19d158aadfb59eebac4ee721084a5753c17a7bef3e189c8481cf30dce005ba41

Analysis

max time kernel
145s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 05:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

832bff275bc8c8b2105e00db336e6f01_JaffaCakes118.html
Size

7KB
MD5

832bff275bc8c8b2105e00db336e6f01
SHA1

18108ee06b89938de2845cfcee39a8ec3f921f95
SHA256

19d158aadfb59eebac4ee721084a5753c17a7bef3e189c8481cf30dce005ba41
SHA512

7b545c2d8a4382b7f035c5b5fbab8c8cd00df4f11f684698c94496a95c0e220a7aea5470cec27bec08b21e0e69993962bb5e12e022c1dec92e79ac6f610d3ba3
SSDEEP

96:uzVs+ux7lvLLY1k9o84d12ef7CSTUszf+Ch92UccEZ7ru7f:csz7lvAYS/+jb76f

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1976	msedge.exe
1976	msedge.exe
2528	msedge.exe
2528	msedge.exe
4596	identity_helper.exe
4596	identity_helper.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 3740	2528	msedge.exe	83
PID 2528 wrote to memory of 3740	2528	msedge.exe	83
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 948	2528	msedge.exe	84
PID 2528 wrote to memory of 1976	2528	msedge.exe	85
PID 2528 wrote to memory of 1976	2528	msedge.exe	85
PID 2528 wrote to memory of 3600	2528	msedge.exe	86
PID 2528 wrote to memory of 3600	2528	msedge.exe	86
PID 2528 wrote to memory of 3600	2528	msedge.exe	86
PID 2528 wrote to memory of 3600	2528	msedge.exe	86
PID 2528 wrote to memory of 3600	2528	msedge.exe	86
PID 2528 wrote to memory of 3600	2528	msedge.exe	86
PID 2528 wrote to memory of 3600	2528	msedge.exe	86
PID 2528 wrote to memory of 3600	2528	msedge.exe	86
PID 2528 wrote to memory of 3600	2528	msedge.exe	86
PID 2528 wrote to memory of 3600	2528	msedge.exe	86
PID 2528 wrote to memory of 3600	2528	msedge.exe	86
PID 2528 wrote to memory of 3600	2528	msedge.exe	86
PID 2528 wrote to memory of 3600	2528	msedge.exe	86
PID 2528 wrote to memory of 3600	2528	msedge.exe	86
PID 2528 wrote to memory of 3600	2528	msedge.exe	86
PID 2528 wrote to memory of 3600	2528	msedge.exe	86
PID 2528 wrote to memory of 3600	2528	msedge.exe	86
PID 2528 wrote to memory of 3600	2528	msedge.exe	86
PID 2528 wrote to memory of 3600	2528	msedge.exe	86
PID 2528 wrote to memory of 3600	2528	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\832bff275bc8c8b2105e00db336e6f01_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff840ed46f8,0x7ff840ed4708,0x7ff840ed4718
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,3639707888179816729,3707521955935887367,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,3639707888179816729,3707521955935887367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,3639707888179816729,3707521955935887367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3639707888179816729,3707521955935887367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3639707888179816729,3707521955935887367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,3639707888179816729,3707521955935887367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,3639707888179816729,3707521955935887367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3639707888179816729,3707521955935887367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3639707888179816729,3707521955935887367,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3639707888179816729,3707521955935887367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3639707888179816729,3707521955935887367,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,3639707888179816729,3707521955935887367,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0dc31145339977b457eec605c4e1a567

SHA1
deb6ff8183afdaafd849858c821af52f93936e1c

SHA256
4b1ef876e1d4f2c9726b7b966222c336d0be026c588178ad40ab476be4d353ec

SHA512
ef095404247530ade966bae7d6920f0ff060852e3dfb545f4bbca384f88d0e2a4622b55e4b856ab63f6e6c56196a8ad1257711b53a2fcdd89962d1252b6c4e17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
31f5155eeaa8631c1c80614efb4e73cd

SHA1
aac054ba3a9bd71bb2644cc541aad11a5f119017

SHA256
7e0833f04bdc7ed7a88940d793f110d199368d7c2ca55eabb154de84a355d7cf

SHA512
94c43c4e59ae3745fee5157852c279110de2f89dd1562c47627ef960a70790db0b713155817ac7ac636e43f0218f73d35c915f9de61df019ba65c09730a21452

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6796f941509fddf127588b4d7b61fd96

SHA1
e7b0bf0a9d49ef73f3930d302a66495f2449ae6d

SHA256
0a88698352937ee991f22cfb38f4ecdc09d3f5e3ce7fa0cbaf4e6294aa4367f7

SHA512
43700fb0e5707a7381381e9528e7524feda4092e0c74d23b5b1452229e139203443610744668c5bf150bac7b7130a92ebb5dfb3e56258c7ba6fa387805757dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1a38fbafc83a47b376f0cbaa2153fd7e

SHA1
b68ad48896b5c701914499dc9bce312e2ce1158c

SHA256
d8eb4de8c0e390901022404e58b2f68e75f46b389298bd0dd3fe6f177bd9d1cf

SHA512
f754b5d00a1d77ef92354062cff1dfe535ca5b1f044076d94c0eac875308c839d0fa3cafbe0a208dbe99e8bd4258bec993bc168b5a541656dd997a47d1c26970

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a1032ba29608f74d1370c174e9d5c238

SHA1
e79a36cc32c79699d16a37a417b5604937b94103

SHA256
9a0d19d6800f91a449452287c872f8d40247bd818f9112e9a3804b37c15b2efc

SHA512
3fe7309c621b462150bf162410ea549ca4ff6f501eb24de62dc64ec4cd41782382f0be6d01b6d5662a1e91afad3817a32c5ce2c901233593f5a042e8ee999bec

Download Submit