8f6d55a3a580c3d1212993b9a7c5eceed3dfa0e7c5b7e3c2e1633af5129e7b6a

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-08-2024 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be5c7afce9e927f6c773d399e2433e45_JaffaCakes118.html
Size

190KB
MD5

be5c7afce9e927f6c773d399e2433e45
SHA1

95bccd14327566d7184d88584afd52c6763bb0fd
SHA256

8f6d55a3a580c3d1212993b9a7c5eceed3dfa0e7c5b7e3c2e1633af5129e7b6a
SHA512

52be74181d00cbc1d76caf9338416fb5a1520572df2961750ddc15500f88ef360c765d17857978464345e896545cf3587153657e39bfe9c57440e5189c7b262f
SSDEEP

3072:pkqeSGfBr5fUmj2es9poAQQ/DMBZIy0yB6VIj0y:uqwUmj7ZIe

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
4496	msedge.exe
4496	msedge.exe
3460	identity_helper.exe
3460	identity_helper.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 3712	4496	msedge.exe	84
PID 4496 wrote to memory of 3712	4496	msedge.exe	84
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 2588	4496	msedge.exe	85
PID 4496 wrote to memory of 1072	4496	msedge.exe	86
PID 4496 wrote to memory of 1072	4496	msedge.exe	86
PID 4496 wrote to memory of 1308	4496	msedge.exe	87
PID 4496 wrote to memory of 1308	4496	msedge.exe	87
PID 4496 wrote to memory of 1308	4496	msedge.exe	87
PID 4496 wrote to memory of 1308	4496	msedge.exe	87
PID 4496 wrote to memory of 1308	4496	msedge.exe	87
PID 4496 wrote to memory of 1308	4496	msedge.exe	87
PID 4496 wrote to memory of 1308	4496	msedge.exe	87
PID 4496 wrote to memory of 1308	4496	msedge.exe	87
PID 4496 wrote to memory of 1308	4496	msedge.exe	87
PID 4496 wrote to memory of 1308	4496	msedge.exe	87
PID 4496 wrote to memory of 1308	4496	msedge.exe	87
PID 4496 wrote to memory of 1308	4496	msedge.exe	87
PID 4496 wrote to memory of 1308	4496	msedge.exe	87
PID 4496 wrote to memory of 1308	4496	msedge.exe	87
PID 4496 wrote to memory of 1308	4496	msedge.exe	87
PID 4496 wrote to memory of 1308	4496	msedge.exe	87
PID 4496 wrote to memory of 1308	4496	msedge.exe	87
PID 4496 wrote to memory of 1308	4496	msedge.exe	87
PID 4496 wrote to memory of 1308	4496	msedge.exe	87
PID 4496 wrote to memory of 1308	4496	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\be5c7afce9e927f6c773d399e2433e45_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97c7046f8,0x7ff97c704708,0x7ff97c704718
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,2510206230165093334,13205573031073086865,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,2510206230165093334,13205573031073086865,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,2510206230165093334,13205573031073086865,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2510206230165093334,13205573031073086865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2510206230165093334,13205573031073086865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,2510206230165093334,13205573031073086865,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,2510206230165093334,13205573031073086865,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2510206230165093334,13205573031073086865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2510206230165093334,13205573031073086865,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2510206230165093334,13205573031073086865,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2510206230165093334,13205573031073086865,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,2510206230165093334,13205573031073086865,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4936 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
afe7af08335388921151e07184ae6807

SHA1
19449babf0fda51c423f11a660dfad10e33f4b8e

SHA256
94d73f3f9585382408643a73b69226e5d080e3ab989aa345569a03e0e807ba57

SHA512
ec91356c6b0e4db8b1e19af03e108e76da212495b60b64c67e07f414255e4861d51443bf1945a2f36d233951d796362aec00ba21cef4c4bc10c44bf2b0c58e21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8807ccc937708d230dce774be7b231cb

SHA1
c7588056931a2a0a4d2efa1dbd767889eb4b407c

SHA256
59180c1ef1ede484577152cf3cb2eb9fae4b15bb9dbc8ba93d146d03a0f10854

SHA512
2aed950d3aea41a8a9233393cc662f1ef4d47fff01317284ba46dddd0098160ed00502b1d44f0bf53ca92c89996d42870fcd7b07f8af3e9275e880a29b0aefc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
17717d6b1621949ede233a77b5b829f3

SHA1
29a2499a5493131341cd903f5e59f1f5126eb841

SHA256
3dc48419b1078a5dbca4a30f4ea68171038fe5fd908362415cb43f20f94a8f96

SHA512
2267c4ae4a98aff6bab08c71bf1b61fbba680439e2bd14f72efcad87f9b49062883aeda83d309e3503d75d522389f65fbd89da2c12574150178ec7cccd6736fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
50cfe7f703a2c943fbd0b5a6bf79662d

SHA1
a5f08d97a986c65aae052a2f3b7e7b5102fc89d8

SHA256
dbd8707a6157c1f4b3bf4786acefa16d482e4899eeb2814084bcbeb534ced9c4

SHA512
43c943d5eb20cde6210dd65a50c02c1f5853bdd874d7df8fbe991a1efd88bcc3a820531c620085dc52d7e027f7ebf1cdabaa12f82eb5157d7be2d5e989fe9d39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b2160bd815265a900c7ddc7a6addd03f

SHA1
cfbff44f995be8cddcab0827c43200a56f7fb5d9

SHA256
630035cc609f2db624adf5fdd812ba885bc19ea268f8f9f702c995a86e7ff73a

SHA512
a2652d6718cee6c2f95f38b9f43aff9e6b5c653403f8a14c8316aaac1baf8bfe10134dcc41fa4f05cb9cc946c9c037e43bb3b4b4acdee31760706edad396b5f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dd52a7b5beb9d0b0ef62bcc1ea719136

SHA1
4e544ee95185084f28c28e626549e70aee9a7368

SHA256
9f80ca9f7d6dffd045669134867bfdc5471745387c11dfec1ead49fec2b19ab7

SHA512
eb194b5ae9954b9428b5f16950744004a614131bc7abaa66605b3cfeca41d3f07ad9be0e9fa02edd322f72c6c1d441b6bdd06d4fb40aa43df383d22b128931e9

Download Submit