5bb0ee062c98c9edc7e1b86b8ddd2462e3edfec8c72da704a7570451aa6ec398

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bec767ed61e633da8732b1c3dc34ebd7_JaffaCakes118.html
Size

4KB
MD5

bec767ed61e633da8732b1c3dc34ebd7
SHA1

5764ae9a561d1ac30efc64837f43c6cc48a815e1
SHA256

5bb0ee062c98c9edc7e1b86b8ddd2462e3edfec8c72da704a7570451aa6ec398
SHA512

8fe466f1ed2aebec06c54e9759797d8903429c02d87a1d74dc488885158ee2161f514b7129ae38511aa6cfb04ab9ccf9799dbfaba4b1749cf058b6b30500d8d8
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o0v5HTd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDj

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1208	msedge.exe
1208	msedge.exe
2660	msedge.exe
2660	msedge.exe
2648	identity_helper.exe
2648	identity_helper.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe
5124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 4172	2660	msedge.exe	83
PID 2660 wrote to memory of 4172	2660	msedge.exe	83
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 3744	2660	msedge.exe	85
PID 2660 wrote to memory of 1208	2660	msedge.exe	86
PID 2660 wrote to memory of 1208	2660	msedge.exe	86
PID 2660 wrote to memory of 3600	2660	msedge.exe	87
PID 2660 wrote to memory of 3600	2660	msedge.exe	87
PID 2660 wrote to memory of 3600	2660	msedge.exe	87
PID 2660 wrote to memory of 3600	2660	msedge.exe	87
PID 2660 wrote to memory of 3600	2660	msedge.exe	87
PID 2660 wrote to memory of 3600	2660	msedge.exe	87
PID 2660 wrote to memory of 3600	2660	msedge.exe	87
PID 2660 wrote to memory of 3600	2660	msedge.exe	87
PID 2660 wrote to memory of 3600	2660	msedge.exe	87
PID 2660 wrote to memory of 3600	2660	msedge.exe	87
PID 2660 wrote to memory of 3600	2660	msedge.exe	87
PID 2660 wrote to memory of 3600	2660	msedge.exe	87
PID 2660 wrote to memory of 3600	2660	msedge.exe	87
PID 2660 wrote to memory of 3600	2660	msedge.exe	87
PID 2660 wrote to memory of 3600	2660	msedge.exe	87
PID 2660 wrote to memory of 3600	2660	msedge.exe	87
PID 2660 wrote to memory of 3600	2660	msedge.exe	87
PID 2660 wrote to memory of 3600	2660	msedge.exe	87
PID 2660 wrote to memory of 3600	2660	msedge.exe	87
PID 2660 wrote to memory of 3600	2660	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bec767ed61e633da8732b1c3dc34ebd7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbc77b46f8,0x7ffbc77b4708,0x7ffbc77b4718
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,17186800309498414565,16511548645327369439,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,17186800309498414565,16511548645327369439,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,17186800309498414565,16511548645327369439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17186800309498414565,16511548645327369439,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17186800309498414565,16511548645327369439,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,17186800309498414565,16511548645327369439,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,17186800309498414565,16511548645327369439,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17186800309498414565,16511548645327369439,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17186800309498414565,16511548645327369439,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17186800309498414565,16511548645327369439,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17186800309498414565,16511548645327369439,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,17186800309498414565,16511548645327369439,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5264 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
292B

MD5
e4afb49996dd7118f2df8f90e1d9e435

SHA1
2110e452637addb70bbfee7d697ac4ceaf5f8af8

SHA256
4c4b5e9dbb43280d4f278c709cb64fa7fe3106c19e912ba5eb611fffe8e7da21

SHA512
8df08d51c58fb28f91565a57ecf31ff3fed585775d3e9bab4d4844c933d74f80d1722c1d00db4a0fca88986210227dca97483c43ae3877830b3a330cf7185a78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f9873530a0ca3638aaeaef785787bc47

SHA1
babd488578a2562c15ac775bf3649d2f8914ed6e

SHA256
a575ff7fe94b0aabcc37eba1ceaf4b5dbcd2eebe96344204edd7936e77ce41d4

SHA512
109a906ff6f2f739cd6e29bd26bb360b64901f41c5b385961f0f6723510feb44475c2c152813e374c20779c3bf249afcd538427e4ecad808962346b360ab9a01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
12a2575e6c8f6a9deee293a288a44880

SHA1
ff3217037857649956adcd820bb8e6139cc37add

SHA256
795b359548f2abc99efb67e294755db925aa8cbe68be606cae9377a5b5726941

SHA512
327a7be84699f5c5fd1769d1650e883469a0bb683502f37707ce778c63f72e3b7e8e5676124de73685be769a0ab09b6bd4dcf5603a654593429996d21b9c4b3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
19b1e613b6dd389137e4d40bc3681227

SHA1
c89d792767c94b739c60d71e07cc40491c8e8c58

SHA256
3dea7b173c8b0221e4552d80a0ea1376a0af27652c9b3dcd01d59fe13c02ab04

SHA512
816a18a53b7cd9dcd15d3f9d97a5286130c78df324ab5d90e8d984e471b5cae6e06512a7f9fbee00a5fc22e425f30a2b229720ed7afb32821dc52d9d978a8a0d

Download Submit