5e015e46b76f367ff32ec9f742a4c4055da8786a8c66ce3e2490768a6b960f8f

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 10:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c07fcd4ca9a10a38248a41506540bb90_JaffaCakes118.html
Size

56KB
MD5

c07fcd4ca9a10a38248a41506540bb90
SHA1

fe28cb223beb8bca7b4dd8a263e7710088a89fd7
SHA256

5e015e46b76f367ff32ec9f742a4c4055da8786a8c66ce3e2490768a6b960f8f
SHA512

102220f0345ec3069530dc2e238d549c2abe1c3c6be573a74c49e5e66acc7906934f06879b80cd442cfd3f1b93a5e24cead4e4ecd974568c877a6a135e012ad1
SSDEEP

768:wLt3pHvvCIooV/mAsg3KIBDt0D7i4SRZAJXmqO/wQNdAgVJk:wfHv7oi/m8/DtI7i4SRZAwwQN4

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe
644	msedge.exe
644	msedge.exe
3564	identity_helper.exe
3564	identity_helper.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 2152	644	msedge.exe	83
PID 644 wrote to memory of 2152	644	msedge.exe	83
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3796	644	msedge.exe	87
PID 644 wrote to memory of 3112	644	msedge.exe	88
PID 644 wrote to memory of 3112	644	msedge.exe	88
PID 644 wrote to memory of 4680	644	msedge.exe	89
PID 644 wrote to memory of 4680	644	msedge.exe	89
PID 644 wrote to memory of 4680	644	msedge.exe	89
PID 644 wrote to memory of 4680	644	msedge.exe	89
PID 644 wrote to memory of 4680	644	msedge.exe	89
PID 644 wrote to memory of 4680	644	msedge.exe	89
PID 644 wrote to memory of 4680	644	msedge.exe	89
PID 644 wrote to memory of 4680	644	msedge.exe	89
PID 644 wrote to memory of 4680	644	msedge.exe	89
PID 644 wrote to memory of 4680	644	msedge.exe	89
PID 644 wrote to memory of 4680	644	msedge.exe	89
PID 644 wrote to memory of 4680	644	msedge.exe	89
PID 644 wrote to memory of 4680	644	msedge.exe	89
PID 644 wrote to memory of 4680	644	msedge.exe	89
PID 644 wrote to memory of 4680	644	msedge.exe	89
PID 644 wrote to memory of 4680	644	msedge.exe	89
PID 644 wrote to memory of 4680	644	msedge.exe	89
PID 644 wrote to memory of 4680	644	msedge.exe	89
PID 644 wrote to memory of 4680	644	msedge.exe	89
PID 644 wrote to memory of 4680	644	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c07fcd4ca9a10a38248a41506540bb90_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed10146f8,0x7ffed1014708,0x7ffed1014718
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,10528078189095300214,11523824122747501899,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1956,10528078189095300214,11523824122747501899,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1956,10528078189095300214,11523824122747501899,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,10528078189095300214,11523824122747501899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,10528078189095300214,11523824122747501899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,10528078189095300214,11523824122747501899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,10528078189095300214,11523824122747501899,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3236 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,10528078189095300214,11523824122747501899,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,10528078189095300214,11523824122747501899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,10528078189095300214,11523824122747501899,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,10528078189095300214,11523824122747501899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,10528078189095300214,11523824122747501899,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,10528078189095300214,11523824122747501899,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
aa103e548dae4dcbd98aa5517eafa9b5

SHA1
7022f69f7b7b8cd69d37ca9cc2ef060ae8d2cded

SHA256
bfd39a378de304c94945dfc37cc387b729ba7b3c6d4a6014f28c8dfae43f6131

SHA512
2393434a7b9087167d44c7038fcd3b53403560a71691a4c8de3bd4daa0e4153f6b24a7473baeed9fa1561f40b72e59e817d9fe1db549241c7fa6b47ab9532b99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
171d1a988f98729d3841b2aae3a0b695

SHA1
53a03eb7292d2d2f485bc2cd93c9997f6679f151

SHA256
e688e3831c3e0fc518e18b3f0e32c2160f94bf1aa297a633849c6797fa0a45d4

SHA512
137fd47c1c446734f5332055908a46b6da35e5d339eac1920d5b2764c8b1c58bca86bffe95bc01bebbec6bce2facf83030ab3fde329d22125084bbe30776fe92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b88528eaad44a00fcec2f7505f19f838

SHA1
573c5b347ec4081aa7e7b730b1ee646967e99c3c

SHA256
828611ea0b27290ef2eb4036f4ed17877cde53e7fb879605dfe062890e22eb95

SHA512
66f46ce8363ac5cdba36a216d46be5539f973d070b449ef9c668065c42138dba3c258028e4dcae579b92b742ebac9c8e15b160ad93acf634b078c6920eb3d6f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dfc791b5b8650ffd481cbbaaf35933ce

SHA1
065e0631e138d8d6acf5c7ad80845aa107f1d51e

SHA256
5b29ca550947cf3681556cbdb604d985c7c3c45a16466aa464a487a50e64d137

SHA512
af23e50473add125a718b75675eeb1eba88df9e498690bf5de5c771192abb06475cef107035fa8fc7d303ef36264f53c30621e850438c189225d864dfea47ecd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
72cc052c9892a05e460bab0a3d328094

SHA1
02ece86651d9e4cc963ef41b1eb64e0e3860ac79

SHA256
8113fc425b0982f03fdfc8d4659ba9fa8848afb46565bfdd131b50f4570cff0a

SHA512
046874d73ad24214181d295c2c268f31ffd07155af5553bca0292531586e20b61f0d74eb07ec188ee869cc23e7a724feda16e11b1bd1d4c6ea8723515147adce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6f50c7a85aa9d0449292ed1784e398a8

SHA1
64c2a778aa1e64c4f4088a06584bef74c7212453

SHA256
dc0266dec24e4196911de1a0e45fdb974b795c9a68ce3f7a5e830c458efaead9

SHA512
3e21253a7ef2f8f7bdd9b2ec85203b1a2b9a3818368b9f75c37b176a2891c6f14d8bac37c09a22ed85b02430db78a6ee93831383b402f559067498d50c7950f8

Download Submit