ef3b40f64ab1138e8544b83e885b9ca2e3ce3e551e5500afa25621996c229aa4

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 08:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf2635dd87fda94dd940ba0386c51ba2_JaffaCakes118.html
Size

188KB
MD5

cf2635dd87fda94dd940ba0386c51ba2
SHA1

ed8f2e66d44db666effc186b7e07b19abd571f08
SHA256

ef3b40f64ab1138e8544b83e885b9ca2e3ce3e551e5500afa25621996c229aa4
SHA512

e36cd7188a4dcc9ac8500975b04e23afe754e8949b479b8842bac44d5470deeeeac179530cc98f930ac48d5f80eff6b627fb3edbe16026fb2f21e3ae89498ea0
SSDEEP

3072:AxDNvG8rm/GXmNJUNBVTRQUe+Eb41nLIgPWyHb/th2wfngwDvoR6l:+VXmNJzhYl

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
732	msedge.exe
732	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 2604	732	msedge.exe	83
PID 732 wrote to memory of 2604	732	msedge.exe	83
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 4068	732	msedge.exe	84
PID 732 wrote to memory of 3544	732	msedge.exe	85
PID 732 wrote to memory of 3544	732	msedge.exe	85
PID 732 wrote to memory of 4956	732	msedge.exe	86
PID 732 wrote to memory of 4956	732	msedge.exe	86
PID 732 wrote to memory of 4956	732	msedge.exe	86
PID 732 wrote to memory of 4956	732	msedge.exe	86
PID 732 wrote to memory of 4956	732	msedge.exe	86
PID 732 wrote to memory of 4956	732	msedge.exe	86
PID 732 wrote to memory of 4956	732	msedge.exe	86
PID 732 wrote to memory of 4956	732	msedge.exe	86
PID 732 wrote to memory of 4956	732	msedge.exe	86
PID 732 wrote to memory of 4956	732	msedge.exe	86
PID 732 wrote to memory of 4956	732	msedge.exe	86
PID 732 wrote to memory of 4956	732	msedge.exe	86
PID 732 wrote to memory of 4956	732	msedge.exe	86
PID 732 wrote to memory of 4956	732	msedge.exe	86
PID 732 wrote to memory of 4956	732	msedge.exe	86
PID 732 wrote to memory of 4956	732	msedge.exe	86
PID 732 wrote to memory of 4956	732	msedge.exe	86
PID 732 wrote to memory of 4956	732	msedge.exe	86
PID 732 wrote to memory of 4956	732	msedge.exe	86
PID 732 wrote to memory of 4956	732	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\cf2635dd87fda94dd940ba0386c51ba2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83db846f8,0x7ff83db84708,0x7ff83db84718
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,566626761335755488,5343094268706959653,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,566626761335755488,5343094268706959653,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,566626761335755488,5343094268706959653,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,566626761335755488,5343094268706959653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,566626761335755488,5343094268706959653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,566626761335755488,5343094268706959653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,566626761335755488,5343094268706959653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,566626761335755488,5343094268706959653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,566626761335755488,5343094268706959653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,566626761335755488,5343094268706959653,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
23KB

MD5
33a83c16527e4531fbfca2631f653674

SHA1
87a63514c262ba4bffc52d2ceebb3ca14353507a

SHA256
1156bb50a264543f6a9dc8922dd2c65d444c8bb11b3b18be95d5adff840b33b4

SHA512
f1dba28d0f81aa0894436ae7b4ba76a2e635f002f666d17d31b8b21500dc2321d7862ca8dcfd22e44aab4d1f33112c076dc95191c889546a40f9c6197cccbda3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
45KB

MD5
aa6a698d1c7fc6d35265b10af5570e9c

SHA1
00da372ad4964a5d5b8afff7fe1b207ff284f232

SHA256
02f6ae7bda59fb1a20d3386021fb972ced348bf724fea42157225d416f9f049a

SHA512
f5b2f732e899cc0fed577e1ef1c51c154ede5d206543e8ac7c1fabb182901f8e93e137b63f12cbb87b3f570a283a368bfb1b9d637cc5b1c4f1669ff5cfbf306b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
560d0c549f741349ea6c81f06c4bb830

SHA1
4fe97756652a0bf48d0b1a034648e72330d356ea

SHA256
25d2a0e4c81c1f06c5f7fc9612db94d7444a9e15599fcb3613619d7164ce88ad

SHA512
4999f1193c9de92e146bcfcb68f80f06e8c2e9bde346fc2097251819b57484e34b7d4be205cf031a7ab08183f7a296b80a42eee52021373dcaf15ee1f4baf35a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
2da2e29a57d1b3f632551bcdd2f5c669

SHA1
cd9f827e86c471d08be5f914ae008d28743bb8f8

SHA256
e46aeb0b4e30c422b14dd96ebc9a0a03333cef287665bc69e64ab6e356086b2f

SHA512
ebb7f29632753e12e47e0a7434089f68fc338a8ad80a9d0900e2cf0ebcfe610b835c71522ca77b4e92c056f4ea536818cc870ec07504eb930d9f289512404413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a58f4fb1b4c772380f221274013b4644

SHA1
8c1c0a6ebc8fef29220dba88474b4a709ad40e20

SHA256
efc573b48fedfee9faf4903de72b11213e327d86e44537f0adc80138c3ccb267

SHA512
577f26fce6155713f72be55eaec6bf99e46081876fe91ee454461a8262dbc291df547f525c8b033df429db9e23fc307f64f763e8e997e4a903d107702daa2675

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d6a1eb109c16ac4fcb80f390263361fa

SHA1
9c28fec1a60b9131e2857c3660916da94e4a7124

SHA256
56ddeb0ac49e2da7292a77b8ca3b8ee0799c7737e67e67001228fef79b5ddcad

SHA512
c4aaa5228e7329dbd8b3558c493885d51b60fadf28a8c5f3b3a08fce5f90e88386f135c302517cce5f5f3228fc827be21855dec787bcbbfdc4d21fb13d68bd96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6c0fe6bab03e634ed5bbb6aef986f3e7

SHA1
4cb3755e132f8901661f68fd9c14dc6a131e92e7

SHA256
07971c799b1eda0991185272e5b30927fed6ff9f40fe3b69fe932038dd498bc2

SHA512
14b5a16448860a878794424f6ca72560f355eb353d49fd2b042e1c156d02eb47733f73f89d1388fb1b03a7da349755e17859225ec318f6311a4c1dc9fa911545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f0a6324d4304436474db08c08a87818f

SHA1
aa7c56e32870bf08d7738250fa5aeb3ef84c565b

SHA256
177c5e8e45c50c03ea4890a5acdd708aeb7e01fb77d3209b820665f057e2ff73

SHA512
28f29e96ebe74ebdf712725e6683cb362b48e520b7aeeac96339de3a3effc18fa88897628ebf03644bb4b92c03fd245ebaa3767b9e9193473ab61f8f775fb0ec

Download Submit