62e7839e2a855dc258a7e460c353bf1542ca98f37bbea5a5f42a8318172e8e3b

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 07:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cf0cc339d39dc3b9d54cb56101ac78b4_JaffaCakes118.html
Size

112KB
MD5

cf0cc339d39dc3b9d54cb56101ac78b4
SHA1

4b6962810cb1fa234e001c60178f46f7477baaaa
SHA256

62e7839e2a855dc258a7e460c353bf1542ca98f37bbea5a5f42a8318172e8e3b
SHA512

86a57d5e7cc28c40bf96ae058417fa6ed320b6405d93cc57b652f7e6275c9d975f864cb024af0f732c87fec9b0a6b54eda3abe79c9eed57aa4bb09712d8ef51e
SSDEEP

768:sCZzMfjbrgVlCeWlcVNjiLD9Y4x3NjqtpWFTjENuPwFN+Xi:sCZz/nNjin9Y4x3N+tpWFTwwWN+Xi

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
212	msedge.exe
212	msedge.exe
396	msedge.exe
396	msedge.exe
3372	identity_helper.exe
3372	identity_helper.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 4852	396	msedge.exe	86
PID 396 wrote to memory of 4852	396	msedge.exe	86
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 344	396	msedge.exe	87
PID 396 wrote to memory of 212	396	msedge.exe	88
PID 396 wrote to memory of 212	396	msedge.exe	88
PID 396 wrote to memory of 1244	396	msedge.exe	89
PID 396 wrote to memory of 1244	396	msedge.exe	89
PID 396 wrote to memory of 1244	396	msedge.exe	89
PID 396 wrote to memory of 1244	396	msedge.exe	89
PID 396 wrote to memory of 1244	396	msedge.exe	89
PID 396 wrote to memory of 1244	396	msedge.exe	89
PID 396 wrote to memory of 1244	396	msedge.exe	89
PID 396 wrote to memory of 1244	396	msedge.exe	89
PID 396 wrote to memory of 1244	396	msedge.exe	89
PID 396 wrote to memory of 1244	396	msedge.exe	89
PID 396 wrote to memory of 1244	396	msedge.exe	89
PID 396 wrote to memory of 1244	396	msedge.exe	89
PID 396 wrote to memory of 1244	396	msedge.exe	89
PID 396 wrote to memory of 1244	396	msedge.exe	89
PID 396 wrote to memory of 1244	396	msedge.exe	89
PID 396 wrote to memory of 1244	396	msedge.exe	89
PID 396 wrote to memory of 1244	396	msedge.exe	89
PID 396 wrote to memory of 1244	396	msedge.exe	89
PID 396 wrote to memory of 1244	396	msedge.exe	89
PID 396 wrote to memory of 1244	396	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\cf0cc339d39dc3b9d54cb56101ac78b4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcff3546f8,0x7ffcff354708,0x7ffcff354718
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,2495265055103204262,16167161162683968791,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,2495265055103204262,16167161162683968791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,2495265055103204262,16167161162683968791,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2495265055103204262,16167161162683968791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2495265055103204262,16167161162683968791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2495265055103204262,16167161162683968791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2495265055103204262,16167161162683968791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,2495265055103204262,16167161162683968791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,2495265055103204262,16167161162683968791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2495265055103204262,16167161162683968791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2495265055103204262,16167161162683968791,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2495265055103204262,16167161162683968791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2495265055103204262,16167161162683968791,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,2495265055103204262,16167161162683968791,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4612 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
676B

MD5
02479cc4f5e00e6489d4899bd93a5395

SHA1
27bf0c404b752ac8d06b08be4d0eb4c6fb2a4abe

SHA256
09b94290a00124817bd6b660b1e1dbc3ccd223fd64c4b43ded19013f0ba39e01

SHA512
e716d7f4c46ec098234a6fd1f6bed34b49468d50d344fbaf5dc71f29afea10bbde765db0ae64b2d65d0fed5f697af8899c20c5fe88771d915da81eba51043d02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
89d41889dd115d3899347f1d970e53e2

SHA1
0ed5f8f26b0f89ee3a0386401bd0056ec3bf9bb6

SHA256
cebfeb68d4bc8e28d3fc6aa3d739ae48d1aef794c09952cbac62b8814be06a01

SHA512
4a13823b4e9a00adee9d95757652649bd017a468fecf528b4c8f51021887d336eef7649cee87088027e029c79552ff47a19581eb7b21522f17dabb44ef7e6cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
91c3abc49f1053ca4e7b4c90a3b83088

SHA1
87707d0c273c6aa3ab51df2b958079cb5c74345d

SHA256
cc16444daa12744791fc74b4b83758c26a8e882b7cc68d846e979d7da3406e45

SHA512
5a1423da4633dd81916cb70d16cc01a168cc4860fce7b0b72b309d8267a905c91ab1d6ce22575bb8854efc69adbda10c7b05749612bb2c880b3b391c3f0a7c09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
99635c5bfaf14bf3cb70e9ac305f596a

SHA1
76f689ab551cbd1882df1e0d809c31841b94338f

SHA256
3ebcfb4e751498301810cb4c32c78e8c3755a30c9958d64a093bb20bd7925ea6

SHA512
a370fee3ea77e15bce30fa9a6a88d9c5721e7e86284df1a2c642ceaf33b5e165ec5454aeb9bd51b8f2098281d8f14b63a27eb15c063de58dc21504db920e63bd

Download Submit