5471f4a2ee0426adb98ed6348d7d6455f0ffc831241c29c1d193119ba61cdad4

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0ded6bda512da358f8608baadce8d3b_JaffaCakes118.html
Size

23KB
MD5

c0ded6bda512da358f8608baadce8d3b
SHA1

9cd7077456d9363d36116c0b3a4a3f9ef5fa80b6
SHA256

5471f4a2ee0426adb98ed6348d7d6455f0ffc831241c29c1d193119ba61cdad4
SHA512

a92f872da16e63f1ebcd26170c8a78110fb1d29a719745f9532f8fa40cdef8cedb81ce1405116bc4af087008528da57d744e5276a1416427430bd93ab0509fff
SSDEEP

384:P1J1h1K1c1i1l121S171e1Z191l1x1S1D1O1U1R1u1S1XQ/A1C111v1V1O1c1j1+:trz6wCHmSpebvHjShuYDOS5i3NXuwB0T

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2184	msedge.exe
2184	msedge.exe
3420	msedge.exe
3420	msedge.exe
1152	identity_helper.exe
1152	identity_helper.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 4104	3420	msedge.exe	84
PID 3420 wrote to memory of 4104	3420	msedge.exe	84
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 3560	3420	msedge.exe	85
PID 3420 wrote to memory of 2184	3420	msedge.exe	86
PID 3420 wrote to memory of 2184	3420	msedge.exe	86
PID 3420 wrote to memory of 2200	3420	msedge.exe	87
PID 3420 wrote to memory of 2200	3420	msedge.exe	87
PID 3420 wrote to memory of 2200	3420	msedge.exe	87
PID 3420 wrote to memory of 2200	3420	msedge.exe	87
PID 3420 wrote to memory of 2200	3420	msedge.exe	87
PID 3420 wrote to memory of 2200	3420	msedge.exe	87
PID 3420 wrote to memory of 2200	3420	msedge.exe	87
PID 3420 wrote to memory of 2200	3420	msedge.exe	87
PID 3420 wrote to memory of 2200	3420	msedge.exe	87
PID 3420 wrote to memory of 2200	3420	msedge.exe	87
PID 3420 wrote to memory of 2200	3420	msedge.exe	87
PID 3420 wrote to memory of 2200	3420	msedge.exe	87
PID 3420 wrote to memory of 2200	3420	msedge.exe	87
PID 3420 wrote to memory of 2200	3420	msedge.exe	87
PID 3420 wrote to memory of 2200	3420	msedge.exe	87
PID 3420 wrote to memory of 2200	3420	msedge.exe	87
PID 3420 wrote to memory of 2200	3420	msedge.exe	87
PID 3420 wrote to memory of 2200	3420	msedge.exe	87
PID 3420 wrote to memory of 2200	3420	msedge.exe	87
PID 3420 wrote to memory of 2200	3420	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c0ded6bda512da358f8608baadce8d3b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x9c,0x108,0x7ffe7afd46f8,0x7ffe7afd4708,0x7ffe7afd4718
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,4814866617037950061,9117495068138119813,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,4814866617037950061,9117495068138119813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,4814866617037950061,9117495068138119813,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4814866617037950061,9117495068138119813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4814866617037950061,9117495068138119813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,4814866617037950061,9117495068138119813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,4814866617037950061,9117495068138119813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4814866617037950061,9117495068138119813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4814866617037950061,9117495068138119813,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4814866617037950061,9117495068138119813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4814866617037950061,9117495068138119813,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,4814866617037950061,9117495068138119813,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4116 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e38ab7ee209513b56b9a733e1949c656

SHA1
98371e94ab374c5a6849c32353601545445ddb2c

SHA256
032d6acad3fbae56c77059bce80da792a5707c2464b6bd923b9ac0e05e1c099d

SHA512
8baac3d33275ba09328bcd31624070ac57986fa85639a64d2500cf56aeebbb17073833128404eb5bb0d2e75b8b9bf7a0f6b97c5241d8964db684ebcd913bb34b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2013a3f85811a35d297863b82102e8e4

SHA1
44bc888e0f5c4172b4abc8850903e56838def1d9

SHA256
0e6f0866d8a65aa5c3986346ef80b770c36b62e9a9b0527bf95ff5e2d6640a67

SHA512
4e69915231f65934a67b6ae16d6373809c6c64766520fa3caa238b684368c039f714c384e297d1fdad5c61f75dde014c7b3a0dac346dd291e397e38e7a86db9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cd5f6f626da8c13b8a8e142d18fabe15

SHA1
6606352ecce15e08b13209fa3f311ad82b182088

SHA256
9aa4d5f5be8e5935ef831d05f8c00821f7e5ddb6a8c974243ebaed34293c9e80

SHA512
a0a05678e87427facd0052444647dd779e11e72347167056b0907eb4276ac7662a4fb4b39ff1c230c8c6c4112f62e76bd05666ac89e8bcea9ec4f292b7fae33d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bc85e89945ad49f1bf9e1b1d8bfec0af

SHA1
34ea417ea310f5e649600c4de2acbeb58fc7a0f7

SHA256
a5d85fa7228a6450db660f57c638b2ee9ee60a355b8678eadf14647705559c0b

SHA512
202e5421b98c49508524ea427870c82a79466e035d4fe6be2601e61239099de71f3177d168e619cd21ff3ee8dd08a61f7a7e7e597dc700f82507aefe1d3653be

Download Submit