826ab6537c48fc787225bf856a4ffb26572a18ed64b9073ba45c8cdcb2547e2a

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

883298010c52436e6e007ca8aa7096bf_JaffaCakes118.html
Size

34KB
MD5

883298010c52436e6e007ca8aa7096bf
SHA1

ae5224936ace6b0c590e21730b3a07637f8e2132
SHA256

826ab6537c48fc787225bf856a4ffb26572a18ed64b9073ba45c8cdcb2547e2a
SHA512

d772c81749263f5ffac540c920a1d0a68ddaa7d315572bc39791e3a5818813bfe61b51ce5dfed58c1d484ff2d52fe2a2bdb88c0b6c56ef9a6c0b04d80312ecfc
SSDEEP

768:vwOD6hITO4tJ/CsFim2AVYXF+zDe6sdxYh3ool1/u:k4tMsLKxYhY7

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2724	msedge.exe
2724	msedge.exe
3944	msedge.exe
3944	msedge.exe
3080	identity_helper.exe
3080	identity_helper.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 4576	3944	msedge.exe	84
PID 3944 wrote to memory of 4576	3944	msedge.exe	84
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 4676	3944	msedge.exe	85
PID 3944 wrote to memory of 2724	3944	msedge.exe	86
PID 3944 wrote to memory of 2724	3944	msedge.exe	86
PID 3944 wrote to memory of 4136	3944	msedge.exe	87
PID 3944 wrote to memory of 4136	3944	msedge.exe	87
PID 3944 wrote to memory of 4136	3944	msedge.exe	87
PID 3944 wrote to memory of 4136	3944	msedge.exe	87
PID 3944 wrote to memory of 4136	3944	msedge.exe	87
PID 3944 wrote to memory of 4136	3944	msedge.exe	87
PID 3944 wrote to memory of 4136	3944	msedge.exe	87
PID 3944 wrote to memory of 4136	3944	msedge.exe	87
PID 3944 wrote to memory of 4136	3944	msedge.exe	87
PID 3944 wrote to memory of 4136	3944	msedge.exe	87
PID 3944 wrote to memory of 4136	3944	msedge.exe	87
PID 3944 wrote to memory of 4136	3944	msedge.exe	87
PID 3944 wrote to memory of 4136	3944	msedge.exe	87
PID 3944 wrote to memory of 4136	3944	msedge.exe	87
PID 3944 wrote to memory of 4136	3944	msedge.exe	87
PID 3944 wrote to memory of 4136	3944	msedge.exe	87
PID 3944 wrote to memory of 4136	3944	msedge.exe	87
PID 3944 wrote to memory of 4136	3944	msedge.exe	87
PID 3944 wrote to memory of 4136	3944	msedge.exe	87
PID 3944 wrote to memory of 4136	3944	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\883298010c52436e6e007ca8aa7096bf_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcde2346f8,0x7ffcde234708,0x7ffcde234718
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,5379357382637997462,4768068578218016146,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,5379357382637997462,4768068578218016146,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,5379357382637997462,4768068578218016146,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5379357382637997462,4768068578218016146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5379357382637997462,4768068578218016146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,5379357382637997462,4768068578218016146,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,5379357382637997462,4768068578218016146,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5379357382637997462,4768068578218016146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5379357382637997462,4768068578218016146,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5379357382637997462,4768068578218016146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5379357382637997462,4768068578218016146,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,5379357382637997462,4768068578218016146,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4136 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
910B

MD5
ed817a999cded64c1bc86b106c833386

SHA1
fd9bbc0191c96809a1797e6a28a6ccafb17d82e8

SHA256
208de5e3d4fa314cc3a8ba289032f93131714ce5d7c5c89b864633b269ea6165

SHA512
177cbdddf11e2b0f5abe4d5f831f548e3f2f785e4c1a77993b584becab0b464c4f67504933b0482bb38c7a8e64732c0d41d0bf99088717be7264d26f8e8ac300

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
39d745c945ef72d6a9d03aae9acafd34

SHA1
4ea2e5c90856e6c67646a6a70812ec9c0933e4dc

SHA256
43fb0c95a665aa870fa5ec696569ed11d0e2d35bc64df7cef9cff7e232d91669

SHA512
4157ff443ef8507fa6d617187c459262929ada6f6dd999f8bccf3e83a323eeb5dff03b9a1595ad420ec9f8ab42b62fe9e591030cbdc70084428f607d1824f78e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
140a46f83cec31664cb5df717f2f48b1

SHA1
75f4930ba2b898d04d4ab4f005198a1694ed68d2

SHA256
1f7b6916befea40749ecbb1b3f9450f8ba15e538a0b177b15923145543857658

SHA512
7e6fc856acce36e3adab0e2e470e720465a2d635e79450fa6aa2d9b5eb6648208f787f9788eb3aadf701d265a32488b052cb5e6daffa4c2df3b86a5c9cac509a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
cf2761cfc5b6109256063587c9b36798

SHA1
d045814ecdb511ee4acbc57c5eb2bda6bac90b33

SHA256
a535a0cb63017a2bfefd3a667a60b739ed9072fb011cd2e70619291d8fc0f7a4

SHA512
bd79660ad007b8181c03c2106c210064c5175a788b0d5c41f32012a81c58c68a0e53499187825209d6ed947d787fe237dd20598c2b0642fb1679e6fb4fa51a2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58290f.TMP

Filesize
204B

MD5
750c9c0644fd82d7b277ab9b9a010892

SHA1
489bcfc6f8c3719f55ef820d316d2702033dad27

SHA256
9205d98af93eda018998e0a2e13ac30316765904409177c8eaaa1b51b291af9c

SHA512
7f845dce7e3b23c7a881f85b1cdf470b08f0842a93f00cda05d4b38045029e5f18d336807517ea3724c84e0fe2e710bdd82c7f4f7856904cb933e2e9c4cb59b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aa9c7873-42e9-451e-9a08-d7fe4089f583.tmp

Filesize
6KB

MD5
86fc2f8d4b62b447a546aa9a0bd4a458

SHA1
e9d38951a0d43600c22da6d6fd2e2c7602b99a24

SHA256
618581a8494d6ee1826651d67d8938e377546bdbd76d53bbabc502a315ac7af7

SHA512
a57c9ad1cb5ead1b792aa95b1d708d3a7b9785713ae4368f94a543d9ec53192b5682961fb46f39c3d838d99f93a70419a0b5e11568aa18c388a98c1bbdeb14d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8ea680eeaf58eae435be9aabfb1d39f4

SHA1
b3546af51d2a1e3aba7e3c5a97807d53825cd816

SHA256
7f7141a7b34370092f2cee8340bd8bed4224cc762d38e2d6926f61a689a0c793

SHA512
25134172cc70819aeae54fc9ce47c764e46d72833e70296c0a4284dab26193b456f80eb7a1b7ae01fbbf34eaaf09e7ebec927b50f145a82779d19f026869eafd

Download Submit