479b8c5b96a48785e733cc3e7aee10ac65dcf81103e28e38f52d01013b14744f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 21:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71569313ae139975b148cca34b895093_JaffaCakes118.html
Size

20KB
MD5

71569313ae139975b148cca34b895093
SHA1

88621726fb09b7ce837e7239f2d9e326543b4a73
SHA256

479b8c5b96a48785e733cc3e7aee10ac65dcf81103e28e38f52d01013b14744f
SHA512

910d863e037b4326e0b96e382f528639670baad1ab127c22410a0aea8f4efd6d4a05f0c2375f25b1105eb0eeb316b8e787ef7ab797acb3366e15702021dae3d4
SSDEEP

384:D1MflIcAty4HTGTHZ1era1KS17obVn6Z85/gR/6guLZ:RBEXJ8pgN6xLZ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3580	msedge.exe
3580	msedge.exe
3036	msedge.exe
3036	msedge.exe
2304	identity_helper.exe
2304	identity_helper.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 3544	3036	msedge.exe	85
PID 3036 wrote to memory of 3544	3036	msedge.exe	85
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 1780	3036	msedge.exe	86
PID 3036 wrote to memory of 3580	3036	msedge.exe	87
PID 3036 wrote to memory of 3580	3036	msedge.exe	87
PID 3036 wrote to memory of 3676	3036	msedge.exe	88
PID 3036 wrote to memory of 3676	3036	msedge.exe	88
PID 3036 wrote to memory of 3676	3036	msedge.exe	88
PID 3036 wrote to memory of 3676	3036	msedge.exe	88
PID 3036 wrote to memory of 3676	3036	msedge.exe	88
PID 3036 wrote to memory of 3676	3036	msedge.exe	88
PID 3036 wrote to memory of 3676	3036	msedge.exe	88
PID 3036 wrote to memory of 3676	3036	msedge.exe	88
PID 3036 wrote to memory of 3676	3036	msedge.exe	88
PID 3036 wrote to memory of 3676	3036	msedge.exe	88
PID 3036 wrote to memory of 3676	3036	msedge.exe	88
PID 3036 wrote to memory of 3676	3036	msedge.exe	88
PID 3036 wrote to memory of 3676	3036	msedge.exe	88
PID 3036 wrote to memory of 3676	3036	msedge.exe	88
PID 3036 wrote to memory of 3676	3036	msedge.exe	88
PID 3036 wrote to memory of 3676	3036	msedge.exe	88
PID 3036 wrote to memory of 3676	3036	msedge.exe	88
PID 3036 wrote to memory of 3676	3036	msedge.exe	88
PID 3036 wrote to memory of 3676	3036	msedge.exe	88
PID 3036 wrote to memory of 3676	3036	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\71569313ae139975b148cca34b895093_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff855aa46f8,0x7ff855aa4708,0x7ff855aa4718
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,18054950319644994065,7688449304186184104,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,18054950319644994065,7688449304186184104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,18054950319644994065,7688449304186184104,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18054950319644994065,7688449304186184104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18054950319644994065,7688449304186184104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18054950319644994065,7688449304186184104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,18054950319644994065,7688449304186184104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,18054950319644994065,7688449304186184104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18054950319644994065,7688449304186184104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18054950319644994065,7688449304186184104,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18054950319644994065,7688449304186184104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18054950319644994065,7688449304186184104,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,18054950319644994065,7688449304186184104,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
584971c8ba88c824fd51a05dddb45a98

SHA1
b7c9489b4427652a9cdd754d1c1b6ac4034be421

SHA256
e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307

SHA512
5dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b28ef7d9f6d74f055cc49876767c886c

SHA1
d6b3267f36c340979f8fc3e012fdd02c468740bf

SHA256
fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37

SHA512
491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
2111d6cae0827ac7a782def4a619f9aa

SHA1
7e79947dc2effce83003644abe70f482a086f931

SHA256
20437b44dd23a457417ad5bc8cc3caadb93128ab60ceef60941d6670233f8001

SHA512
1a15043a745daa4e466225058dd6c88879c8199f607de73a36b285aee217e1d85f28e3bf9e4d8c3f773cb0e3a2172f218495151345b8803ed2df617b5c054f39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4925e64abe2eebac18829223fb5d8eda

SHA1
4bb7d6659a775f623a1e46725f4a25ed5e9bcdb2

SHA256
058c435721977c9b4ce234e5fa4af591993ea5be65b925f63cb74219d0c7c168

SHA512
0aca583c3bbc69a01acefbf36d1ae2db9dc0fa4e6e3287210c38c0938c5e358f90fb02cc906909d4002e8bfdc48379499644aff93918411e81b8b70dd9437152

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
19d72807c2b2f0bbc600a6b443fb2f0c

SHA1
25ca40b53679017b2077bb7d891767b040ab01d7

SHA256
b1c7342cdc930d7ce593502bfd949a0681f97e0deb76f004c9972f80b966229c

SHA512
ab983a4b36061970e3a547c95d12c1f212a16f3c697d17a1afdf6ce14b825da366cec5b6d8a30d90772849cf6bd46d214a31828bc9b47d97804e5994530e85ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f273e2d20c75ad370824b61febea6aab

SHA1
0901075cca5afe7694d080e9def0294d14574666

SHA256
e797ba58ab48f958a37d1207dda20e1dcd384d785f38c9f4c1ebbc00dcee370a

SHA512
349d9a40046b9f944e841670b3431c450a717ed35fa24ad15f63a23ef80a461496260a0329fac259d150d6a16823a166f6c8e12481e5c2fb1cc32d878126b3db

Download Submit