aa0adfd5838c70d28275be7208fdaa707871722b87cc3f220bf13cd76a98c2c9

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2115b3173a47bb5dbe2e8a5834db18f_JaffaCakes118.html
Size

41KB
MD5

c2115b3173a47bb5dbe2e8a5834db18f
SHA1

03928e23cecfa4df7b8a6a2c1f9bb52aba68a784
SHA256

aa0adfd5838c70d28275be7208fdaa707871722b87cc3f220bf13cd76a98c2c9
SHA512

9899b49b2214fb62cc0ccdd1d8451dd1dec030a16a8d19a1cefa2a5b6961e860763ee1208a94dee4bafaaf15fbec3756525bd171003c9c2ad5124c6654fed4ea
SSDEEP

384:TQ/8+xxIDa024BMjSQyimdy9yFCFrdRdMliTST0wEGPRxF:nQyFdyo7

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5072	msedge.exe
5072	msedge.exe
868	msedge.exe
868	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
4656	identity_helper.exe
4656	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 436	868	msedge.exe	84
PID 868 wrote to memory of 436	868	msedge.exe	84
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 4028	868	msedge.exe	85
PID 868 wrote to memory of 5072	868	msedge.exe	86
PID 868 wrote to memory of 5072	868	msedge.exe	86
PID 868 wrote to memory of 3364	868	msedge.exe	87
PID 868 wrote to memory of 3364	868	msedge.exe	87
PID 868 wrote to memory of 3364	868	msedge.exe	87
PID 868 wrote to memory of 3364	868	msedge.exe	87
PID 868 wrote to memory of 3364	868	msedge.exe	87
PID 868 wrote to memory of 3364	868	msedge.exe	87
PID 868 wrote to memory of 3364	868	msedge.exe	87
PID 868 wrote to memory of 3364	868	msedge.exe	87
PID 868 wrote to memory of 3364	868	msedge.exe	87
PID 868 wrote to memory of 3364	868	msedge.exe	87
PID 868 wrote to memory of 3364	868	msedge.exe	87
PID 868 wrote to memory of 3364	868	msedge.exe	87
PID 868 wrote to memory of 3364	868	msedge.exe	87
PID 868 wrote to memory of 3364	868	msedge.exe	87
PID 868 wrote to memory of 3364	868	msedge.exe	87
PID 868 wrote to memory of 3364	868	msedge.exe	87
PID 868 wrote to memory of 3364	868	msedge.exe	87
PID 868 wrote to memory of 3364	868	msedge.exe	87
PID 868 wrote to memory of 3364	868	msedge.exe	87
PID 868 wrote to memory of 3364	868	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c2115b3173a47bb5dbe2e8a5834db18f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8996946f8,0x7ff899694708,0x7ff899694718
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,11401536279152398364,4898151433159084140,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,11401536279152398364,4898151433159084140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,11401536279152398364,4898151433159084140,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1472 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11401536279152398364,4898151433159084140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11401536279152398364,4898151433159084140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,11401536279152398364,4898151433159084140,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4876 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,11401536279152398364,4898151433159084140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,11401536279152398364,4898151433159084140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11401536279152398364,4898151433159084140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11401536279152398364,4898151433159084140,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:2972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fc5d3a4bb889f3be8695f24f07456805

SHA1
21dfee0f3b7b0c168d9b575337f3f3f80d5d1f48

SHA256
3936d192b634eb62e5fbd568cf60a97a538779fdec935c6ff3340f9dbb45519d

SHA512
e642da56f0cec073db5dd1be94b4e191389ede5a7679e2c4a6efae1a75ad95b32bf3a191c0f46f46246df7c8bad467d59041617c2f26d57e048886aa7516d075

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
302d891f47f379806c26bf68567b9e79

SHA1
ca76168e91e20df27a9615f83b8e7afae43608cb

SHA256
5d425dcc96672ef0111ea9f165e42dc13c7137f7fd141294282dc5711bf987e7

SHA512
a025878ade2cf3fe33c62ee028063802c5ff0da649dc97e6ceae38437a7dcb2c040d50eb206db94730195364857fa97df25dce8a28b70212a9cee51462c3eaed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ad980de500206bfeb2e411b100e55bf3

SHA1
20765dbdae35a3de1b6b14db938a8541311c9a7b

SHA256
d43857daf76bdf4b340e3537f80c0f20331b123f8f3a2fd7ffca9c1aad6804c5

SHA512
35ef31bb592c02923c50471d2546e05aab95e2110e2ebd2c99801c9eb4a72dda79d51e2c3436476ab9740f421ddd540c1d5ab638d81644fcece13e598fda3c7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
303ba648ba4905e6c333a5cf260fe5f7

SHA1
2ccd458712bd3624654eb1a653627b6f9f7b0b70

SHA256
a0bf69ac3dcf8778c8607ddef92cf1f65a053c8f685e0de1801083787fb7cbdb

SHA512
94750e6ecfe11de0cf4b6a81bcc92ec14b1b05d828b1f13bf233744780ca4b5e29563ac5ca385564fad8fa4ad9ecaa3ce1630691d18fa849cfe313e85001031e

Download Submit