f75273a45ba50f986fb64d9feeb35cecf1192c544257261fb62908a846dd5523e9760f8635bfc30deba7cb93c828233bc78a97acc2e849bddb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
807da867c5e163f3bf04f58bc31d8853

SHA1
3d495c8e5806f86faa889f6387e4c4a6f4744697

SHA256
b4cba4c604148f37a4e69188a893e1ff4777227545aa3e27a3643d49ff2a417d

SHA512
8d4458931dade96863743c4f0cf650ec033c810a529a9c9b17390aff493a0b214220ce8ce6504baeec9fecc4851237d53e4e46887fb514ca5bd9d7e013d2c248

Download Submit