45185756e407e4486420f264376b0551871d7cc13bd0de9e113e520653cfa531

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ce9c8b4d6068904f73b42d965c1c35d2_JaffaCakes118.html
Size

2KB
MD5

ce9c8b4d6068904f73b42d965c1c35d2
SHA1

af6b7924ab27d10cc6e600825cb9386cf0b6b7b7
SHA256

45185756e407e4486420f264376b0551871d7cc13bd0de9e113e520653cfa531
SHA512

0c939ef1bed9789da70b6b63df3a033f7bde36eaeb85fe3141b769c8cfc779a0215bbad09e2f4b9e17591df2bb7037cf46852adae6c6bdcfa36fff945579fbb1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3176	msedge.exe
3176	msedge.exe
3736	msedge.exe
3736	msedge.exe
3444	identity_helper.exe
3444	identity_helper.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 5044	3736	msedge.exe	87
PID 3736 wrote to memory of 5044	3736	msedge.exe	87
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3520	3736	msedge.exe	88
PID 3736 wrote to memory of 3176	3736	msedge.exe	89
PID 3736 wrote to memory of 3176	3736	msedge.exe	89
PID 3736 wrote to memory of 3164	3736	msedge.exe	90
PID 3736 wrote to memory of 3164	3736	msedge.exe	90
PID 3736 wrote to memory of 3164	3736	msedge.exe	90
PID 3736 wrote to memory of 3164	3736	msedge.exe	90
PID 3736 wrote to memory of 3164	3736	msedge.exe	90
PID 3736 wrote to memory of 3164	3736	msedge.exe	90
PID 3736 wrote to memory of 3164	3736	msedge.exe	90
PID 3736 wrote to memory of 3164	3736	msedge.exe	90
PID 3736 wrote to memory of 3164	3736	msedge.exe	90
PID 3736 wrote to memory of 3164	3736	msedge.exe	90
PID 3736 wrote to memory of 3164	3736	msedge.exe	90
PID 3736 wrote to memory of 3164	3736	msedge.exe	90
PID 3736 wrote to memory of 3164	3736	msedge.exe	90
PID 3736 wrote to memory of 3164	3736	msedge.exe	90
PID 3736 wrote to memory of 3164	3736	msedge.exe	90
PID 3736 wrote to memory of 3164	3736	msedge.exe	90
PID 3736 wrote to memory of 3164	3736	msedge.exe	90
PID 3736 wrote to memory of 3164	3736	msedge.exe	90
PID 3736 wrote to memory of 3164	3736	msedge.exe	90
PID 3736 wrote to memory of 3164	3736	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ce9c8b4d6068904f73b42d965c1c35d2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8a1f46f8,0x7ffa8a1f4708,0x7ffa8a1f4718
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,14490112687571944799,158243071548515562,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,14490112687571944799,158243071548515562,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,14490112687571944799,158243071548515562,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14490112687571944799,158243071548515562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14490112687571944799,158243071548515562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14490112687571944799,158243071548515562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,14490112687571944799,158243071548515562,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,14490112687571944799,158243071548515562,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14490112687571944799,158243071548515562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14490112687571944799,158243071548515562,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14490112687571944799,158243071548515562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14490112687571944799,158243071548515562,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,14490112687571944799,158243071548515562,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2d0422c566ecff476990cfa84d020634

SHA1
44847018489e24f2128d5d226f2da2aca4f9c8a4

SHA256
9d559205100a91a4496c9f8f80ce0a9cd1ea8d2e4652f3a10b2c4cd13585e155

SHA512
3e0cbc71ea5616f1b357a6dc71b090d8a7a2e08022547abdf7f4b7b795efc7078a2b7566cf5c6e078630a4d745c91874e31ed076904f892ed31830b714fa084b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
291d975edf76982d1b0b3763a2079402

SHA1
2ef7085155b6079b5bfd44047089d8d5afe02d8f

SHA256
ddc4cba6226a21ee833cfeb57e4579e5b6e7440b03741eec6abbe55dd3e3df8b

SHA512
baee77a21fc03fc94e79ef148ef290f2bc660717e8875787d6ebfc5ac64c61a4332e64265a6b8fba7f395b7794b8b2f80ba6adbb6af8aca852f9fd0c42a3f6db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f5f4c21666588cb460f4dbaa1fdde546

SHA1
959eb80d1be25fee9aedbbe14c6fd35400d7b1a7

SHA256
185b06240230d002f83bb8c2f6d92296851f1bd0cd600797b8dc4658982d1ebf

SHA512
882f332eb126c1183180c8d7662a6aa95b299dfdb2a2efe1508dcc7ea0891845d0eef6056bb3939f4e8eebf59844323038c521f0df138de28998a3826d29542e

Download Submit