413022aac6ec25decee2cac8c4178e773310bfa0aba3592f2e96ccac3c24095a

Analysis

max time kernel
147s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 23:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c1d694caa793b63bcda699ce90d1a717_JaffaCakes118.html
Size

45KB
MD5

c1d694caa793b63bcda699ce90d1a717
SHA1

acb4d7f89072a1bbb467697c68b387d90ced6fc8
SHA256

413022aac6ec25decee2cac8c4178e773310bfa0aba3592f2e96ccac3c24095a
SHA512

13f9d932255df1b100e5e999e070eaf97ffbe7c0446ace8a842a51fe5297baa8571ffd7cf47d32d7a97dfaafa7858ae3368cef26bcb3bd30e6c82ba4da6afae3
SSDEEP

768:G5KSOmga7hOUG7GtVnnOshzUUyB9rjn36EBS3RnI2By33vqMu:G5+mgatZVnmrr3BBShnR+3ve

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
2184	msedge.exe
2184	msedge.exe
2344	identity_helper.exe
2344	identity_helper.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 1932	2184	msedge.exe	84
PID 2184 wrote to memory of 1932	2184	msedge.exe	84
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4284	2184	msedge.exe	86
PID 2184 wrote to memory of 4384	2184	msedge.exe	87
PID 2184 wrote to memory of 4384	2184	msedge.exe	87
PID 2184 wrote to memory of 4376	2184	msedge.exe	88
PID 2184 wrote to memory of 4376	2184	msedge.exe	88
PID 2184 wrote to memory of 4376	2184	msedge.exe	88
PID 2184 wrote to memory of 4376	2184	msedge.exe	88
PID 2184 wrote to memory of 4376	2184	msedge.exe	88
PID 2184 wrote to memory of 4376	2184	msedge.exe	88
PID 2184 wrote to memory of 4376	2184	msedge.exe	88
PID 2184 wrote to memory of 4376	2184	msedge.exe	88
PID 2184 wrote to memory of 4376	2184	msedge.exe	88
PID 2184 wrote to memory of 4376	2184	msedge.exe	88
PID 2184 wrote to memory of 4376	2184	msedge.exe	88
PID 2184 wrote to memory of 4376	2184	msedge.exe	88
PID 2184 wrote to memory of 4376	2184	msedge.exe	88
PID 2184 wrote to memory of 4376	2184	msedge.exe	88
PID 2184 wrote to memory of 4376	2184	msedge.exe	88
PID 2184 wrote to memory of 4376	2184	msedge.exe	88
PID 2184 wrote to memory of 4376	2184	msedge.exe	88
PID 2184 wrote to memory of 4376	2184	msedge.exe	88
PID 2184 wrote to memory of 4376	2184	msedge.exe	88
PID 2184 wrote to memory of 4376	2184	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c1d694caa793b63bcda699ce90d1a717_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff877946f8,0x7fff87794708,0x7fff87794718
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,13687991727043927753,16538258976565334054,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,13687991727043927753,16538258976565334054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,13687991727043927753,16538258976565334054,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13687991727043927753,16538258976565334054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13687991727043927753,16538258976565334054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,13687991727043927753,16538258976565334054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,13687991727043927753,16538258976565334054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13687991727043927753,16538258976565334054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13687991727043927753,16538258976565334054,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13687991727043927753,16538258976565334054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,13687991727043927753,16538258976565334054,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,13687991727043927753,16538258976565334054,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5360 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
178B

MD5
1441885fa844fdb080efe09e4a46a6a5

SHA1
431014e215ff19d5dde8a9a9678787ab8e85a4e7

SHA256
ea4b914f3f7827871c2f8634e1640109916fc946c3ed18a8ffc4641d8f2cd39f

SHA512
4a972fca0218e906fc308a2daa0cd9fcb4ba67dff69481c031e68986b23e42e8c0d9f6a3f4a3d22f00efe56b6d32bbdab1c482e831cecba95daaad0ccb5e1225

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
13e89a118543bc6c950e3cef99266377

SHA1
b2391c195b31c3073cd8c310ac1bd809adf28974

SHA256
cc89f13aa2c2f7d8c57e4d214fa2538c9dc5eb9c926c39f77ca24c61db047e2f

SHA512
bdeafd68803873c38db187a2b373be9b13b74d01eca9b09d2a56e74d32e6c2c3d679b6da20dcfa4fbf7caa7f812b514f0db2d5a01104ddb4c6b2d697e8bdc512

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
69724d4e2534b05a96f86c9b1c54963a

SHA1
96fc25dda8c911adcb55fbacae0c3b2b7041a69d

SHA256
0a6dac7c38efd136b741acc092e020d58c0856f058e663fecc9d0a20c51ff392

SHA512
c68ee80d3f87dbe6402a68611c57efb1b33d2a6e3964b638af0bc574cac840f51fd61e3e850e031a3364f92991f9f55974a1329c23c31521cf5ce607e5cd9eee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
32d54a60df42e219864d4757a34bacb7

SHA1
8dc6ae6f4a5841238ade126b36ad6b92a92f9da4

SHA256
eea6bbe8ad4f6595f46f870ef4ca38f0112bfe4aafb6902799f9789107c17970

SHA512
ef4f8b969e0124b103bd1cb70631470f0999f259ae4869f69a7448cae5e4d3cc77c59ad89c310c96b14b0d24f16c0e9059b6e89fbaef3c7867a3a3670ad49054

Download Submit