15fd339c81bd25e091fab25ff132635c7113966e9beaa1a1a3062b9b7acdf896

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 12:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a62fe6942af5f14a22395ae0d2df86f_JaffaCakes118.html
Size

6KB
MD5

8a62fe6942af5f14a22395ae0d2df86f
SHA1

95cea4b4edddedcbbe05d1e3b621b237400bcb16
SHA256

15fd339c81bd25e091fab25ff132635c7113966e9beaa1a1a3062b9b7acdf896
SHA512

47358bf4b0846944d91d5b6919ddaa77326407ae3f28fb5b9cb38578ec24b90ad534a57c99f300d129ed4a211c375641ececa84caeabc688920f068dd57e7b10
SSDEEP

96:uzVs+ux7JiLLY1k9o84d12ef7CSTUaZcEZ7ru7f:csz7JiAYS/tb76f

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
2956	msedge.exe
2956	msedge.exe
2352	identity_helper.exe
2352	identity_helper.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 4152	2956	msedge.exe	84
PID 2956 wrote to memory of 4152	2956	msedge.exe	84
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4176	2956	msedge.exe	85
PID 2956 wrote to memory of 4568	2956	msedge.exe	86
PID 2956 wrote to memory of 4568	2956	msedge.exe	86
PID 2956 wrote to memory of 3280	2956	msedge.exe	87
PID 2956 wrote to memory of 3280	2956	msedge.exe	87
PID 2956 wrote to memory of 3280	2956	msedge.exe	87
PID 2956 wrote to memory of 3280	2956	msedge.exe	87
PID 2956 wrote to memory of 3280	2956	msedge.exe	87
PID 2956 wrote to memory of 3280	2956	msedge.exe	87
PID 2956 wrote to memory of 3280	2956	msedge.exe	87
PID 2956 wrote to memory of 3280	2956	msedge.exe	87
PID 2956 wrote to memory of 3280	2956	msedge.exe	87
PID 2956 wrote to memory of 3280	2956	msedge.exe	87
PID 2956 wrote to memory of 3280	2956	msedge.exe	87
PID 2956 wrote to memory of 3280	2956	msedge.exe	87
PID 2956 wrote to memory of 3280	2956	msedge.exe	87
PID 2956 wrote to memory of 3280	2956	msedge.exe	87
PID 2956 wrote to memory of 3280	2956	msedge.exe	87
PID 2956 wrote to memory of 3280	2956	msedge.exe	87
PID 2956 wrote to memory of 3280	2956	msedge.exe	87
PID 2956 wrote to memory of 3280	2956	msedge.exe	87
PID 2956 wrote to memory of 3280	2956	msedge.exe	87
PID 2956 wrote to memory of 3280	2956	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8a62fe6942af5f14a22395ae0d2df86f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8b7ca46f8,0x7ff8b7ca4708,0x7ff8b7ca4718
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,15551981513206749773,14929271818619920702,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,15551981513206749773,14929271818619920702,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,15551981513206749773,14929271818619920702,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15551981513206749773,14929271818619920702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15551981513206749773,14929271818619920702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,15551981513206749773,14929271818619920702,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,15551981513206749773,14929271818619920702,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15551981513206749773,14929271818619920702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15551981513206749773,14929271818619920702,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15551981513206749773,14929271818619920702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15551981513206749773,14929271818619920702,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,15551981513206749773,14929271818619920702,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1840 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b0e9fec0b3c681f59f5ccaeb68a65eb4

SHA1
2d89ddab93b0bbfb6a69542d4992162b0333f32f

SHA256
7d6d29d852bff96a7f98c97b5b9c4537beaddbe2b85561bc046fb3ede3f989db

SHA512
79e5960420fb26b108166ab2f0174d68522537fb99e44ba93fb9d6072f172573df4ce08d2095ca454375f4373b57dfcee30dd55eff1c4a0f58515b3271b78ebd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8b08cffa25948f008f2f29faedf79e08

SHA1
f0a571b52d9188c3c51f12af1b8bad8d8a5ddf0e

SHA256
d21644f3dd296ff9ea209f353ba451b6baa4f1068f869291c365f3f78a1dccc1

SHA512
111e9598714586acf1ba44d2c3bea3eac2a0cd0fd3d6fa62b52544edf477df8144f3b2c685b8841788a07b2b5068203fce26b9fb95300319dea56b10f3c3f8e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2b190e89bcd5e0a0edf1807d9edd04c6

SHA1
f02931b1ba038470bcdfac123ce275aacb72a62d

SHA256
8903143a4288d4e4d9ce51e9c3c4a34b3acd40a28f6895c6404e37fe6d62e83f

SHA512
3ebf8ad6559a79e792c2563aca9095752787bf8cdb815bac853e8df447505ff3d775e5770c24030888df7a23ccb9f6112697a5e34e15619e483cd2e6487c8ded

Download Submit