c9e671e4f142eb7ffb2c31f2c5767bfff1ae2dd042bd8eec873f24780b0ae5b2

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 16:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf034e2d23f7b255dbdb57ecc0bd0bb9_JaffaCakes118.html
Size

26KB
MD5

bf034e2d23f7b255dbdb57ecc0bd0bb9
SHA1

6d8cc52489ff9d0838a63a55b9477dd089923d44
SHA256

c9e671e4f142eb7ffb2c31f2c5767bfff1ae2dd042bd8eec873f24780b0ae5b2
SHA512

8da1ef7b8b2fc7d9e3633aa8a088b6005acf509a999ac844e5e5a01d71d69f74c4e74bb864e7cf0db98344c2fe9847217f841463cb13f8218cb4c4387ec1f613
SSDEEP

192:Srsd7LevfM/G1j+XpgVSErjHhOUR75GQ4Q2xMbqFfLf43Gjq2QvFDjkkyUqmLrAd:SnIGguxPUUT34Q0MWFTLcmoK5

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
4852	msedge.exe
4852	msedge.exe
4404	identity_helper.exe
4404	identity_helper.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 1608	4852	msedge.exe	84
PID 4852 wrote to memory of 1608	4852	msedge.exe	84
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 1068	4852	msedge.exe	85
PID 4852 wrote to memory of 4320	4852	msedge.exe	86
PID 4852 wrote to memory of 4320	4852	msedge.exe	86
PID 4852 wrote to memory of 5072	4852	msedge.exe	87
PID 4852 wrote to memory of 5072	4852	msedge.exe	87
PID 4852 wrote to memory of 5072	4852	msedge.exe	87
PID 4852 wrote to memory of 5072	4852	msedge.exe	87
PID 4852 wrote to memory of 5072	4852	msedge.exe	87
PID 4852 wrote to memory of 5072	4852	msedge.exe	87
PID 4852 wrote to memory of 5072	4852	msedge.exe	87
PID 4852 wrote to memory of 5072	4852	msedge.exe	87
PID 4852 wrote to memory of 5072	4852	msedge.exe	87
PID 4852 wrote to memory of 5072	4852	msedge.exe	87
PID 4852 wrote to memory of 5072	4852	msedge.exe	87
PID 4852 wrote to memory of 5072	4852	msedge.exe	87
PID 4852 wrote to memory of 5072	4852	msedge.exe	87
PID 4852 wrote to memory of 5072	4852	msedge.exe	87
PID 4852 wrote to memory of 5072	4852	msedge.exe	87
PID 4852 wrote to memory of 5072	4852	msedge.exe	87
PID 4852 wrote to memory of 5072	4852	msedge.exe	87
PID 4852 wrote to memory of 5072	4852	msedge.exe	87
PID 4852 wrote to memory of 5072	4852	msedge.exe	87
PID 4852 wrote to memory of 5072	4852	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bf034e2d23f7b255dbdb57ecc0bd0bb9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdce3446f8,0x7ffdce344708,0x7ffdce344718
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4507401153537317021,15417642954693850515,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,4507401153537317021,15417642954693850515,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2488 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,4507401153537317021,15417642954693850515,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4507401153537317021,15417642954693850515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4507401153537317021,15417642954693850515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4507401153537317021,15417642954693850515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4507401153537317021,15417642954693850515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4507401153537317021,15417642954693850515,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4507401153537317021,15417642954693850515,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4507401153537317021,15417642954693850515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4507401153537317021,15417642954693850515,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4507401153537317021,15417642954693850515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4507401153537317021,15417642954693850515,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4507401153537317021,15417642954693850515,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5144 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\14c4468d-8efa-4fd3-b69f-ec4e95878cc7.tmp

Filesize
5KB

MD5
b7019b03b81157e7c0703c8b4083025f

SHA1
4cf288b4effa69bb2e88577880b2d409f168a5f7

SHA256
62ba345397966ce534fdbf23f0768a7071f2d407ea97e3f96475e5a73f953c07

SHA512
9c1cef8c07dd679314d1f69889f3f43145266fefc857ea1d623611a038979f23aab37517eb13c4fcf502dff3a070eddb8c42ce3caa510a94b2a563cf3c167b50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
024910064d591ad03c2c2058eb4fb7cd

SHA1
29b36e171bdfa3f32b567166157f5834679cc923

SHA256
6530019a9444dd052ed2383e95c57c83a30af46db89c2f080d2b7556b5b30098

SHA512
e55be1d7964efb34fb857138ed0799e1e17fdc43e1ee933b831b6806a99fbff421cfa1195be2e5558b6f23ca3ad38930c45b6ced9456cf76c9a1dc333c2e2a98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
877B

MD5
383d1811c46eeef03f7b88725fc39680

SHA1
5adeacb8c1de66b876286836352c4cafe0a24651

SHA256
231f7a6b109629ed79a096c08362b528d753b12a6ec76c5ec114461f037d76ab

SHA512
2744bdb1acd56c708be4a7de69a821950b75dab030561fb360b3f986a5569c1f79f8b320e7f304738763a5aff0b9dbf7673f1b713f473cb439c3b76a3c06e165

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6232e30efa3dbb3ceec425b75e7d577e

SHA1
2fa96172ff299bafe6c19650aa844f874c98a02c

SHA256
83a92ed3bdd031ede5397c624d4bbbbbac0a2dbd3ea39b1995f6bdea20994c1b

SHA512
bb6d118116c0116224d4dcc8ae5cbb35604dcdaf211d3b5e7acd9f5cd907fe32b2dc3e8b403bb02502820a4bb37358d12538545e0dfb9c7937a7513d988062e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8997ba4ece396e1f32a6735712e62c96

SHA1
069a11333ec2f148c485067ad4a09056d866bdb1

SHA256
5a9aee21c8ba2f2d1983a28637dfe6b0115ff6b8bb7735ee79d2e76776127032

SHA512
bcc1c1f4460c5aa7deebcd87c3198e01ec3f0764be38d0070c7640310497afb0b9e78b438b372ced77cec5fc0ae9499b883f6796d825763bd1023a00e9c4c0e6

Download Submit