89645a4e2cd2e59277326bf86f5a9ab63b3acc8b642056175d69fe9c7f66b5c5

Analysis

max time kernel
145s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf963393950dc0617160f93833411906_JaffaCakes118.html
Size

2KB
MD5

cf963393950dc0617160f93833411906
SHA1

654fa4122fc5b798fd07f7ea3bd2378065b1126f
SHA256

89645a4e2cd2e59277326bf86f5a9ab63b3acc8b642056175d69fe9c7f66b5c5
SHA512

c43aed7c1b7f9d8fc556ca900cb7ccaad316fd46737eb517f34890fb36133b1b3c21ede31d0252a01c33e1b9833e8059b25ab469167ea7397362a2a7aa484879

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
4548	msedge.exe
4548	msedge.exe
2532	identity_helper.exe
2532	identity_helper.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 2500	4548	msedge.exe	83
PID 4548 wrote to memory of 2500	4548	msedge.exe	83
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3940	4548	msedge.exe	84
PID 4548 wrote to memory of 3412	4548	msedge.exe	85
PID 4548 wrote to memory of 3412	4548	msedge.exe	85
PID 4548 wrote to memory of 1844	4548	msedge.exe	86
PID 4548 wrote to memory of 1844	4548	msedge.exe	86
PID 4548 wrote to memory of 1844	4548	msedge.exe	86
PID 4548 wrote to memory of 1844	4548	msedge.exe	86
PID 4548 wrote to memory of 1844	4548	msedge.exe	86
PID 4548 wrote to memory of 1844	4548	msedge.exe	86
PID 4548 wrote to memory of 1844	4548	msedge.exe	86
PID 4548 wrote to memory of 1844	4548	msedge.exe	86
PID 4548 wrote to memory of 1844	4548	msedge.exe	86
PID 4548 wrote to memory of 1844	4548	msedge.exe	86
PID 4548 wrote to memory of 1844	4548	msedge.exe	86
PID 4548 wrote to memory of 1844	4548	msedge.exe	86
PID 4548 wrote to memory of 1844	4548	msedge.exe	86
PID 4548 wrote to memory of 1844	4548	msedge.exe	86
PID 4548 wrote to memory of 1844	4548	msedge.exe	86
PID 4548 wrote to memory of 1844	4548	msedge.exe	86
PID 4548 wrote to memory of 1844	4548	msedge.exe	86
PID 4548 wrote to memory of 1844	4548	msedge.exe	86
PID 4548 wrote to memory of 1844	4548	msedge.exe	86
PID 4548 wrote to memory of 1844	4548	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\cf963393950dc0617160f93833411906_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbd4446f8,0x7ffdbd444708,0x7ffdbd444718
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,15275534162943134896,15175510180287800959,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,15275534162943134896,15175510180287800959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,15275534162943134896,15175510180287800959,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15275534162943134896,15175510180287800959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15275534162943134896,15175510180287800959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15275534162943134896,15175510180287800959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,15275534162943134896,15175510180287800959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,15275534162943134896,15175510180287800959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15275534162943134896,15175510180287800959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15275534162943134896,15175510180287800959,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15275534162943134896,15175510180287800959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15275534162943134896,15175510180287800959,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,15275534162943134896,15175510180287800959,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5508 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
561ba63df631e6940d9d5e57af3058ee

SHA1
1d0de8aa7a67f7375970fb0c3f5042d8772c325e

SHA256
866d11cef58e83ed487d8fa4d55624ac8ee6776ee929af26dffe44869f16e020

SHA512
a5f532684ff803fae75415e235f201be9a4e7d45c1a6e95067e0dbd828214688ca4ffed34d28cc76b5912e8e056ac86fa96343bdab23ce08ac4d2ab62b00ae54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ea13318c7c91295e5811d56b2ee006e6

SHA1
ea89e82d14f8524ad69cca0320fd1eb449464ec7

SHA256
6de97115371a79ea01785b49555834758c9b1525d23c225c05ed6a17c93e291b

SHA512
9d8e5384227f88b73f4a2170f95360d876d1ee33c9c74d4a523b4ac837cec53b2b86ff219db9bb86de3f53d482cb0bf9c914ef5baaf7465cee526c8b44ee24e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
74816174f272195fbe6e429175dabee5

SHA1
3b29ecaf0964de3cb3febf873d7a9e5a1cc0f6c7

SHA256
b366ce697a4f48c0a5d78bcdf4c22f539f81c28f73144af509df01997b771f09

SHA512
53eda096106b56cf65bda6b8ca49db7de3c777cb951d8cb13480e745448cd905cebd62fa7b034a460efb2b158a8ee7eda779593098aafe768c8907bfc5f4a5fd

Download Submit