02459e665cd2beee571978692149d41f27cac3db586fbb8907dbb4b9ed7ed252

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 16:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

befe7ae1c3339a8a2a95b316c4016ca3_JaffaCakes118.html
Size

35KB
MD5

befe7ae1c3339a8a2a95b316c4016ca3
SHA1

fc13e538451d06a29d9356323b47b28fa3b11538
SHA256

02459e665cd2beee571978692149d41f27cac3db586fbb8907dbb4b9ed7ed252
SHA512

075835c8d93203c878b900827cff08ef53da3e6ab2117d292be5d35d160828c20dae3be9872da699d86b66018591cb47a28f5fd3cb1cdbac3c92cf7c5e779cdd
SSDEEP

384:7oXGeXOIIZJj4tud9H7TQAjUwJELCya32Wm0m2e72maVwlXFkrsSz8xOVI/MVywO:vIIZN4ta9b8FimaVYXF6F6xYh/Ll1/u

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe
3312	msedge.exe
3312	msedge.exe
4532	identity_helper.exe
4532	identity_helper.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 1992	3312	msedge.exe	85
PID 3312 wrote to memory of 1992	3312	msedge.exe	85
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 2816	3312	msedge.exe	86
PID 3312 wrote to memory of 4896	3312	msedge.exe	87
PID 3312 wrote to memory of 4896	3312	msedge.exe	87
PID 3312 wrote to memory of 1476	3312	msedge.exe	88
PID 3312 wrote to memory of 1476	3312	msedge.exe	88
PID 3312 wrote to memory of 1476	3312	msedge.exe	88
PID 3312 wrote to memory of 1476	3312	msedge.exe	88
PID 3312 wrote to memory of 1476	3312	msedge.exe	88
PID 3312 wrote to memory of 1476	3312	msedge.exe	88
PID 3312 wrote to memory of 1476	3312	msedge.exe	88
PID 3312 wrote to memory of 1476	3312	msedge.exe	88
PID 3312 wrote to memory of 1476	3312	msedge.exe	88
PID 3312 wrote to memory of 1476	3312	msedge.exe	88
PID 3312 wrote to memory of 1476	3312	msedge.exe	88
PID 3312 wrote to memory of 1476	3312	msedge.exe	88
PID 3312 wrote to memory of 1476	3312	msedge.exe	88
PID 3312 wrote to memory of 1476	3312	msedge.exe	88
PID 3312 wrote to memory of 1476	3312	msedge.exe	88
PID 3312 wrote to memory of 1476	3312	msedge.exe	88
PID 3312 wrote to memory of 1476	3312	msedge.exe	88
PID 3312 wrote to memory of 1476	3312	msedge.exe	88
PID 3312 wrote to memory of 1476	3312	msedge.exe	88
PID 3312 wrote to memory of 1476	3312	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\befe7ae1c3339a8a2a95b316c4016ca3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ff9835546f8,0x7ff983554708,0x7ff983554718
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,10851194370028837197,6800147733173387435,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,10851194370028837197,6800147733173387435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,10851194370028837197,6800147733173387435,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10851194370028837197,6800147733173387435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10851194370028837197,6800147733173387435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,10851194370028837197,6800147733173387435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,10851194370028837197,6800147733173387435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10851194370028837197,6800147733173387435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10851194370028837197,6800147733173387435,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10851194370028837197,6800147733173387435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10851194370028837197,6800147733173387435,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,10851194370028837197,6800147733173387435,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
911B

MD5
687976d64079acef23084ff9bf0f4681

SHA1
014fe21c93ed39b76da7cedfef0b6bed81e2c89c

SHA256
16e8e67a594d9daf40cfcf8298376bf44cf44c76faeee8ea1dd70d856383aa15

SHA512
ff8957ede28fbbfc1ad2ed28d3dfd464351b6d3724a53599c9eb7e077198ee8ab616cde9c596af768f7cb00e24788bd0d265c44442a59882b6b931a9e85e826f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a2e968c94736da24d97342f30940a0af

SHA1
891ea279eb3a152d2ce95826e9e00f8cbb318dea

SHA256
64bc67354b341b32685c34357beba791cbb7ab5cd610af75d36aea7c30d3b4f7

SHA512
3cb714579fe0c60c6dbcdc5167e0ee83e679f2b7a1a77ff3cdaa2379c72da8a60c68abb909d029e5de23f90539abc074b7aea5cfdd4f99b0f0eed7d5065f8971

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6daf6ea357e193ebe065a4dc3a3fa7a6

SHA1
d7475cace3d3652d9f37e1cfa013fb33aac8572b

SHA256
97506585dd2f894e7ee5fe2949c06953c93f5537f2ae874eeaab7bc8d94a1367

SHA512
405e3a9d6b82e8decddf9d75be684caf15db9b935bb3f090d740545dc9623967b1433593cfb17854cfcf7799773c2bc5f73fef712dd313a0944126430d0c6c4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2e37497aa1419635a9d3bf5d1a04d83b

SHA1
1f1df51e39cafa4e19d4d26d188d62e3c7159833

SHA256
542c512c4d65b705d10a7d9d7d2a432f044a6b5648f05bce99127873e9a115ba

SHA512
e1604544b0d3caa9cfd50d1fb4ac06f35f55adfa52d01c6ee99d01eb08c25afb377049a921de76c4e11e0972b0eb57b171739eb048a71c85455acd73f3db51df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
7fcd8da453ae1f82644b0f6670a23694

SHA1
963347c267fc1279b4ebc8c78740386e2d8b754a

SHA256
fcdc26227c7d788e5554545598a994ab8e00b6e085f148b728940aee1c1b69e6

SHA512
e4a4920bc5f33289a6812921f2613cb1107e43969c6e14cd4a5adf092be4f57b5684f1214881869fb1c6ebf42c38430a4d6d5b9e8db32e6ac6f32a8610f8cf89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584159.TMP

Filesize
204B

MD5
cc645d22a7b40f89ee70eefcd66a05e6

SHA1
602531397c4d64f60868b0cefb38e9b144ed1882

SHA256
de42e3685f4343b60b14fc0128f87ec86a3c11ba76e80560d15e3f2793d96591

SHA512
468e68dec629d4546592dff3351b1333a2b54d4585be4d4cb427725e4a7d12b28cb036fb10c9c1cc325eb44491289d67abd6848a9317d5260a020a119db38cd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2b560ffb5127ba98513c25290bdfa994

SHA1
09e99f44047da4f0b398c151ea00f33dbe7ce635

SHA256
448cc7255544883bbf5909b0ebd65a87bf9b30bb64edd489476ceb1c3e5ae01a

SHA512
6ff04632d69ddd604c2c7eb3f4c4b705be28c63c68af78979f3bc18d8189bb9af838f5b9cae50fb3ac1186bb1f95a9d0fb4d9e53b58b72563fb7d4a950af3910

Download Submit