58ef77d727c0e741c6fda379a15109d419ebd1566de41de837580cf126f7e4b0

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 00:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cde65a672742e5ebcb8adc56b949012b_JaffaCakes118.html
Size

53KB
MD5

cde65a672742e5ebcb8adc56b949012b
SHA1

734335e619c1108483569cf4f9db92d99966b5b5
SHA256

58ef77d727c0e741c6fda379a15109d419ebd1566de41de837580cf126f7e4b0
SHA512

8ce99ec6f4faac05665a76eea8af925076c6805a34379456624962d22e0070d0563c98db43dd35a622859f16924ce7c746386bdeb0416a6f69d9b97a52955b0c
SSDEEP

1536:CkgUiIakTqGivi+PyU9runlY963Nj+q5VyvR0w2AzTICbbeou/t9M/dNwIUEDmDR:CkgUiIakTqGivi+PyU9runlY963Nj+q7

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe
684	msedge.exe
684	msedge.exe
1268	identity_helper.exe
1268	identity_helper.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 684 wrote to memory of 5064	684	msedge.exe	84
PID 684 wrote to memory of 5064	684	msedge.exe	84
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 4436	684	msedge.exe	85
PID 684 wrote to memory of 1060	684	msedge.exe	86
PID 684 wrote to memory of 1060	684	msedge.exe	86
PID 684 wrote to memory of 4228	684	msedge.exe	87
PID 684 wrote to memory of 4228	684	msedge.exe	87
PID 684 wrote to memory of 4228	684	msedge.exe	87
PID 684 wrote to memory of 4228	684	msedge.exe	87
PID 684 wrote to memory of 4228	684	msedge.exe	87
PID 684 wrote to memory of 4228	684	msedge.exe	87
PID 684 wrote to memory of 4228	684	msedge.exe	87
PID 684 wrote to memory of 4228	684	msedge.exe	87
PID 684 wrote to memory of 4228	684	msedge.exe	87
PID 684 wrote to memory of 4228	684	msedge.exe	87
PID 684 wrote to memory of 4228	684	msedge.exe	87
PID 684 wrote to memory of 4228	684	msedge.exe	87
PID 684 wrote to memory of 4228	684	msedge.exe	87
PID 684 wrote to memory of 4228	684	msedge.exe	87
PID 684 wrote to memory of 4228	684	msedge.exe	87
PID 684 wrote to memory of 4228	684	msedge.exe	87
PID 684 wrote to memory of 4228	684	msedge.exe	87
PID 684 wrote to memory of 4228	684	msedge.exe	87
PID 684 wrote to memory of 4228	684	msedge.exe	87
PID 684 wrote to memory of 4228	684	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\cde65a672742e5ebcb8adc56b949012b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf51a46f8,0x7ffbf51a4708,0x7ffbf51a4718
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,18124636804139524047,15212861412470246525,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,18124636804139524047,15212861412470246525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,18124636804139524047,15212861412470246525,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18124636804139524047,15212861412470246525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18124636804139524047,15212861412470246525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18124636804139524047,15212861412470246525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,18124636804139524047,15212861412470246525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,18124636804139524047,15212861412470246525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18124636804139524047,15212861412470246525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18124636804139524047,15212861412470246525,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18124636804139524047,15212861412470246525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18124636804139524047,15212861412470246525,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,18124636804139524047,15212861412470246525,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1772 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2e9d7ff4c4c573dcae0b8d2fb749c1eb

SHA1
75e84377967fbb6bb05fe3b9fdde343b5555c35d

SHA256
a72477c2953be17666bdbd722f11c7e89cea7bd3be3fbae2a5f4cf76ecb99ee6

SHA512
7af1e18a0916a6fd5f3cc599034c8d26e3a86d19ae39c1daaa7612f790ee9b486f1efba58fa14f46363c07bfb31d64ae24089a9116f2304e2ef697204a4824ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c6f2802b-bcce-4a89-af59-2def9d001625.tmp

Filesize
5KB

MD5
cdd1a727d90cf1af7219b3d916231ba0

SHA1
78c53df12ec3b287a60b865f6ec8ca1aafb79478

SHA256
57db5f58fba4751c070fad89c769206ab3aa2d0d185469d07cce581d4f78a7ce

SHA512
b8495fe637b875748fedbfd0ed2e120955aa68d4b6a946a52e3e47a3058e656ead40797214d22f4dd72e06e08c3179183c2a178ce871da9b122b1314d878a155

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9695a0fb77ad08257c99527a2e3daa68

SHA1
6713b24e5809076c276d5c98b2d5a30567719462

SHA256
1c5cdf08f9345f6983521d3fe16edba31e981102ee91b029fb93636d2185c366

SHA512
aabc41478961555a2ac1337255fe516545a3550f0f3ccc7164c6661578ce5f3ebc681ee0b274202a7928c09208e1e877eb0f81e5fd09cfc366c47ff2d31ea3f8

Download Submit