5829e046caf459ebb498c5a24cf8bceaa77c6777b18366829deaa614fdcecad5

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-08-2024 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be095b112cdde8cde1fd54c84502c21f_JaffaCakes118.html
Size

70KB
MD5

be095b112cdde8cde1fd54c84502c21f
SHA1

5c6fccd792db938cb04f0fe474a458ba7c495547
SHA256

5829e046caf459ebb498c5a24cf8bceaa77c6777b18366829deaa614fdcecad5
SHA512

e806d04cf21f5afbebb6a44aff4c8031f652fdaf7a2578b08fcfcf117c091cc6783aa373fc83bcfa9cdc142306a37b2d84b81612e77565529804a5508deeff39
SSDEEP

768:Ji/gcMWR3sI2PDDnd0g6M6jHoT2e1wCZkoTyMdtbBnfBgN8/lboiGhcRfQFVG8sM:JpcITTNen0tbrga90hc+NnhVJ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2272	msedge.exe
2272	msedge.exe
5076	msedge.exe
5076	msedge.exe
3844	identity_helper.exe
3844	identity_helper.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 4952	5076	msedge.exe	86
PID 5076 wrote to memory of 4952	5076	msedge.exe	86
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 3308	5076	msedge.exe	87
PID 5076 wrote to memory of 2272	5076	msedge.exe	88
PID 5076 wrote to memory of 2272	5076	msedge.exe	88
PID 5076 wrote to memory of 3588	5076	msedge.exe	89
PID 5076 wrote to memory of 3588	5076	msedge.exe	89
PID 5076 wrote to memory of 3588	5076	msedge.exe	89
PID 5076 wrote to memory of 3588	5076	msedge.exe	89
PID 5076 wrote to memory of 3588	5076	msedge.exe	89
PID 5076 wrote to memory of 3588	5076	msedge.exe	89
PID 5076 wrote to memory of 3588	5076	msedge.exe	89
PID 5076 wrote to memory of 3588	5076	msedge.exe	89
PID 5076 wrote to memory of 3588	5076	msedge.exe	89
PID 5076 wrote to memory of 3588	5076	msedge.exe	89
PID 5076 wrote to memory of 3588	5076	msedge.exe	89
PID 5076 wrote to memory of 3588	5076	msedge.exe	89
PID 5076 wrote to memory of 3588	5076	msedge.exe	89
PID 5076 wrote to memory of 3588	5076	msedge.exe	89
PID 5076 wrote to memory of 3588	5076	msedge.exe	89
PID 5076 wrote to memory of 3588	5076	msedge.exe	89
PID 5076 wrote to memory of 3588	5076	msedge.exe	89
PID 5076 wrote to memory of 3588	5076	msedge.exe	89
PID 5076 wrote to memory of 3588	5076	msedge.exe	89
PID 5076 wrote to memory of 3588	5076	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\be095b112cdde8cde1fd54c84502c21f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9addf46f8,0x7ff9addf4708,0x7ff9addf4718
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,6170817306211920045,12657013517528624040,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,6170817306211920045,12657013517528624040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,6170817306211920045,12657013517528624040,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6170817306211920045,12657013517528624040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6170817306211920045,12657013517528624040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,6170817306211920045,12657013517528624040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,6170817306211920045,12657013517528624040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6170817306211920045,12657013517528624040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6170817306211920045,12657013517528624040,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6170817306211920045,12657013517528624040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6170817306211920045,12657013517528624040,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,6170817306211920045,12657013517528624040,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5a5d500f53d873fe5bee083d5f9b328e

SHA1
77176a8a800a87f409888e5e05a7b33d5456dcaf

SHA256
605bb78bba2bcef1cdce4c2bf6776f8e60e36398d0e70187072722812ca73dbe

SHA512
c9f4cf94517dc2effeca328a09fc5baede8066dea26a1d216f619e87b389d464ed839c537e962f683ea44929b2c5857a55b443301dd7832cf6a2d1d953605ae7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d30c0f51532052cb6fedc731b380fc77

SHA1
839bd0f60a4f05328fe50df6a2b7d7cd1b7f6492

SHA256
551ae40b2ea023729d13697808fd7fbafdc8cdc2cf68ca4153b515e42a7a5633

SHA512
44376873574913dfebf1b3e54c17fe866ca2cc18136782d5c53d4cbcd001f709da766aa816e66523ed3b2dbcea76a0f6f3fc9fc626dbdd29fe2cad392396f57b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
43be241bc57fc115201ca224d1cd1919

SHA1
c2afaf8db471d8a6feb145dcb09de5b0957abb64

SHA256
cd0e5e7770b150cb7dacbb75779fbe0374ec459b11cba8d36339214b4f8c503f

SHA512
7f2cfd6afdf6b86529d71e566fab355d2b60fa0e6b83f580c0561e79fbc3aefa375f7473e5eaefb66062188b4b4f4a02c381c3f8436ef0b4618ae3ee047c0f8f

Download Submit