669689c9baefed53878f9d483bd2dde48a41116d39d03ca89b255370bee184da

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 03:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce8eff90ac13bcd4983efdf675334904_JaffaCakes118.html
Size

25KB
MD5

ce8eff90ac13bcd4983efdf675334904
SHA1

a0c51ce68dac8e60bcddd0fa2db85d2e81529108
SHA256

669689c9baefed53878f9d483bd2dde48a41116d39d03ca89b255370bee184da
SHA512

d9916cbf124b2be4cf99b53ded9cf60752be051782c0e4c8ff750ba17551132b00a6e932f4310e83050d789b1bf3edcb03afed6474e0bad919699de015081ce5
SSDEEP

384:SrHuXgqlt7ChSXsLKD5Je6THkjIoCSw9bZTVNDxqVdu/eySn2X/GuJsC0pK3i3:S6RL2hd2tREj7+fDoI3i3

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1620	msedge.exe
1620	msedge.exe
3344	msedge.exe
3344	msedge.exe
3904	identity_helper.exe
3904	identity_helper.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 3696	3344	msedge.exe	85
PID 3344 wrote to memory of 3696	3344	msedge.exe	85
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 736	3344	msedge.exe	86
PID 3344 wrote to memory of 1620	3344	msedge.exe	87
PID 3344 wrote to memory of 1620	3344	msedge.exe	87
PID 3344 wrote to memory of 3444	3344	msedge.exe	88
PID 3344 wrote to memory of 3444	3344	msedge.exe	88
PID 3344 wrote to memory of 3444	3344	msedge.exe	88
PID 3344 wrote to memory of 3444	3344	msedge.exe	88
PID 3344 wrote to memory of 3444	3344	msedge.exe	88
PID 3344 wrote to memory of 3444	3344	msedge.exe	88
PID 3344 wrote to memory of 3444	3344	msedge.exe	88
PID 3344 wrote to memory of 3444	3344	msedge.exe	88
PID 3344 wrote to memory of 3444	3344	msedge.exe	88
PID 3344 wrote to memory of 3444	3344	msedge.exe	88
PID 3344 wrote to memory of 3444	3344	msedge.exe	88
PID 3344 wrote to memory of 3444	3344	msedge.exe	88
PID 3344 wrote to memory of 3444	3344	msedge.exe	88
PID 3344 wrote to memory of 3444	3344	msedge.exe	88
PID 3344 wrote to memory of 3444	3344	msedge.exe	88
PID 3344 wrote to memory of 3444	3344	msedge.exe	88
PID 3344 wrote to memory of 3444	3344	msedge.exe	88
PID 3344 wrote to memory of 3444	3344	msedge.exe	88
PID 3344 wrote to memory of 3444	3344	msedge.exe	88
PID 3344 wrote to memory of 3444	3344	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ce8eff90ac13bcd4983efdf675334904_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcafda46f8,0x7ffcafda4708,0x7ffcafda4718
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,15843510780818302565,14857859630792654328,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,15843510780818302565,14857859630792654328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,15843510780818302565,14857859630792654328,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15843510780818302565,14857859630792654328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15843510780818302565,14857859630792654328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,15843510780818302565,14857859630792654328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,15843510780818302565,14857859630792654328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15843510780818302565,14857859630792654328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15843510780818302565,14857859630792654328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15843510780818302565,14857859630792654328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15843510780818302565,14857859630792654328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,15843510780818302565,14857859630792654328,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5444 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
259B

MD5
d4b641a2d6d48c68da9802f6e56678d5

SHA1
aa34afc602c079f32a2f9d28c1bfc6d25cfb0d6b

SHA256
5875a0e0471e56ff719bdb8633a51744c19b5ccc0013492edf32aee8ef3499b8

SHA512
d80721759911524a42a8201be73cf7efeb66b8b385eee51aad8aceeed0628fa83c25ebaf17e28c74bcd87e7c1cfcefff15b6762f5ec24adbfdcdf5f236eb89ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b1457ac23a13a404f9dc051c662ac4ac

SHA1
0c4b1ce0d0d231aa3db41664239073e141060daa

SHA256
742c24cc9cfb6592410a3ff543489da68ae2b54f8e6f82522ac117988260cde9

SHA512
6bb6f7134343c1d5ee542186dd87a6f9b954ad3258c2281087d90f538b7df09cf9979ba127e975778ec6b52ab7bad6b675c41f1880772d1c37a4544d77d8d87c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6fa06b7c0b1fc8aea878d3d38b99a8b5

SHA1
3e4cbe614579766f1f0bf4a0ea176e155ed0ecbb

SHA256
f4f513b1e91c69e73ed73f261ed5c024f5ff29014cc2addd306a3a27d2952708

SHA512
8e1a2b799a04c63006e066a5eed98f4e9f156a08cbf48e3c72840a19480652499885142273b5accf8d70c21ffc937bdacb75dc39c597af22d891db1d13e6cc58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
530611cc29e93c77fa0db0c8dfe9a4ad

SHA1
ac169a6a8f6f211bd68445b74f3b372784bf1eec

SHA256
b63157fd56ba7d6b4a6f8230aae6475ce8a08c157d366a3d5c698f55772675b2

SHA512
57a0aa3bfdec267559280108aa68dfc2c7bc43d3d47ab54a939a055c1114dbca9b988369962a4540535a0e2976a90d4bf089690f1ea865f81b8adf0ea5c930f0

Download Submit