7e047725d890bab0edfe461728ba95f0ae0d38f16aeaf3f56321ca45093c8578

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0ab600de6f6f168814086020d97a145_JaffaCakes118.html
Size

4KB
MD5

c0ab600de6f6f168814086020d97a145
SHA1

cdb0493b98c321ae098ef250786d9acc26488331
SHA256

7e047725d890bab0edfe461728ba95f0ae0d38f16aeaf3f56321ca45093c8578
SHA512

03e4c72913409177209566e55f08024d31becf19becb6b204c06a0d9bfc558464be55b1fab9db93ec829ad1125c777c05741c70b67395a65f1549f264c97addb
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oBbOfad:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDu

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
3304	msedge.exe
3304	msedge.exe
1524	identity_helper.exe
1524	identity_helper.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 4024	3304	msedge.exe	84
PID 3304 wrote to memory of 4024	3304	msedge.exe	84
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 1076	3304	msedge.exe	86
PID 3304 wrote to memory of 740	3304	msedge.exe	87
PID 3304 wrote to memory of 740	3304	msedge.exe	87
PID 3304 wrote to memory of 4996	3304	msedge.exe	88
PID 3304 wrote to memory of 4996	3304	msedge.exe	88
PID 3304 wrote to memory of 4996	3304	msedge.exe	88
PID 3304 wrote to memory of 4996	3304	msedge.exe	88
PID 3304 wrote to memory of 4996	3304	msedge.exe	88
PID 3304 wrote to memory of 4996	3304	msedge.exe	88
PID 3304 wrote to memory of 4996	3304	msedge.exe	88
PID 3304 wrote to memory of 4996	3304	msedge.exe	88
PID 3304 wrote to memory of 4996	3304	msedge.exe	88
PID 3304 wrote to memory of 4996	3304	msedge.exe	88
PID 3304 wrote to memory of 4996	3304	msedge.exe	88
PID 3304 wrote to memory of 4996	3304	msedge.exe	88
PID 3304 wrote to memory of 4996	3304	msedge.exe	88
PID 3304 wrote to memory of 4996	3304	msedge.exe	88
PID 3304 wrote to memory of 4996	3304	msedge.exe	88
PID 3304 wrote to memory of 4996	3304	msedge.exe	88
PID 3304 wrote to memory of 4996	3304	msedge.exe	88
PID 3304 wrote to memory of 4996	3304	msedge.exe	88
PID 3304 wrote to memory of 4996	3304	msedge.exe	88
PID 3304 wrote to memory of 4996	3304	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c0ab600de6f6f168814086020d97a145_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca8c646f8,0x7ffca8c64708,0x7ffca8c64718
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2328,17805837770910157999,14639607081415736585,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2328,17805837770910157999,14639607081415736585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2328,17805837770910157999,14639607081415736585,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2328,17805837770910157999,14639607081415736585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2328,17805837770910157999,14639607081415736585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2328,17805837770910157999,14639607081415736585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2328,17805837770910157999,14639607081415736585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2328,17805837770910157999,14639607081415736585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2328,17805837770910157999,14639607081415736585,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2328,17805837770910157999,14639607081415736585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2328,17805837770910157999,14639607081415736585,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2328,17805837770910157999,14639607081415736585,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4932 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
292B

MD5
6c64a840e77b8c3fa4036ed945f46161

SHA1
2372f653b1989582b944b3932b4e9bd10e223e87

SHA256
a79422631fe1906f9a84cb556ccd500cae9f4d12e2ca2a9534b38e412fa4a4d5

SHA512
698d42d424b523bb97af898ef6a6ea9633a629a602b4ffe48261acec047890c0e467dc05e8f332e93f31b7f8204564d992c93e49510a952c4e2ba0cd1b189fb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
11607d02fc1c5422471e58182a565483

SHA1
529a2eff714ba3188e2db14208108b88d701bac4

SHA256
ca83ac0993c08da6c9c3550ca36943bbf03fe4b4f72174584d245a46a6c3e30e

SHA512
0f87e505aa21ce3977414694669ac084b8039ca4c7f6bb7b6d7683d6137b09b931c94851f84227708180ab6ba37260708966a6ab735f30a081297d9379ac8f35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
20ecc549c52e7683dfde23ab8a0da527

SHA1
f351bedf3e9a064e81973cc358aa1523b1275ac1

SHA256
b467cdbcae3babece29b7a1117aa0a013f35f48d0b189a3634660e2d8eac45be

SHA512
d6a310df891b72a65f129222d9e1b7d3a8b082acbedadbbb606dbe2ca4e1900d40c178e508c8ff094f218fead4d373ee2928f39b4907983db9d6a0a8de8dab3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
daf0fd252d547051f4cc978d995447ee

SHA1
0dbc852dec6cc1cbab07302c229ce8967114975a

SHA256
86aa5d1a3b0ee3d3c759a460b0a4a5bf8fcb0bacde402fdf0458b7fc06aa556b

SHA512
6c6407841aa5bb5455214966efa2146fc8fe4107cd4ecee5b1a686660ded8c147da89549243c550664903bd793a4c0dbaa2567e315bafd393107ac9d23fb8a83

Download Submit