3fcfb6e9a6fabda3ae00f21712f2bcda4c149656470432b88f702bbda08e7533

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 22:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c35548d9b1bde4bbd03f1cc980cfe44_JaffaCakes118.html
Size

74KB
MD5

8c35548d9b1bde4bbd03f1cc980cfe44
SHA1

7f422980882483b31c8f2018fb7c17e18da28569
SHA256

3fcfb6e9a6fabda3ae00f21712f2bcda4c149656470432b88f702bbda08e7533
SHA512

bf03cc02e90dc5dcb9fac6b02bf049ab37830a1a446504d988e054e788761f094de3355ea19d2e0c46e6c25979f7c7fd63c3e6e6116b98bfabb945ab42f4200e
SSDEEP

1536:uYM9DWqHBPmClW/BPTMxr2iPXUFo+OFvYUCP7sbc8mvk6NUr+cfUkoSzq:3M9DW+B12NZM6NUr+cfUkoSzq

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3724	msedge.exe
3724	msedge.exe
628	msedge.exe
628	msedge.exe
1420	identity_helper.exe
1420	identity_helper.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 5076	628	msedge.exe	84
PID 628 wrote to memory of 5076	628	msedge.exe	84
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 5012	628	msedge.exe	85
PID 628 wrote to memory of 3724	628	msedge.exe	86
PID 628 wrote to memory of 3724	628	msedge.exe	86
PID 628 wrote to memory of 624	628	msedge.exe	87
PID 628 wrote to memory of 624	628	msedge.exe	87
PID 628 wrote to memory of 624	628	msedge.exe	87
PID 628 wrote to memory of 624	628	msedge.exe	87
PID 628 wrote to memory of 624	628	msedge.exe	87
PID 628 wrote to memory of 624	628	msedge.exe	87
PID 628 wrote to memory of 624	628	msedge.exe	87
PID 628 wrote to memory of 624	628	msedge.exe	87
PID 628 wrote to memory of 624	628	msedge.exe	87
PID 628 wrote to memory of 624	628	msedge.exe	87
PID 628 wrote to memory of 624	628	msedge.exe	87
PID 628 wrote to memory of 624	628	msedge.exe	87
PID 628 wrote to memory of 624	628	msedge.exe	87
PID 628 wrote to memory of 624	628	msedge.exe	87
PID 628 wrote to memory of 624	628	msedge.exe	87
PID 628 wrote to memory of 624	628	msedge.exe	87
PID 628 wrote to memory of 624	628	msedge.exe	87
PID 628 wrote to memory of 624	628	msedge.exe	87
PID 628 wrote to memory of 624	628	msedge.exe	87
PID 628 wrote to memory of 624	628	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8c35548d9b1bde4bbd03f1cc980cfe44_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbda7c46f8,0x7ffbda7c4708,0x7ffbda7c4718
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,9325474243855971554,13450665603736278591,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,9325474243855971554,13450665603736278591,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,9325474243855971554,13450665603736278591,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,9325474243855971554,13450665603736278591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,9325474243855971554,13450665603736278591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,9325474243855971554,13450665603736278591,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3652 /prefetch:8
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,9325474243855971554,13450665603736278591,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3652 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,9325474243855971554,13450665603736278591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,9325474243855971554,13450665603736278591,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2700 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,9325474243855971554,13450665603736278591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,9325474243855971554,13450665603736278591,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,9325474243855971554,13450665603736278591,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3468 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d4829218222c8bedb9ffe89dffd37095

SHA1
aae577f33f413ec3d09f2e7ff5d9cc20a602241c

SHA256
49239b229a2519583ba5d6de3702480b8a8ebf3cfaa8945100dbab25fcb02b7b

SHA512
03e26a2e3de41b8a829b5543da504c7d7ccdc4c112d629efcac24dcda23acb50a52b5b99572b5efb2a01cf392a457cf9fac85663b3d63f7606be00dba218f8f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
15e9c4b4eefb3e1c08a010e748e10f58

SHA1
3172378f2c7a00553ce086dbf53fcf3126c5a724

SHA256
07b56a769467e8b57f9b7acd9d32da266ca5000803758c18bb6818ac236c7000

SHA512
811058b539e914a812c88543bb6657de736f691d18d6dadb5e1f6ced286780fb334dc5f575babbcf4fd2dceda30d1bf4004b374c5775e7f278346b100b29eb7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9672954d8ded40bed5c0082d899935f6

SHA1
967fd970d51e3f3fff28b02e1fedec237e959b12

SHA256
b7ebeec510726ce536a7c901991c15c8760335b00f6bd3cf1234bb10ddc762ba

SHA512
24da8ac8beaac1d81931ecbf2d3ce96af1d4e9730b4486d8a4a0538635cb4a0cafeb53deeb03289297acf39a17d5fcac6e3fee555fcdd8e95462897380832126

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c2e466207e5459d01e9fb55341b8dce9

SHA1
2b089443611b73f0f6a09ae83b384722a3c8b695

SHA256
70e92556c4f33fc15c3224f33151a223e057e585c73771977f470d9b476f7c8f

SHA512
ab6d6f73e451f0ea68a2c660ecafecba66c487371992cc40698b754dc49f315553bfbb7ff5ecb8fb69bee3842c821da59104d9073f64cc20191ceadde85ff7f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8b4e10be9a93c1c2f08e6325bc4d867e

SHA1
e0cb21f39e769717a9cd47cf1b2bb003a7b7e2d5

SHA256
a757f81173fad568b192f4182f1c5c892503e73f0c5a3097882a6bf6f4184ec8

SHA512
a7d7283244d8b43f6943053dfa3f6e2e0d8e0e7721011b1491257dd39f3fe5742a1104f1cec940f22d60f471546b6c07f0fecdee9fcb3915c97dc1d393fbb2a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d787573cfa13cea022766f11c8abd3ba

SHA1
a161079b4ee35a522f509a5c2487d90d8c3c3050

SHA256
fd1b30c7a5925097faa70f0b03cada142df755a7c252328efbd849596a944e46

SHA512
8c068732c29ac1876154035b2fcbb27d49debecf7a55dc0d7a48a118c75397107bf0844dc3fbc597277da2f0ee2a852670c69bdb99d6f3fac8614a5372bbfd91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
7915ba0545666aa5833cf9f9f86d45d6

SHA1
743ecc319bc2a54973582d4a5198042a48fbe8db

SHA256
f8fcc045da13bde0f5dec3ada86342105cbff34ebc2442bcf51e8ed509a95b20

SHA512
a53036251a22cdc95579ea8641c5574f1dc1f7dfd0390f00ebeafbbea0c1a2c0c3e6dba23bbbb8d8e2c77a3e1e816ccfaf84a97da1c334019c8df1414999d1f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
73f23150e1068cb6195314a05e04eec9

SHA1
2b4e62387cb9d2171c9f95ebdf3a7a84e9ab5105

SHA256
7181b1075cf3b34f107347479076c4dd9fdde2f0b490717cf4dd967cce00e58d

SHA512
c7216c2a4faafbfd6d94c583d88753109316c10f684d7223db69749b3cc53548cd66c7a1092f10ec08efcab20c1ea870d444933c09cba987f8ac2e0458278447

Download Submit