4f76a6f1f2b440ef85b213496787564eb232c2eb45e475e5476bb42b5e3171c5

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 02:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce7dbbc61ed0390577c19d343d0f6514_JaffaCakes118.html
Size

139KB
MD5

ce7dbbc61ed0390577c19d343d0f6514
SHA1

e884f7e648d0eafbf79312554b368030713f5c4c
SHA256

4f76a6f1f2b440ef85b213496787564eb232c2eb45e475e5476bb42b5e3171c5
SHA512

3526d69190334342b8e70d48efbbdb4cde701abccba56427ff775020eb1b3476172aa8bdeb71c1dd5be5b8a146051acf6e03872140e94facf9b51b0142e0e947
SSDEEP

1536:m71l1ukruImnSspBolXAjLMvB2FTh5snza8Q4JkR:m71qkqImfpBJLMvBKThmpQ4JkR

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
4652	msedge.exe
4652	msedge.exe
4176	identity_helper.exe
4176	identity_helper.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 5064	4652	msedge.exe	85
PID 4652 wrote to memory of 5064	4652	msedge.exe	85
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4460	4652	msedge.exe	86
PID 4652 wrote to memory of 4856	4652	msedge.exe	87
PID 4652 wrote to memory of 4856	4652	msedge.exe	87
PID 4652 wrote to memory of 1940	4652	msedge.exe	88
PID 4652 wrote to memory of 1940	4652	msedge.exe	88
PID 4652 wrote to memory of 1940	4652	msedge.exe	88
PID 4652 wrote to memory of 1940	4652	msedge.exe	88
PID 4652 wrote to memory of 1940	4652	msedge.exe	88
PID 4652 wrote to memory of 1940	4652	msedge.exe	88
PID 4652 wrote to memory of 1940	4652	msedge.exe	88
PID 4652 wrote to memory of 1940	4652	msedge.exe	88
PID 4652 wrote to memory of 1940	4652	msedge.exe	88
PID 4652 wrote to memory of 1940	4652	msedge.exe	88
PID 4652 wrote to memory of 1940	4652	msedge.exe	88
PID 4652 wrote to memory of 1940	4652	msedge.exe	88
PID 4652 wrote to memory of 1940	4652	msedge.exe	88
PID 4652 wrote to memory of 1940	4652	msedge.exe	88
PID 4652 wrote to memory of 1940	4652	msedge.exe	88
PID 4652 wrote to memory of 1940	4652	msedge.exe	88
PID 4652 wrote to memory of 1940	4652	msedge.exe	88
PID 4652 wrote to memory of 1940	4652	msedge.exe	88
PID 4652 wrote to memory of 1940	4652	msedge.exe	88
PID 4652 wrote to memory of 1940	4652	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ce7dbbc61ed0390577c19d343d0f6514_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd490846f8,0x7ffd49084708,0x7ffd49084718
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,17376322945240318409,18257415809255257885,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,17376322945240318409,18257415809255257885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,17376322945240318409,18257415809255257885,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17376322945240318409,18257415809255257885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17376322945240318409,18257415809255257885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17376322945240318409,18257415809255257885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17376322945240318409,18257415809255257885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17376322945240318409,18257415809255257885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,17376322945240318409,18257415809255257885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,17376322945240318409,18257415809255257885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17376322945240318409,18257415809255257885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17376322945240318409,18257415809255257885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17376322945240318409,18257415809255257885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17376322945240318409,18257415809255257885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,17376322945240318409,18257415809255257885,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
617e506d666fe6b7f3e3ac6ae93c67ac

SHA1
e368810d010d68534618dd4ec74d0f99fe9f4600

SHA256
a2e8bab3a32e317ee0ca2423b6cc91a38950726f6204e37514a306a35c6a7866

SHA512
2eb3dd215e0681ff3c18b4e67f75d95a8afeb40952c6655d7db7202c0480f8d6fbded6d5e2295825e80c2bdec5e61f65b09b63261fa8bb43d29286926f84fbfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b2afe2033ab87e46a287a006d56e13c1

SHA1
5f96515c60bd1f0f98067b386a1adf2a6cce5ee2

SHA256
abd22baabaadf7bf149c45492375ecc9aaffcd8ceb64f8d5380e5034ab55edba

SHA512
e49fc635c63030a7fb6be214810a55a74449f83588f912a3205b2b34d8c42f7e7905078257b0d8d65cac793ea737a4cdd330a8207f8fe73621cdaf01080598d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3dedad273b596c4af2f7a314d23d9b70

SHA1
4b9e3b1e7aa254a43c813ca1469f35ca16123045

SHA256
df3ab1dc508e30e498cedbcc79d1e5e3181c4a48154412a29656088484fe8a24

SHA512
7dae39c5f33649b473a8705e52ea2ae3bd490af1538f6e40c1b95f346e9cc6ef8635e1e53667b45ccb68237e6947327fe1f1c008f73a3353fe50e12595fb8543

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b20ef9c6950bbadb76e46061fb9a379a

SHA1
907350d5bb2fb931dad729221ddab8fa2ae5ec26

SHA256
ff06ce680eced26f328e3e8193713a97eff15d4d40b7d5a1ffce1bec8ff9ea9b

SHA512
3dea82dbfb27e836705145f15368cdbb1e535bde2b68f0d390ad5bca8fc3247464b59b8a973f4bf7dee64af399b18cab54d35e7277f86e876a1ee5bf0b49baa9

Download Submit