416017c735c9483da2ae564bba7bfa1924b605812139dc284ce26059f07b5af4

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 02:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a0e2deca5c2038c2fe4c1fda5ed34d26_JaffaCakes118.html
Size

6KB
MD5

a0e2deca5c2038c2fe4c1fda5ed34d26
SHA1

d9890a58f19a12b683b5213777e286a0d31747d7
SHA256

416017c735c9483da2ae564bba7bfa1924b605812139dc284ce26059f07b5af4
SHA512

ccfbdae6da5b87aa76554bcc3338b9218ce53ee7e5c9857e0c464c7504015dc43dfff2f506a42630433c23279304ae0da265ced9f3f85a95d09f55322ca7f5fb
SSDEEP

96:uzVs+ux7pRLLY1k9o84d12ef7CSTUq9/6/NcEZ7ru7f:csz7pRAYS/14Nb76f

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1452	msedge.exe
1452	msedge.exe
2160	msedge.exe
2160	msedge.exe
784	identity_helper.exe
784	identity_helper.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 3140	2160	msedge.exe	84
PID 2160 wrote to memory of 3140	2160	msedge.exe	84
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1376	2160	msedge.exe	85
PID 2160 wrote to memory of 1452	2160	msedge.exe	86
PID 2160 wrote to memory of 1452	2160	msedge.exe	86
PID 2160 wrote to memory of 396	2160	msedge.exe	87
PID 2160 wrote to memory of 396	2160	msedge.exe	87
PID 2160 wrote to memory of 396	2160	msedge.exe	87
PID 2160 wrote to memory of 396	2160	msedge.exe	87
PID 2160 wrote to memory of 396	2160	msedge.exe	87
PID 2160 wrote to memory of 396	2160	msedge.exe	87
PID 2160 wrote to memory of 396	2160	msedge.exe	87
PID 2160 wrote to memory of 396	2160	msedge.exe	87
PID 2160 wrote to memory of 396	2160	msedge.exe	87
PID 2160 wrote to memory of 396	2160	msedge.exe	87
PID 2160 wrote to memory of 396	2160	msedge.exe	87
PID 2160 wrote to memory of 396	2160	msedge.exe	87
PID 2160 wrote to memory of 396	2160	msedge.exe	87
PID 2160 wrote to memory of 396	2160	msedge.exe	87
PID 2160 wrote to memory of 396	2160	msedge.exe	87
PID 2160 wrote to memory of 396	2160	msedge.exe	87
PID 2160 wrote to memory of 396	2160	msedge.exe	87
PID 2160 wrote to memory of 396	2160	msedge.exe	87
PID 2160 wrote to memory of 396	2160	msedge.exe	87
PID 2160 wrote to memory of 396	2160	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a0e2deca5c2038c2fe4c1fda5ed34d26_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ff9e39c46f8,0x7ff9e39c4708,0x7ff9e39c4718
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,4548134378568800729,1894691374480187727,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,4548134378568800729,1894691374480187727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,4548134378568800729,1894691374480187727,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1464 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4548134378568800729,1894691374480187727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4548134378568800729,1894691374480187727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,4548134378568800729,1894691374480187727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,4548134378568800729,1894691374480187727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4548134378568800729,1894691374480187727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4548134378568800729,1894691374480187727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4548134378568800729,1894691374480187727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4548134378568800729,1894691374480187727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,4548134378568800729,1894691374480187727,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3108 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5f6e1caed4c65a07e602ae7da204e8b9

SHA1
c6e2c3f90f6f6f495104d1d40452641cd37ea6f7

SHA256
654f7b9b397756d247a997aa4cd76db25d40807e1894973ee9d1641937938274

SHA512
48cea7c0b7f63a1dc08bf099fa7e884ca0cdf5ab3fd97da9c6d54db8803e68204cef556a5997b51d2ad768b01904dc67935219f9caa86631fbde781cb84b7bdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
08892287fb880b14e496fce9362fd92e

SHA1
5938f5c28a3fbd03af2a5e2997e77e41991a162d

SHA256
68e433557aa6f1fe98fc7348320493e9861be6658e486a5d7bf375b57b7f7769

SHA512
2530d71e2eb1eacd3cb98603821c9bf71e5f8d6030da72d952de5e9950a2d7f405bc632892248fa4d4646c0a90f3342cac8a835a5fef4b8aac5f6a78161fabc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fa15999b84d5c2d0c4906e5d9f3c694b

SHA1
0f55d82fdaa80ddad1e05ef33406ed476e4671a6

SHA256
c92e03f819e84bc8267c2b32b2846777e5d4cc7958e1f5aa9d4a23636db43a3e

SHA512
bb471e1912c3fd31ccff96569f4930fab5ba09b1f7c43d2be0ab5858578a8c41e1dec3b806e2b7651c0cd8d15789787c9b364293eba856ebec5e55529985542d

Download Submit