20f793fdecd9773d1d2412e4adc8a4beb5e0dea6675cc539deaf6ad9799f2599

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 05:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae0512a82b640e1a0edb52e9249f1b48_JaffaCakes118.html
Size

33KB
MD5

ae0512a82b640e1a0edb52e9249f1b48
SHA1

ee42a1b6bdb920f727577f769c25c614f1fb7c3b
SHA256

20f793fdecd9773d1d2412e4adc8a4beb5e0dea6675cc539deaf6ad9799f2599
SHA512

294c5c1e4829fb5541ea60863f46b1b8e1a93f40546ca0d7d934acca614ea4dc484c2d06707558e951541b70b585cbc7bf511160c5f71caf219ce64adc087f80
SSDEEP

768:rF2Pkxc0BYUHzXw0zFyevtkrP4PnoWQqFbXr32G0:rF28xc0BYUHzXrFyevtkrwPo76b32H

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
5100	msedge.exe
5100	msedge.exe
3320	identity_helper.exe
3320	identity_helper.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 4428	5100	msedge.exe	84
PID 5100 wrote to memory of 4428	5100	msedge.exe	84
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 3148	5100	msedge.exe	85
PID 5100 wrote to memory of 4064	5100	msedge.exe	86
PID 5100 wrote to memory of 4064	5100	msedge.exe	86
PID 5100 wrote to memory of 2068	5100	msedge.exe	87
PID 5100 wrote to memory of 2068	5100	msedge.exe	87
PID 5100 wrote to memory of 2068	5100	msedge.exe	87
PID 5100 wrote to memory of 2068	5100	msedge.exe	87
PID 5100 wrote to memory of 2068	5100	msedge.exe	87
PID 5100 wrote to memory of 2068	5100	msedge.exe	87
PID 5100 wrote to memory of 2068	5100	msedge.exe	87
PID 5100 wrote to memory of 2068	5100	msedge.exe	87
PID 5100 wrote to memory of 2068	5100	msedge.exe	87
PID 5100 wrote to memory of 2068	5100	msedge.exe	87
PID 5100 wrote to memory of 2068	5100	msedge.exe	87
PID 5100 wrote to memory of 2068	5100	msedge.exe	87
PID 5100 wrote to memory of 2068	5100	msedge.exe	87
PID 5100 wrote to memory of 2068	5100	msedge.exe	87
PID 5100 wrote to memory of 2068	5100	msedge.exe	87
PID 5100 wrote to memory of 2068	5100	msedge.exe	87
PID 5100 wrote to memory of 2068	5100	msedge.exe	87
PID 5100 wrote to memory of 2068	5100	msedge.exe	87
PID 5100 wrote to memory of 2068	5100	msedge.exe	87
PID 5100 wrote to memory of 2068	5100	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ae0512a82b640e1a0edb52e9249f1b48_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffadbad46f8,0x7ffadbad4708,0x7ffadbad4718
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5452967231300001369,11856514715854122058,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,5452967231300001369,11856514715854122058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,5452967231300001369,11856514715854122058,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5452967231300001369,11856514715854122058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5452967231300001369,11856514715854122058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5452967231300001369,11856514715854122058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,5452967231300001369,11856514715854122058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,5452967231300001369,11856514715854122058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5452967231300001369,11856514715854122058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5452967231300001369,11856514715854122058,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5452967231300001369,11856514715854122058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5452967231300001369,11856514715854122058,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5452967231300001369,11856514715854122058,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\15afece7-fe00-4b19-b0a0-b9b4430cb6d2.tmp

Filesize
11KB

MD5
25da36d5c9cb85eec4668df9d49a692e

SHA1
1ec99adf01fc4ad9e4b969018503df4285e8e7d2

SHA256
e4c2c7ac38ff9d973f62f805b63764b3aa0dae08e76479541276d64d7610beee

SHA512
90d61c24b9d58fda11fb97e8f3118ff00a235140c420161332588381be2815a075813d0e9138d8dcfae35ca518f32f826d06c98ae3a7dd4aa1897a2cb380f09a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
260B

MD5
f9e3ac181b2429449b2fef1717a33368

SHA1
bbe317b22f8cb054c3f24fe04f6cb905fc932be3

SHA256
8d457b7f32dc2854940eb01e02be1183fbc80029d06402db14d21aa2be534ca3

SHA512
233b97b623e58f82a7145a70ec304f3d59e0e8e028962130f1f079c5c162f2c2ab977977fb9bdc4e04cbb5fb828cac3b51a64b7aadd2a14dac0717350747a8be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
35eca852be9cb18cabf44c536f64dc37

SHA1
b99ca5ed9a8bf7736eaf4d9ab6896a59a8edb217

SHA256
21361e557894dba8d2a9985b1122f7c7e719671b9686d3193aa1cabc4e897a3e

SHA512
4c69e7eac62168f65984b589cfcfcc2914006dc7af195d84a9e02e4b844413bf62a6f2c81f076ebf21eb9e19080c6e6a83284878e7be3ed591dc5825f65e4f55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b22031a594132a4ef64f3af6e1d561f9

SHA1
4f2cc53a3f719305c11890bc36d769c281690ead

SHA256
cb570443c2c7c01eeef3415c07325be075db34d225eef303e79a7df5a95a3799

SHA512
8636b02f412132149ef64da2c1f90856b36f13c94c683239c69dce951df1bf57dc1a7c7ef124bad47a7e0bbf0ef03d792856a74310d5c870f1c9915003abf279

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit