482ec91b193b5be737f9bc4f74d049206d5229afd5cff83eea884bfaa53fd2c6

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-08-2024 15:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bee38c5a5099f2c70f9fba9f0f21dbca_JaffaCakes118.html
Size

4KB
MD5

bee38c5a5099f2c70f9fba9f0f21dbca
SHA1

a99b72c9398b125d545420e0d4423d32288d2ed6
SHA256

482ec91b193b5be737f9bc4f74d049206d5229afd5cff83eea884bfaa53fd2c6
SHA512

2890dedc3b4980482b01bda45d4b210aa7f1acc69e7b15d1bb55ad7d9f85d34e778056002f71465d61bcc7cdadb384f104814f2f0bacc8d16c867dd67809b151
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oS5Uod:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDV

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
2660	msedge.exe
2660	msedge.exe
4716	identity_helper.exe
4716	identity_helper.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe
2660	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 4640	2660	msedge.exe	84
PID 2660 wrote to memory of 4640	2660	msedge.exe	84
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 1856	2660	msedge.exe	85
PID 2660 wrote to memory of 4912	2660	msedge.exe	86
PID 2660 wrote to memory of 4912	2660	msedge.exe	86
PID 2660 wrote to memory of 3100	2660	msedge.exe	87
PID 2660 wrote to memory of 3100	2660	msedge.exe	87
PID 2660 wrote to memory of 3100	2660	msedge.exe	87
PID 2660 wrote to memory of 3100	2660	msedge.exe	87
PID 2660 wrote to memory of 3100	2660	msedge.exe	87
PID 2660 wrote to memory of 3100	2660	msedge.exe	87
PID 2660 wrote to memory of 3100	2660	msedge.exe	87
PID 2660 wrote to memory of 3100	2660	msedge.exe	87
PID 2660 wrote to memory of 3100	2660	msedge.exe	87
PID 2660 wrote to memory of 3100	2660	msedge.exe	87
PID 2660 wrote to memory of 3100	2660	msedge.exe	87
PID 2660 wrote to memory of 3100	2660	msedge.exe	87
PID 2660 wrote to memory of 3100	2660	msedge.exe	87
PID 2660 wrote to memory of 3100	2660	msedge.exe	87
PID 2660 wrote to memory of 3100	2660	msedge.exe	87
PID 2660 wrote to memory of 3100	2660	msedge.exe	87
PID 2660 wrote to memory of 3100	2660	msedge.exe	87
PID 2660 wrote to memory of 3100	2660	msedge.exe	87
PID 2660 wrote to memory of 3100	2660	msedge.exe	87
PID 2660 wrote to memory of 3100	2660	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bee38c5a5099f2c70f9fba9f0f21dbca_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcafda46f8,0x7ffcafda4708,0x7ffcafda4718
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,13663347101118631900,15910935847059972538,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,13663347101118631900,15910935847059972538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,13663347101118631900,15910935847059972538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13663347101118631900,15910935847059972538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13663347101118631900,15910935847059972538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,13663347101118631900,15910935847059972538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,13663347101118631900,15910935847059972538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13663347101118631900,15910935847059972538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13663347101118631900,15910935847059972538,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13663347101118631900,15910935847059972538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13663347101118631900,15910935847059972538,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,13663347101118631900,15910935847059972538,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2632 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8a871839-30e5-477a-a914-edc43117fa96.tmp

Filesize
5KB

MD5
bba0573bba1e150c3fffe89eaa3d5304

SHA1
2745998e90bca5d6d85f8d80d1e1b61be3acc24d

SHA256
5211307cf7d200c505ff06be21c5940bdec8db0bf82d0179bd62ac3999a8d150

SHA512
4bbc3d446c55935ee59ab2d778a5644694e86448aafc060dab3b7d60bd11b84126ed64bc18fd153754343117c0d7b07d4b5e32417600e6b587ca402929c44faf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
292B

MD5
cad10078c029724d4a7b4628abd83cba

SHA1
365082da227057ed6b72cf43908998a0ab967a5d

SHA256
06bdf1f6c5171730d01450ba1dfea5166ae7a027752b9945bd272a18c2ae1c73

SHA512
2a8dfaf789749dda22dabc17b2f098252beb1ba9f1d53bc6ee3823f591b7072c904a706c3212fc6d81439d8643933cffb378cd3b4738e930be0b581c6c343dbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
81dc0dd5fd355228a17b5c645d5126f1

SHA1
2c9ee59f58172adce204898c64b06405631e4181

SHA256
0a23fc762892ebcc6ab9dff783b7b28d3a28a184bc7e84015cb9fe9f771c0de3

SHA512
f85270030204c9b007440aa7a9f581c9723f22eb9bcf8b189a12655984fceb5ca435174d918482d3ba551c6fcb71cf79aad859e1e428d4a3c0ffc05bb5555ccf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9515fd1c6ee1e5ba072e57d961dd4424

SHA1
3a9782abe5e3c46151d212a425272d995b277edd

SHA256
0172a0b854e4215d521a6c319bd70607056f77a71651d599dd0d39772948361d

SHA512
cc731c8a1ffbcf13f20b4278cdd31eab605b7d08e4c7c3c2d92363534c6d62049c98a0994da842667fa2aa8f2863bc7fb4a57f5dcdc36e13dfdd0f42555cf8a7

Download Submit