2c17b4abe828d4bd338a3461ef6e9379606d887bd47820de7154e6aca0ef849d

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 14:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0ed197f7c93a9bfaa0d5b138814d85a_JaffaCakes118.html
Size

52KB
MD5

c0ed197f7c93a9bfaa0d5b138814d85a
SHA1

ce94750a82f2c224929c1287cd022bf76228c588
SHA256

2c17b4abe828d4bd338a3461ef6e9379606d887bd47820de7154e6aca0ef849d
SHA512

9de088dbe30939d3f19301e047096e4a65073eef949fede5e8e164312539e02a01306ec1296a5b1c824301bfc6f0cd2f96faac40911c63dfd3dc7a160860fe4c
SSDEEP

768:AX/UkqgOriWNcaSoNXuoWaYj9t/3L2rXvO:AXFaXuR9t/3LGW

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1952	msedge.exe
1952	msedge.exe
2496	msedge.exe
2496	msedge.exe
3492	identity_helper.exe
3492	identity_helper.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 3632	2496	msedge.exe	84
PID 2496 wrote to memory of 3632	2496	msedge.exe	84
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 984	2496	msedge.exe	85
PID 2496 wrote to memory of 1952	2496	msedge.exe	86
PID 2496 wrote to memory of 1952	2496	msedge.exe	86
PID 2496 wrote to memory of 5004	2496	msedge.exe	87
PID 2496 wrote to memory of 5004	2496	msedge.exe	87
PID 2496 wrote to memory of 5004	2496	msedge.exe	87
PID 2496 wrote to memory of 5004	2496	msedge.exe	87
PID 2496 wrote to memory of 5004	2496	msedge.exe	87
PID 2496 wrote to memory of 5004	2496	msedge.exe	87
PID 2496 wrote to memory of 5004	2496	msedge.exe	87
PID 2496 wrote to memory of 5004	2496	msedge.exe	87
PID 2496 wrote to memory of 5004	2496	msedge.exe	87
PID 2496 wrote to memory of 5004	2496	msedge.exe	87
PID 2496 wrote to memory of 5004	2496	msedge.exe	87
PID 2496 wrote to memory of 5004	2496	msedge.exe	87
PID 2496 wrote to memory of 5004	2496	msedge.exe	87
PID 2496 wrote to memory of 5004	2496	msedge.exe	87
PID 2496 wrote to memory of 5004	2496	msedge.exe	87
PID 2496 wrote to memory of 5004	2496	msedge.exe	87
PID 2496 wrote to memory of 5004	2496	msedge.exe	87
PID 2496 wrote to memory of 5004	2496	msedge.exe	87
PID 2496 wrote to memory of 5004	2496	msedge.exe	87
PID 2496 wrote to memory of 5004	2496	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c0ed197f7c93a9bfaa0d5b138814d85a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff449b46f8,0x7fff449b4708,0x7fff449b4718
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,9618295159580301341,13949684830709837904,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,9618295159580301341,13949684830709837904,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,9618295159580301341,13949684830709837904,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9618295159580301341,13949684830709837904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9618295159580301341,13949684830709837904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9618295159580301341,13949684830709837904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,9618295159580301341,13949684830709837904,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,9618295159580301341,13949684830709837904,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9618295159580301341,13949684830709837904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9618295159580301341,13949684830709837904,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9618295159580301341,13949684830709837904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9618295159580301341,13949684830709837904,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,9618295159580301341,13949684830709837904,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5372 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
ac32a94cf66f8381cc44b55293b3a655

SHA1
d5a349896f3d91c33d4e77365d3857dc6ccc0962

SHA256
61bb5726d0b9d133d7c195e32714d245386231a5c5c5ef878a9eb4c1380e76c0

SHA512
b01a3c0ea982a70ca4375f6345f40ef31d6c5b9e8f35f2dddee0f6e141b508d58f77fc63778bad99e496787fe354a620932c97380266ef838c97850013c4c3c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
852B

MD5
26d28bed15018aed101059d2d44a5c96

SHA1
216f1a36999745a3565c0ae0a841abb44e133c47

SHA256
8ec994e54f641ddfb34a550559857510402d8f634d999e257bdb9b10f474da19

SHA512
76ff4fb197378faeb0e27fbc4b92e9bf4f0f137d390a17d9eac0c2b63fbe6d1526b1233f33447260e9c4cee66e19c80daab3da1bde08b2a12cd2fdd6ec58ccea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1a0436f1abcf4158fd2a41fd41e0487d

SHA1
efa07dd185589f0b5a14e67b42a552c30d8630d3

SHA256
4e76d6c3908104c2cfdff3e6d7c8995c54a7382477693057a04af9e609bdf8af

SHA512
1d811404bf3c972f9751922b08c6df20dde71817b679df48cea35b5308be1dd897bd04ce2de7056c8678b4143e67ad480ca013b269abe843f407a72df223437c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aee6a6754bc80742b20088d108af7d95

SHA1
796a3a7335f413f27d5ea271e78c0076f46e62ba

SHA256
6bc28d3ce13432acc9d8d89693de5db2e711645ce98b7dae9790976bd9718b20

SHA512
ae1c6b5e043ebca878dc170c0219e08372a5d1eae8d035ac3d275e7dabc8492b0f34326fd93c9ad8f048f8eaf7ec8c5878e70a263b810d20c330528ca7cd5454

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
14d9ab74ae533c2aa65b1f9705820a87

SHA1
6e7cd402421c49e5a8a13df13575482504418ff4

SHA256
e72fa9b3dad451a4febaba67aa2b59a253214b27c0ba80dda821b1109e8f43c0

SHA512
31c03ee6c9bd5606a0155709162f21ec565a9a8ec7187260f7c6b7efd9f02ba4b678a97a4f126098d4afa6551737006306890e9796df714ac08e53d1d5712a6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b9bde632caa677db48b82d46d609a0d3

SHA1
2e4b8c44aac18e8a4ce806a8f75b4c2f92fce596

SHA256
ccda27711850bdf04e4a4ab36e0dd923294b56530d74fd5a2ad5db5150269855

SHA512
a2c590c9cecfa5e7581f0f4192d2940cebc50dc9bb6f55f134dfce489a3ad25f2c46f46592c15a1bc5743cf1652ae8bf8dd4d9f065bdded4727cced4b8207293

Download Submit