4514959de3eda5db2a0080e6d2d098cb239b9c3909c270cea52d279dcbe7ca76

Analysis

max time kernel
145s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

710dec823fee589af2d050523ab7d449_JaffaCakes118.html
Size

29KB
MD5

710dec823fee589af2d050523ab7d449
SHA1

c1f9c0f82129b6b517de8862c00df74e180f12bf
SHA256

4514959de3eda5db2a0080e6d2d098cb239b9c3909c270cea52d279dcbe7ca76
SHA512

85cbfe5a90c0819631c3eb33ab75f0fa48452604d4422b3bbdfcb37d04730807f8dae98b55be55384fd37e2d4cee9498d71da9515504b2706f4a5bca7996f4a8
SSDEEP

384:bKUcoYz5QYSJSNtB5cSOSNE+HyH9NjS2SNxdDSNPpSYSNfbfRGPSNcSGSNeSNNSe:xobf8SVhu2LPnARrHmT

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
244	msedge.exe
244	msedge.exe
2848	msedge.exe
2848	msedge.exe
2224	identity_helper.exe
2224	identity_helper.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 3408	2848	msedge.exe	84
PID 2848 wrote to memory of 3408	2848	msedge.exe	84
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 5048	2848	msedge.exe	85
PID 2848 wrote to memory of 244	2848	msedge.exe	86
PID 2848 wrote to memory of 244	2848	msedge.exe	86
PID 2848 wrote to memory of 860	2848	msedge.exe	87
PID 2848 wrote to memory of 860	2848	msedge.exe	87
PID 2848 wrote to memory of 860	2848	msedge.exe	87
PID 2848 wrote to memory of 860	2848	msedge.exe	87
PID 2848 wrote to memory of 860	2848	msedge.exe	87
PID 2848 wrote to memory of 860	2848	msedge.exe	87
PID 2848 wrote to memory of 860	2848	msedge.exe	87
PID 2848 wrote to memory of 860	2848	msedge.exe	87
PID 2848 wrote to memory of 860	2848	msedge.exe	87
PID 2848 wrote to memory of 860	2848	msedge.exe	87
PID 2848 wrote to memory of 860	2848	msedge.exe	87
PID 2848 wrote to memory of 860	2848	msedge.exe	87
PID 2848 wrote to memory of 860	2848	msedge.exe	87
PID 2848 wrote to memory of 860	2848	msedge.exe	87
PID 2848 wrote to memory of 860	2848	msedge.exe	87
PID 2848 wrote to memory of 860	2848	msedge.exe	87
PID 2848 wrote to memory of 860	2848	msedge.exe	87
PID 2848 wrote to memory of 860	2848	msedge.exe	87
PID 2848 wrote to memory of 860	2848	msedge.exe	87
PID 2848 wrote to memory of 860	2848	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\710dec823fee589af2d050523ab7d449_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97c5c46f8,0x7ff97c5c4708,0x7ff97c5c4718
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,11412606072238544843,14115551644494289620,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,11412606072238544843,14115551644494289620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,11412606072238544843,14115551644494289620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11412606072238544843,14115551644494289620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11412606072238544843,14115551644494289620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,11412606072238544843,14115551644494289620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,11412606072238544843,14115551644494289620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11412606072238544843,14115551644494289620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11412606072238544843,14115551644494289620,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11412606072238544843,14115551644494289620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,11412606072238544843,14115551644494289620,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,11412606072238544843,14115551644494289620,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5992 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6c86c838cf1dc704d2be375f04e1e6c6

SHA1
ad2911a13a3addc86cc46d4329b2b1621cbe7e35

SHA256
dff0886331bb45ec7711af92ab10be76291fde729dff23ca3270c86fb6e606bb

SHA512
a120248263919c687f09615fed56c7cac825c8c93c104488632cebc1abfa338c39ebdc191e5f0c45ff30f054f08d4c02d12b013de6322490197606ce0c0b4f37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27f3335bf37563e4537db3624ee378da

SHA1
57543abc3d97c2a2b251b446820894f4b0111aeb

SHA256
494425284ba12ee2fb07890e268be7890b258e1b1e5ecfa4a4dbc3411ab93b1a

SHA512
2bef861f9d2d916272f6014110fdee84afced515710c9d69b3c310f6bf41728d1b2d41fee3c86441ff96c08c7d474f9326e992b9164b9a3f13627f7d24d0c485

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b85db0b27be52a568a802f5fcf97ae4c

SHA1
52cc22ea8f01b98f4eeea6621425bd2e6382ed03

SHA256
07fccd1aaa4a4dc8f83ab225e050ba744c22af114336018af93b7aab7175266a

SHA512
00696f3f8d649a9f14b6d8e98fe3c162b195c656a1aabf12e03c2204fcb06ee5a7268d02f789debec4e1be4f46c7d5f156f62a3d1d26574c65c2f5d57bab16d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2b1843640c76f7211964e07c6526fbf8

SHA1
0c3bc34dad2d1a54ea928e2363f6f5a0ccc2b45a

SHA256
af82298938ccab464d5bac0c2411a6525f3c963ec0f1056da9f26fbd49e29ad1

SHA512
d05144a81eae59f214bd91b5bc329ff0c11589097727fd5fae233d4bdc63a0d41aa00966a7075d3d17e13e54406fc602e1abffdae2cbd3434cb0f93802104ef7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
92c0720e9ccecf69c0a32019021bcc1a

SHA1
ada5697322815167a57630d5fd738199b7455631

SHA256
ea3edb9f5cad9b7b392a54c4084bc9433b0020c2a2c07bdb49cb3c1fc36582d8

SHA512
b9250fa9b845e39a463cb1323e67bd6b61aa006728f0d6d030500e6c4ce683065fff6d57b91219f168588ae7f7635798712531dd3b36f9441fad411e4854c740

Download Submit