012b7ae938617384178deb9250045261f253c7d0a1556b75d0842e56ac865b48

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 08:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c05462aab6b05f6dc5221d83c97153ad_JaffaCakes118.html
Size

41KB
MD5

c05462aab6b05f6dc5221d83c97153ad
SHA1

292d50412d345c1681d1225b2f4299430b7a42a4
SHA256

012b7ae938617384178deb9250045261f253c7d0a1556b75d0842e56ac865b48
SHA512

d221a37a8ca9f55230047aba4b78a4b5b37f66a5c27f62655781dce64a186588d92ccd08f773df3c3e2c625ae00c3bc9397b0222fe9da5f54ce9e9ac7036d94d
SSDEEP

768:MIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZreK:MIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqM

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
5108	msedge.exe
5108	msedge.exe
1340	identity_helper.exe
1340	identity_helper.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 3196	5108	msedge.exe	84
PID 5108 wrote to memory of 3196	5108	msedge.exe	84
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 3220	5108	msedge.exe	85
PID 5108 wrote to memory of 4724	5108	msedge.exe	86
PID 5108 wrote to memory of 4724	5108	msedge.exe	86
PID 5108 wrote to memory of 928	5108	msedge.exe	87
PID 5108 wrote to memory of 928	5108	msedge.exe	87
PID 5108 wrote to memory of 928	5108	msedge.exe	87
PID 5108 wrote to memory of 928	5108	msedge.exe	87
PID 5108 wrote to memory of 928	5108	msedge.exe	87
PID 5108 wrote to memory of 928	5108	msedge.exe	87
PID 5108 wrote to memory of 928	5108	msedge.exe	87
PID 5108 wrote to memory of 928	5108	msedge.exe	87
PID 5108 wrote to memory of 928	5108	msedge.exe	87
PID 5108 wrote to memory of 928	5108	msedge.exe	87
PID 5108 wrote to memory of 928	5108	msedge.exe	87
PID 5108 wrote to memory of 928	5108	msedge.exe	87
PID 5108 wrote to memory of 928	5108	msedge.exe	87
PID 5108 wrote to memory of 928	5108	msedge.exe	87
PID 5108 wrote to memory of 928	5108	msedge.exe	87
PID 5108 wrote to memory of 928	5108	msedge.exe	87
PID 5108 wrote to memory of 928	5108	msedge.exe	87
PID 5108 wrote to memory of 928	5108	msedge.exe	87
PID 5108 wrote to memory of 928	5108	msedge.exe	87
PID 5108 wrote to memory of 928	5108	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c05462aab6b05f6dc5221d83c97153ad_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa2e9046f8,0x7ffa2e904708,0x7ffa2e904718
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,1384987200962834548,1419107486933031602,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1948,1384987200962834548,1419107486933031602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1948,1384987200962834548,1419107486933031602,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,1384987200962834548,1419107486933031602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,1384987200962834548,1419107486933031602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1948,1384987200962834548,1419107486933031602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1948,1384987200962834548,1419107486933031602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,1384987200962834548,1419107486933031602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,1384987200962834548,1419107486933031602,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,1384987200962834548,1419107486933031602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,1384987200962834548,1419107486933031602,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,1384987200962834548,1419107486933031602,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
308B

MD5
ab12b0ab1bc94ebe2c5b6a0b5532f889

SHA1
931f1541e1e088e2a9b8b253b1f8de640c8dc39d

SHA256
6dc88741cc22e879c9cfb3e8cb7b434d603bcc9c8f4c1d535c42d62a714eebe7

SHA512
4c76a49b2033354bf27a6c037975f5f2eff1319eb7e27a957a0176a8fba3a11d9ddd0640ef5ebca3a7287ea72f4ffff08684aa7bbfbd4573ee8c03c42129ea1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7ffddf00bfa8db6352c772e746b441ef

SHA1
dc99aba04f2e8648be85261b34df281224425947

SHA256
1772034450c5786779c964e9d29a0268378e77305e2159096bf397d4b5fbf819

SHA512
1a5e8a6c0e7690ed7c9c37c3875d35473f750c098dcb54b6382e95e120962a92c9a35b3ed831bd1b30b4cf1fc9ec421de83f1dc70cfb59a6dd5989192553fa88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
592702ab002c64d65288bf3a34f3b906

SHA1
4ef65b3e436fd41d744654a9228ebd5f3f0d5ae1

SHA256
f6ae924887315dca8647ece7a1b08646314170f6d9581962a54e547edfef2092

SHA512
13b24264afea782b6946d38f355de0fff4145396eb14c2d9beef0eddf69fa7fe55cb4276eacc7844e4f8de80780ccd7f1693aa77480de6f9560e97dd5ab87401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ceaa36fc288f9e1a9d761d5c97aed7a9

SHA1
d3de0b47af3062ec97ca2cf04ad76065210c1150

SHA256
10ac1b97cedd8ff7561226f8f5e0f73b805db64a482f0a9a2e4f219d3526e640

SHA512
4a0633de72f62014c2318c9af1e2a66b9dad4e4a8fc30ae1ff60bbc2938b7244358c4eda1a87e2c4154c293f7613c797781d631135910f7cc79a6bc7ec309ad8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8255afa4cc07156ee755875d501eb6a6

SHA1
02e098b4b145dbdca13a1413a641fc221690037f

SHA256
dcd5788d8ce01b889025660bb09e5a198b1716cbce54ad805765bd5760ed65c8

SHA512
94f022d908ef373b2f15cf2a7759d2ea578f7f5918d7fb55d6bff56c4beaaf2b94178ddda6013d2bf21a65452d6309e817435c8f12da96c3ec0067c9245059b3

Download Submit