a93be5dc6d0c2b7053aedbd714e261c61a4047510f151cf92bf895aa80088f6f

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 22:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1b53103bb17bccd1f0192c30b2b73a5_JaffaCakes118.html
Size

66KB
MD5

c1b53103bb17bccd1f0192c30b2b73a5
SHA1

a3e535a3ac27dc5107d1a132e2152f33bab95b90
SHA256

a93be5dc6d0c2b7053aedbd714e261c61a4047510f151cf92bf895aa80088f6f
SHA512

80645ce62f14aa59652fd3044f585c7741a8c5b511b381271c3e8d50032dbda796d24326ce074fe0c9b94c34d1f2c648dc6fedc460f14f3c79f1ee2929221eae
SSDEEP

1536:EIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZ4HK:n4HWlEx0odSlL

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
636	msedge.exe
636	msedge.exe
3020	identity_helper.exe
3020	identity_helper.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 3900	636	msedge.exe	84
PID 636 wrote to memory of 3900	636	msedge.exe	84
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 928	636	msedge.exe	85
PID 636 wrote to memory of 2344	636	msedge.exe	86
PID 636 wrote to memory of 2344	636	msedge.exe	86
PID 636 wrote to memory of 1632	636	msedge.exe	87
PID 636 wrote to memory of 1632	636	msedge.exe	87
PID 636 wrote to memory of 1632	636	msedge.exe	87
PID 636 wrote to memory of 1632	636	msedge.exe	87
PID 636 wrote to memory of 1632	636	msedge.exe	87
PID 636 wrote to memory of 1632	636	msedge.exe	87
PID 636 wrote to memory of 1632	636	msedge.exe	87
PID 636 wrote to memory of 1632	636	msedge.exe	87
PID 636 wrote to memory of 1632	636	msedge.exe	87
PID 636 wrote to memory of 1632	636	msedge.exe	87
PID 636 wrote to memory of 1632	636	msedge.exe	87
PID 636 wrote to memory of 1632	636	msedge.exe	87
PID 636 wrote to memory of 1632	636	msedge.exe	87
PID 636 wrote to memory of 1632	636	msedge.exe	87
PID 636 wrote to memory of 1632	636	msedge.exe	87
PID 636 wrote to memory of 1632	636	msedge.exe	87
PID 636 wrote to memory of 1632	636	msedge.exe	87
PID 636 wrote to memory of 1632	636	msedge.exe	87
PID 636 wrote to memory of 1632	636	msedge.exe	87
PID 636 wrote to memory of 1632	636	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c1b53103bb17bccd1f0192c30b2b73a5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9991f46f8,0x7ff9991f4708,0x7ff9991f4718
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1500,3020556367425319806,5452665355041872964,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1500,3020556367425319806,5452665355041872964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1500,3020556367425319806,5452665355041872964,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,3020556367425319806,5452665355041872964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,3020556367425319806,5452665355041872964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1500,3020556367425319806,5452665355041872964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1500,3020556367425319806,5452665355041872964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,3020556367425319806,5452665355041872964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,3020556367425319806,5452665355041872964,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,3020556367425319806,5452665355041872964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,3020556367425319806,5452665355041872964,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1500,3020556367425319806,5452665355041872964,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3756 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
308B

MD5
646dd14917d4d21edb84d4ef7edea5a8

SHA1
8c8c2f0985a5ac71a35ae60062967537b9980f57

SHA256
3cc54aacdd03d3a3353da6b99956a958f09900c301413ec387317d54c4b36901

SHA512
75371a80be7459f459a5a840256e92e9c1739c3b0a67d0d187c4c5f7728ff4681406ba2421bc7455d47181c095ea70b114ad8520e5598704a5c8fef3424b03f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4f92316bbecefda8f2e4ac5772d34852

SHA1
74bd66188dc23f49da2cfaa983eb361e31eb1edc

SHA256
d1f4c442cc016dfa7da170c4721ac61a913e7e8c2a94322affa5a5a11df3150f

SHA512
6e27326c1709a7f4b32dff23e261016a27cbb9edf4dc53b16af5ca6d907612ba87bab2080e0c8a3bfb419c6c43fdd1224fa954c3dbf3729eb073d0a13cd4e774

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
389801d8193fc6c5a10143513da0d56f

SHA1
0281ecc20847488481f28f49893338bdc7f2695b

SHA256
0276194a8cee0e64d2d87d7cd5147310db4bb0962c0fd24e5497a7b0dfb6542a

SHA512
f055367af02469eb530951ee6804d5946100e690d11c0cb74eb358b11a11f5a2fd77ca1c5cc9d4e0c31b368d74e86d5490981653872dc571e122cdff9e8fccd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e9c6fa50-80c2-4451-bc9b-216697f14a39.tmp

Filesize
5KB

MD5
45f8fa3951de51fe9f6e2a3932c6bcce

SHA1
6d4c91647063c7618fe63f5c78e8211d971e2a9e

SHA256
963870fb65c7768860f534057de99aebaa702c2d72a6ae6f999d460b392fc228

SHA512
85d6cfeaf4e748d79378d7119c048ceee36715d3fb17378fd26dcfc0bb76bf4b8e17f9e5cb65eaa66ac0d914e6bd25772663887d43c3d6e5fa5203f22abca21c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
278a18b651da465476a14c30bcb89758

SHA1
8fc5d33853aa4040b5ddad8454567692c051ec3e

SHA256
63c960b3fdf60de814267cc1489e7035328f48d1089cd8843099d67846528855

SHA512
6733654ab79e75bce3f6b703dfed6e903d25059a38ba7e6a3d9f88ae61bf1c547864ff98ac1feea7f308c70f58ac12e6d0ab063e94a00bffc558cbec359c4bac

Download Submit