fb5c6cb00b081468aa7dc1db8a40873363a9a0e9ac3f4d8d3008843700fe5c0c

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 09:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aea8b9cd92632a440b7673a2d3b05bb3_JaffaCakes118.html
Size

58KB
MD5

aea8b9cd92632a440b7673a2d3b05bb3
SHA1

cbb2681429c646f4a2bde67cfd579ba2f8c1b63c
SHA256

fb5c6cb00b081468aa7dc1db8a40873363a9a0e9ac3f4d8d3008843700fe5c0c
SHA512

ba19a3901969debf7926fa5c9f559c1eda14dc93708455a5b06cb0b6ff316cb8e8d9b6035e1e6a7b1d608ca48efa62bf63f03a0474af08bc90be4820ab12154d
SSDEEP

1536:7M2iIPi0rhkio1OetFRRMRvtHDhxWsMj32ZafnMxBy1DZq6JEKVTsLQ6PoDB:7Do1OetFReRvtHDhxWsMj32ZafnMxBy1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe
4808	msedge.exe
4808	msedge.exe
4188	identity_helper.exe
4188	identity_helper.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 2976	4808	msedge.exe	84
PID 4808 wrote to memory of 2976	4808	msedge.exe	84
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 672	4808	msedge.exe	85
PID 4808 wrote to memory of 3568	4808	msedge.exe	86
PID 4808 wrote to memory of 3568	4808	msedge.exe	86
PID 4808 wrote to memory of 3512	4808	msedge.exe	87
PID 4808 wrote to memory of 3512	4808	msedge.exe	87
PID 4808 wrote to memory of 3512	4808	msedge.exe	87
PID 4808 wrote to memory of 3512	4808	msedge.exe	87
PID 4808 wrote to memory of 3512	4808	msedge.exe	87
PID 4808 wrote to memory of 3512	4808	msedge.exe	87
PID 4808 wrote to memory of 3512	4808	msedge.exe	87
PID 4808 wrote to memory of 3512	4808	msedge.exe	87
PID 4808 wrote to memory of 3512	4808	msedge.exe	87
PID 4808 wrote to memory of 3512	4808	msedge.exe	87
PID 4808 wrote to memory of 3512	4808	msedge.exe	87
PID 4808 wrote to memory of 3512	4808	msedge.exe	87
PID 4808 wrote to memory of 3512	4808	msedge.exe	87
PID 4808 wrote to memory of 3512	4808	msedge.exe	87
PID 4808 wrote to memory of 3512	4808	msedge.exe	87
PID 4808 wrote to memory of 3512	4808	msedge.exe	87
PID 4808 wrote to memory of 3512	4808	msedge.exe	87
PID 4808 wrote to memory of 3512	4808	msedge.exe	87
PID 4808 wrote to memory of 3512	4808	msedge.exe	87
PID 4808 wrote to memory of 3512	4808	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\aea8b9cd92632a440b7673a2d3b05bb3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9df2f46f8,0x7ff9df2f4708,0x7ff9df2f4718
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,381835603064039079,2832632789592261627,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,381835603064039079,2832632789592261627,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,381835603064039079,2832632789592261627,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,381835603064039079,2832632789592261627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,381835603064039079,2832632789592261627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,381835603064039079,2832632789592261627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,381835603064039079,2832632789592261627,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,381835603064039079,2832632789592261627,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,381835603064039079,2832632789592261627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,381835603064039079,2832632789592261627,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,381835603064039079,2832632789592261627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,381835603064039079,2832632789592261627,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,381835603064039079,2832632789592261627,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5908 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
303B

MD5
d28dc5c9c25d69d5fdfdbe9d0c01bd26

SHA1
e198fe7b1993350a87bf2d89aed76b3b80231e45

SHA256
a713cc5686e515c55b7ec9ced9a02d911ae17cfe2a813053ae5dbf691b6b49f9

SHA512
9ce34f4ee29ea5fab4c269c44b41d43980afd051d4dd081ec0dac2c037f254904217ce81585b859327b124c8a2b0f9900c57506264d6ca6f12ef3c1ce3bc1bb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ea569a6d5f4928efd048f6966fada711

SHA1
f7e52049eceacce3c124f0eca04f9d07e475de43

SHA256
f79de78936feddf46393809a4e319da54d5c3944866135c5b297cad912181c34

SHA512
cd148d0f20e9116fb93877701c0533f24bd462f010d36f1298db6009fc25eb2e4eb3e17e422f3997e50bbb38c777d8ab1cc59d08c576396ecb2f3daae44e60db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
edb545210a52f4a2c5a8ffa5d2793932

SHA1
6aebb786e6e8492b4966b3791cb5929fea797b31

SHA256
245e6f0505cec57300f7e6b932cedf9bb48234695c39ecc99c103ab94e4f9bfa

SHA512
71caf53634672d0d1408eb10be81fb8f368f3bfac6781c6e46516da181155895745e38efcbd3421a0031e53744e8238b662820f6997bf8ee660df2d09675d4f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
03758b8032c3685f42281bd105e9afbe

SHA1
8edc9cb3e06cfeaf796b5d0fb012a796afe174bb

SHA256
f1909f72f54846f40b064a36a362e06cf03ee7a4b009b67eb4251bb59eccacbd

SHA512
d53eb9e253f5e1170244bf750d1bd2a579f052aca9ad2c58928457a67caa3ead01e55f999b5e29848729ea21452d376f3a23fb8239fd079cc3101426216ad0c3

Download Submit