5f50c0d47193f470c69eda93c3f3868d48ee2e2271d70df6aa9caf12c46eba8d

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5c544578c324b4bfb0efb988f72bfc2_JaffaCakes118.html
Size

4KB
MD5

b5c544578c324b4bfb0efb988f72bfc2
SHA1

ca24a2914b04393c265abb1898974db75999b9a6
SHA256

5f50c0d47193f470c69eda93c3f3868d48ee2e2271d70df6aa9caf12c46eba8d
SHA512

7d1c7d14b68048a7e228a9e94bf7667cdb9ed6e4bd34ac1564629adb7dd344fe3f952472090d06e649a11ead625c695fa85ec499a167dec3934872dd93a3b3a6
SSDEEP

96:1usYOt8lBO+4cywt7CtL/Puo6f1NrjCCk0U4lJ/VR0GVkF0D0:YsYOtKB540tQL/Puo6f1N3CCp/lJ9R0F

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
3132	msedge.exe
3132	msedge.exe
2364	identity_helper.exe
2364	identity_helper.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 3584	3132	msedge.exe	84
PID 3132 wrote to memory of 3584	3132	msedge.exe	84
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2092	3132	msedge.exe	85
PID 3132 wrote to memory of 2344	3132	msedge.exe	86
PID 3132 wrote to memory of 2344	3132	msedge.exe	86
PID 3132 wrote to memory of 4908	3132	msedge.exe	87
PID 3132 wrote to memory of 4908	3132	msedge.exe	87
PID 3132 wrote to memory of 4908	3132	msedge.exe	87
PID 3132 wrote to memory of 4908	3132	msedge.exe	87
PID 3132 wrote to memory of 4908	3132	msedge.exe	87
PID 3132 wrote to memory of 4908	3132	msedge.exe	87
PID 3132 wrote to memory of 4908	3132	msedge.exe	87
PID 3132 wrote to memory of 4908	3132	msedge.exe	87
PID 3132 wrote to memory of 4908	3132	msedge.exe	87
PID 3132 wrote to memory of 4908	3132	msedge.exe	87
PID 3132 wrote to memory of 4908	3132	msedge.exe	87
PID 3132 wrote to memory of 4908	3132	msedge.exe	87
PID 3132 wrote to memory of 4908	3132	msedge.exe	87
PID 3132 wrote to memory of 4908	3132	msedge.exe	87
PID 3132 wrote to memory of 4908	3132	msedge.exe	87
PID 3132 wrote to memory of 4908	3132	msedge.exe	87
PID 3132 wrote to memory of 4908	3132	msedge.exe	87
PID 3132 wrote to memory of 4908	3132	msedge.exe	87
PID 3132 wrote to memory of 4908	3132	msedge.exe	87
PID 3132 wrote to memory of 4908	3132	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b5c544578c324b4bfb0efb988f72bfc2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9991f46f8,0x7ff9991f4708,0x7ff9991f4718
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,1766541788221746486,3932739353825011564,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,1766541788221746486,3932739353825011564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,1766541788221746486,3932739353825011564,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1766541788221746486,3932739353825011564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1766541788221746486,3932739353825011564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1766541788221746486,3932739353825011564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,1766541788221746486,3932739353825011564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,1766541788221746486,3932739353825011564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1766541788221746486,3932739353825011564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1766541788221746486,3932739353825011564,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1766541788221746486,3932739353825011564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1766541788221746486,3932739353825011564,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,1766541788221746486,3932739353825011564,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3120 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
0290126b1d551fc073171ee41854ff6e

SHA1
846c9345f501d5b81ff244499f3f89ef6bca170e

SHA256
5211d58d76eb3a7be718a68ae2e2267608cfbd6080de7024d87562ef1fe06af2

SHA512
c7646af48b1134f8a74e97b86b051826bc3df7dc42ee94304a49fab1641299e0df53b9874ae29f97898319c0b60f1c23ae6448bc1d3bebec93c48703afe23dc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c757d2d6790a2edd0bd540883aae3b09

SHA1
91218ebd7bdc0960a3c05e4b8d59d237c051a9e0

SHA256
109de925299d1dcb100a7f2c8885f642e58029bc7014f589e0b488d0809715ec

SHA512
489bedd0d71cda1b14a753ec38ff9ac182f88e029a4c560dda5917c3699d4ae946642d683da0a101b306dcda77ee3f9aff8f93d7df40d1aa80d4332718770aaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
85d557224cd50de6bd26f9e1816a3db0

SHA1
633eae0bbf4c1f64f0d68db88094894f4699ebdb

SHA256
0964903990921daef80e925dff4b17993b8772cd8591819edd3ee9278b39b22a

SHA512
569f39e9ed34b62604c80a015a62a2d0b1b7f386167dcbeb058d2d4c96d4cd950a140bd0e5e2f7ff3f03e14380094657f20ccb065211561d07358aacac2903a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3827807d662c098bd443f467291d0e51

SHA1
2623a324e18140ab5c7efbe16f2832ec137a356b

SHA256
f632383651da04efffa2177fa2a43cb91b6b522777e94d7b79df55ef53806853

SHA512
b67dc6869a63ce656200cf971e4b2cc177011609596ae822941f71bc493d719e6a79c0d7dd7e41066af60ae43900cbdceee19886591f3ad4ec5edccb588887ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
92ec5e6d9fe8bf58b86c6ae242cbbe6d

SHA1
39a4aab3bae7574edec6ac34af1974dff4f85697

SHA256
f0939bf986985fdbbfff826e839823385b672dfa8166cba699526d5aaa0155d4

SHA512
b77627e56c04fab80ce8e0733df12f839a51b6667b9a0116366710b30d784b3164c60403798ed05d8c1d81654cd4055377e89105b686b2e9fe0b3da592a65f03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b2e4246c4d1dea833c6a5fd0ee92808a

SHA1
2014bfceffa7c89c72af7ad4c1c6de6764a5368b

SHA256
a3250b4ded1085fb8bd8e56fb2dd6c5d326fe4df91a3bd22d60efb787256b8e7

SHA512
71501924527921c368752676c405e26ff7974fefa64fdfc9f9eeb5c4fbcd34a455f90b293ab32a96994fb58f3477ebc5a9f9ea45394cd4765a7ff34e4a661f50

Download Submit