2e3a7cd2bf37757aa69474726a17b602936ae95c71c144338776292a879b53df

Analysis

max time kernel
145s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 14:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

747e1425d5fd849ccd7fc377e70688f7_JaffaCakes118.html
Size

8KB
MD5

747e1425d5fd849ccd7fc377e70688f7
SHA1

aa8a74b14961fb47ad5daf5e71b9b1cfdcebbe32
SHA256

2e3a7cd2bf37757aa69474726a17b602936ae95c71c144338776292a879b53df
SHA512

62d9de9766cfd45e4d88d7e32ac64f2cbd953fa2ff6484b62bee753a1530a39cf0e8d4da14349fe4b0b902766653ccaeb850518f68441db6ebe940f7d0378a06
SSDEEP

96:uzVs+ux7QxLLY1k9o84d12ef7CSTUazfSxG6MURT2/13pX4m6WHXCmCGq8k/lBcD:csz7QxAYS/oRTg5o3b76f

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1116	msedge.exe
1116	msedge.exe
2448	msedge.exe
2448	msedge.exe
3224	identity_helper.exe
3224	identity_helper.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 4588	2448	msedge.exe	84
PID 2448 wrote to memory of 4588	2448	msedge.exe	84
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 5044	2448	msedge.exe	85
PID 2448 wrote to memory of 1116	2448	msedge.exe	86
PID 2448 wrote to memory of 1116	2448	msedge.exe	86
PID 2448 wrote to memory of 3616	2448	msedge.exe	87
PID 2448 wrote to memory of 3616	2448	msedge.exe	87
PID 2448 wrote to memory of 3616	2448	msedge.exe	87
PID 2448 wrote to memory of 3616	2448	msedge.exe	87
PID 2448 wrote to memory of 3616	2448	msedge.exe	87
PID 2448 wrote to memory of 3616	2448	msedge.exe	87
PID 2448 wrote to memory of 3616	2448	msedge.exe	87
PID 2448 wrote to memory of 3616	2448	msedge.exe	87
PID 2448 wrote to memory of 3616	2448	msedge.exe	87
PID 2448 wrote to memory of 3616	2448	msedge.exe	87
PID 2448 wrote to memory of 3616	2448	msedge.exe	87
PID 2448 wrote to memory of 3616	2448	msedge.exe	87
PID 2448 wrote to memory of 3616	2448	msedge.exe	87
PID 2448 wrote to memory of 3616	2448	msedge.exe	87
PID 2448 wrote to memory of 3616	2448	msedge.exe	87
PID 2448 wrote to memory of 3616	2448	msedge.exe	87
PID 2448 wrote to memory of 3616	2448	msedge.exe	87
PID 2448 wrote to memory of 3616	2448	msedge.exe	87
PID 2448 wrote to memory of 3616	2448	msedge.exe	87
PID 2448 wrote to memory of 3616	2448	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\747e1425d5fd849ccd7fc377e70688f7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd0f8c46f8,0x7ffd0f8c4708,0x7ffd0f8c4718
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9552780065495560280,12825526584776300602,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,9552780065495560280,12825526584776300602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,9552780065495560280,12825526584776300602,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9552780065495560280,12825526584776300602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9552780065495560280,12825526584776300602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9552780065495560280,12825526584776300602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9552780065495560280,12825526584776300602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9552780065495560280,12825526584776300602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9552780065495560280,12825526584776300602,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9552780065495560280,12825526584776300602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9552780065495560280,12825526584776300602,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9552780065495560280,12825526584776300602,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2784 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaaad45aced1889a90a8aa4c39f92659

SHA1
5c0130d9e8d1a64c97924090d9a5258b8a31b83c

SHA256
5e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b

SHA512
0db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3ee50fb26a9d3f096c47ff8696c24321

SHA1
a8c83e798d2a8b31fec0820560525e80dfa4fe66

SHA256
d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f

SHA512
479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7fc79a996ce28c2a791dc19d9616f046

SHA1
c5f2e636ac6e7d8935d408b8e462daed8d9cccba

SHA256
1c88926f6384ed3473b2a1a223f6cd23ee129465090120bf2f9e38f918c4a232

SHA512
e16c2fcfbcccd46e9dc003b31be8802e124eb5ca0fdb79db6ceb2e3d6831c95876be9a57cfd5f2bd3601a2de2990b5912aed8b3756077b1fae4cdde07fabadd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8c8d7f7256d76f80c84c6b35ca9dbc0b

SHA1
4b8612f156d0319e067131fb2025ba8947163ecb

SHA256
7412ca74131bcf006829ae7c8bf538e4292ff8e455ed8c2013a35f94a5fa5a93

SHA512
ffc2e63aa521adbddb94d48f678b94f28aa16a1ed7922bbdca6a0c602425af19c5286a8a1410dd44c3055896cf469797ed9806a0e8af5ec82a7b96f5b2095d71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5ab15c1cff06bd7e0c07b33684871cbf

SHA1
667bddb40bc92a107e814f4344d9bdadb9a9350a

SHA256
95a1ee31ccd4cbadcee45ea41defbdae3dacf61a134761d44ebc32445f73a12f

SHA512
c836400f0da4b929e6517693060ddca2bddf3adcc5b63e9a31685feb55c8f45512aed6bc0c579bb3438a8b3b4d8a9de835af3b0a2f31f0e2c96a783609a902c2

Download Submit