1548a92618e3211d71039816e9d5ca9f3795f469bc70bb60144ab6a21a307389

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c92f79458f9b872424fed191cd04cba1_JaffaCakes118.html
Size

201KB
MD5

c92f79458f9b872424fed191cd04cba1
SHA1

25381e57c291b7502c1bba6545872838cc67a144
SHA256

1548a92618e3211d71039816e9d5ca9f3795f469bc70bb60144ab6a21a307389
SHA512

5c66cc58f51ab1da8e1e887ca7537af674986e155a45e7c510f5a0933f52815f320ff8b6b3b76518b74f282a151c1d7ae261a7643a0d78709ea335ba9e326e4f
SSDEEP

1536:kaqN+QtxP2NIW22wkYbzfzp+ZOO1DeJP55pna2hlaDu3GvM:dqY85ag

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
100	msedge.exe
100	msedge.exe
1776	msedge.exe
1776	msedge.exe
3900	identity_helper.exe
3900	identity_helper.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 2552	1776	msedge.exe	84
PID 1776 wrote to memory of 2552	1776	msedge.exe	84
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 3100	1776	msedge.exe	85
PID 1776 wrote to memory of 100	1776	msedge.exe	86
PID 1776 wrote to memory of 100	1776	msedge.exe	86
PID 1776 wrote to memory of 3332	1776	msedge.exe	87
PID 1776 wrote to memory of 3332	1776	msedge.exe	87
PID 1776 wrote to memory of 3332	1776	msedge.exe	87
PID 1776 wrote to memory of 3332	1776	msedge.exe	87
PID 1776 wrote to memory of 3332	1776	msedge.exe	87
PID 1776 wrote to memory of 3332	1776	msedge.exe	87
PID 1776 wrote to memory of 3332	1776	msedge.exe	87
PID 1776 wrote to memory of 3332	1776	msedge.exe	87
PID 1776 wrote to memory of 3332	1776	msedge.exe	87
PID 1776 wrote to memory of 3332	1776	msedge.exe	87
PID 1776 wrote to memory of 3332	1776	msedge.exe	87
PID 1776 wrote to memory of 3332	1776	msedge.exe	87
PID 1776 wrote to memory of 3332	1776	msedge.exe	87
PID 1776 wrote to memory of 3332	1776	msedge.exe	87
PID 1776 wrote to memory of 3332	1776	msedge.exe	87
PID 1776 wrote to memory of 3332	1776	msedge.exe	87
PID 1776 wrote to memory of 3332	1776	msedge.exe	87
PID 1776 wrote to memory of 3332	1776	msedge.exe	87
PID 1776 wrote to memory of 3332	1776	msedge.exe	87
PID 1776 wrote to memory of 3332	1776	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c92f79458f9b872424fed191cd04cba1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e0d346f8,0x7ff8e0d34708,0x7ff8e0d34718
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,3536814153270395109,18360921732751362082,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,3536814153270395109,18360921732751362082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,3536814153270395109,18360921732751362082,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3536814153270395109,18360921732751362082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3536814153270395109,18360921732751362082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3536814153270395109,18360921732751362082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,3536814153270395109,18360921732751362082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,3536814153270395109,18360921732751362082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3536814153270395109,18360921732751362082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3536814153270395109,18360921732751362082,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3536814153270395109,18360921732751362082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3536814153270395109,18360921732751362082,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,3536814153270395109,18360921732751362082,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5064 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
255B

MD5
84b28e8ffed9fa0b8f6a91b5b31b308d

SHA1
efaf4dff37c34966c481eef0caf7dacee9e2a78c

SHA256
cf81f066b1ba1e869f5551bbc61c497d91035e2afcb750c3e63d5c7644b0b29c

SHA512
a838f81d13c5ecf02aedcdc60159f4b3f6e22e1f14c566ee3b2765e5645fe0eebabe24124ac018ea64986261c904e5bb50512708babe39bde76d7a5ab9280ea9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
086dd6dbca446f86fe8271a861dcf7ee

SHA1
fdf9549ce2ed5adc46cca501d614bf7a12179d58

SHA256
8381e6531195b00b0da7c5401410fa7ef6cfc83ef2b023daced7bc3508f2a6da

SHA512
72cccaf817a7331eb02ef001771813470987d6776c8f89f64644bc40e573ed6f87446dcf58061e2398814965bbf596304beecb4a5f520c853f34f9f3188f1b99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d7abab6bc0d8f8415e5f0f574fe446c4

SHA1
45f102ea49abcdb3c659bd5e21b7801c219faa97

SHA256
6face4c1fde4c448cd3de6a3169fa4836b6777563bd8b78c29365b08c130f9eb

SHA512
9e6339ed035fbfb40c67926d14de3e60c47ef90ce06dbeb4ac5777d57c0a261e6279b3960b975c9ba1219dcfaf93ed30a3fe97b8202d5dd79b88b4236301f639

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
76b2135c9c383e0ef24723a3b3f0e301

SHA1
bddaca26a402192ea8ec78d2f3987aff63ceda9d

SHA256
e007452de3584e9850d4e45a8d9bef711868a3010d4ed82639d583a66e7a484f

SHA512
0a40e6711d5739cc9e315bd19e4002edcc95442f6926905d0c9fd4fa36860e1ed919c5dd5fa5e90775f8437f151173abad23c96464f9c840244c480c5d97d008

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
507c068561ccb42a037435d65944a4da

SHA1
e25d35ec80c5e02d52cff9ad07c4e5f65306c16d

SHA256
89416e987753aa5df52690e9c5b0e2995e8c01bf8c838603ccc791222b9bee32

SHA512
62f2150cdb3456475e8b4d474d545268deea44fa14027d2eff7b377d38dcb7a48ef9738316441705a870fe553d8134f4a7df8625b7eab3e427991895f4c37004

Download Submit