c1ee79a9536d5fa6ad2678dcea6256a1fbb0c990ee438ffaae68f1a20ac0dabc

Analysis

max time kernel
145s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-08-2024 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95e61e025350266fab5bb091ba79e617_JaffaCakes118.html
Size

488KB
MD5

95e61e025350266fab5bb091ba79e617
SHA1

5228a2728d9871f353b1c20a903703ce5524166b
SHA256

c1ee79a9536d5fa6ad2678dcea6256a1fbb0c990ee438ffaae68f1a20ac0dabc
SHA512

8e33968b420a1e38d184e32a5f4a943787afeac374eb88106bc39e5bdad643b11ecdbd8afab0685d1c578f4ef26aafd1624f9703ec071cfb8aadccc765dc52d5
SSDEEP

6144:SFM/d3t4NoDAyDfnLtxCJJkN4UL2Q082kSiTxDvpCN:xZDtLtxCJotn0bt4be

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4904	msedge.exe
4904	msedge.exe
1588	msedge.exe
1588	msedge.exe
3716	identity_helper.exe
3716	identity_helper.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 232	1588	msedge.exe	84
PID 1588 wrote to memory of 232	1588	msedge.exe	84
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 2612	1588	msedge.exe	85
PID 1588 wrote to memory of 4904	1588	msedge.exe	86
PID 1588 wrote to memory of 4904	1588	msedge.exe	86
PID 1588 wrote to memory of 3064	1588	msedge.exe	87
PID 1588 wrote to memory of 3064	1588	msedge.exe	87
PID 1588 wrote to memory of 3064	1588	msedge.exe	87
PID 1588 wrote to memory of 3064	1588	msedge.exe	87
PID 1588 wrote to memory of 3064	1588	msedge.exe	87
PID 1588 wrote to memory of 3064	1588	msedge.exe	87
PID 1588 wrote to memory of 3064	1588	msedge.exe	87
PID 1588 wrote to memory of 3064	1588	msedge.exe	87
PID 1588 wrote to memory of 3064	1588	msedge.exe	87
PID 1588 wrote to memory of 3064	1588	msedge.exe	87
PID 1588 wrote to memory of 3064	1588	msedge.exe	87
PID 1588 wrote to memory of 3064	1588	msedge.exe	87
PID 1588 wrote to memory of 3064	1588	msedge.exe	87
PID 1588 wrote to memory of 3064	1588	msedge.exe	87
PID 1588 wrote to memory of 3064	1588	msedge.exe	87
PID 1588 wrote to memory of 3064	1588	msedge.exe	87
PID 1588 wrote to memory of 3064	1588	msedge.exe	87
PID 1588 wrote to memory of 3064	1588	msedge.exe	87
PID 1588 wrote to memory of 3064	1588	msedge.exe	87
PID 1588 wrote to memory of 3064	1588	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\95e61e025350266fab5bb091ba79e617_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdce3446f8,0x7ffdce344708,0x7ffdce344718
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,10888520972746303274,14662105066082317012,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,10888520972746303274,14662105066082317012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,10888520972746303274,14662105066082317012,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10888520972746303274,14662105066082317012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10888520972746303274,14662105066082317012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,10888520972746303274,14662105066082317012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,10888520972746303274,14662105066082317012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10888520972746303274,14662105066082317012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10888520972746303274,14662105066082317012,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10888520972746303274,14662105066082317012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10888520972746303274,14662105066082317012,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,10888520972746303274,14662105066082317012,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1304 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9962aaf811ac8ce185e95243eb59e667

SHA1
1127728a61183ba26c25ff128c9a25659e24c2a8

SHA256
f6124cb9441085c9dfdf52ff5cfc7c30907544beda2525a3f11640ad2f7ec43d

SHA512
d57aad5732a0fe0c11e7eb261f71cc4f44e9910bcee0a8ad2b5f4bd98d115712ff3fecbf68a6b4937048ee6f3cadc655f5849462166bb577d0406dfc5c984cb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1300c1fb82ac2ff474c5c42d9fe4eb74

SHA1
eaa10176ee5f0ac0281cc115511a1b0def4c1c0a

SHA256
c10f3c08e43751ec88c316ec8b02cd806115c82f76683f0cfc127d212a43aa0a

SHA512
8b33f0625f61b3e5b04b5a3f2a88014324b707b6a55a886e92959199e516a763f6c7f185649c34cf596146132dd0b6829e0e95307575734fc477e5dd8ad9df03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d43a22d98cd4a8557dc71aafefac6e3e

SHA1
32d7d9fc43c0cefcfe02823ac890a4fdc539fcc2

SHA256
2aba90b2dfc2da92a47bb114763c720bb644c6febb088e3987eb03274bcb906c

SHA512
c11bc7d144d4b57ad8e6202d39defd2327d119ab27cb57a02f05756767170f7e9dc941ead1a3ba876e9471653d1c17bf50e170a142d5de053651e98f0a481b36

Download Submit