64ce7b12ac23d3b94c897b01755394dc8ff518f9ff959eaf74454743e87b69cc

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ce68e6ebca2ee2a1530c40f37c8d1c14_JaffaCakes118.html
Size

3KB
MD5

ce68e6ebca2ee2a1530c40f37c8d1c14
SHA1

2be019614be2dc562310bb64550f1a0ee7696eb9
SHA256

64ce7b12ac23d3b94c897b01755394dc8ff518f9ff959eaf74454743e87b69cc
SHA512

9e510b034da09650d2889ebabc32de1404fd42fcff653aaea0e64f7ff810c7623044a8816c350f864c989601c801caa2bf3d4f30114c414547641ce85006f606

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4208	msedge.exe
4208	msedge.exe
2044	msedge.exe
2044	msedge.exe
1348	identity_helper.exe
1348	identity_helper.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe
2044	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2388	2044	msedge.exe	82
PID 2044 wrote to memory of 2388	2044	msedge.exe	82
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 3620	2044	msedge.exe	83
PID 2044 wrote to memory of 4208	2044	msedge.exe	84
PID 2044 wrote to memory of 4208	2044	msedge.exe	84
PID 2044 wrote to memory of 4264	2044	msedge.exe	85
PID 2044 wrote to memory of 4264	2044	msedge.exe	85
PID 2044 wrote to memory of 4264	2044	msedge.exe	85
PID 2044 wrote to memory of 4264	2044	msedge.exe	85
PID 2044 wrote to memory of 4264	2044	msedge.exe	85
PID 2044 wrote to memory of 4264	2044	msedge.exe	85
PID 2044 wrote to memory of 4264	2044	msedge.exe	85
PID 2044 wrote to memory of 4264	2044	msedge.exe	85
PID 2044 wrote to memory of 4264	2044	msedge.exe	85
PID 2044 wrote to memory of 4264	2044	msedge.exe	85
PID 2044 wrote to memory of 4264	2044	msedge.exe	85
PID 2044 wrote to memory of 4264	2044	msedge.exe	85
PID 2044 wrote to memory of 4264	2044	msedge.exe	85
PID 2044 wrote to memory of 4264	2044	msedge.exe	85
PID 2044 wrote to memory of 4264	2044	msedge.exe	85
PID 2044 wrote to memory of 4264	2044	msedge.exe	85
PID 2044 wrote to memory of 4264	2044	msedge.exe	85
PID 2044 wrote to memory of 4264	2044	msedge.exe	85
PID 2044 wrote to memory of 4264	2044	msedge.exe	85
PID 2044 wrote to memory of 4264	2044	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ce68e6ebca2ee2a1530c40f37c8d1c14_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff6b6646f8,0x7fff6b664708,0x7fff6b664718
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1532,8588744648693049046,18273692186402516772,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1532,8588744648693049046,18273692186402516772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1532,8588744648693049046,18273692186402516772,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1532,8588744648693049046,18273692186402516772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1532,8588744648693049046,18273692186402516772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1532,8588744648693049046,18273692186402516772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1532,8588744648693049046,18273692186402516772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1532,8588744648693049046,18273692186402516772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1532,8588744648693049046,18273692186402516772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1532,8588744648693049046,18273692186402516772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1532,8588744648693049046,18273692186402516772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1532,8588744648693049046,18273692186402516772,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5220 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
276B

MD5
63e94862b42530f86676ad4d8dad984d

SHA1
3fd2230f79711e641c7d8bc1fc8f6d671319aec8

SHA256
02bd271fbf1d8f8cfeb229ec24d7bfb1c261116853c2e66a3f5d0b3536f59a25

SHA512
8f57ba1d96f3a97a7867f7eb43efd22baea3a78766fd88e87affcbc1e2e1699de833cbe9d78d22fa784ebf9602bd2006ee315ea13aebbcb79b56ec137c7a5aff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
55cec9ef32be51d2a471def4df92dfc4

SHA1
44741aa30a91072405082d37f3af324087e96c29

SHA256
f48170edadc10fdf6311b20efa537271f99b5ec3eec46a598d479280a845734d

SHA512
64e538da3655399840d23fafb7f8966c823090b989b7d58cd9592deff64bc1c06bf4350103c2bf5caf40e0c2190c21b21aee0c74c87ed10d2750f31da69d0af9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bbfe86eb53883ba8aa8e9802a9a5cab1

SHA1
bd15401af9f9b0f754a453de1d675ec94a838cb4

SHA256
e6bbd5f0dbda378de473dabc6f2cc4f364d6f84f68ac867318e925673dd112f5

SHA512
7599db988133709c676e0726f2e7e85cd4053f3440bf2dbfa4b7cc47f5e614be196c5c3a924cfe39f1e1b704d32c6787c8f650713af59491f7ecdefb4d12fb10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
52c4cd8bcb5c4b994a83619c3d4daf5d

SHA1
67015ff8fe054ed9a5a21ff58090a80b463a2f1f

SHA256
5e23c973ff279ec83bb7de138c380fe089c1cc4db13c93e74bce14741e46c255

SHA512
a7ebd309b444fa8b470fcdbfd54f431fe051a41e8cbcadb48709dd35135023e5a62caa787c6c78b01d1606d19123e0ff4d73a570063861771f0cfe44c2c07dc9

Download Submit