4b8dc665ae83bcf6c6d154fc1cda2085c623ac6ce39cdcd8c9d2934b89858c29

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 16:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cff1087894b42ce1ffcbc6c39e953bf5_JaffaCakes118.html
Size

69KB
MD5

cff1087894b42ce1ffcbc6c39e953bf5
SHA1

a56511c3d6b78521ca783c24d5476def4b67fbde
SHA256

4b8dc665ae83bcf6c6d154fc1cda2085c623ac6ce39cdcd8c9d2934b89858c29
SHA512

2521615b94f5a55f8a8e9adeb6d2c69327444f014799b37d2fc558b1bd103fa2ae9ac91265ff4bfb3031bed26dc981618d4152f790d1dd23b138cffc10734647
SSDEEP

1536:JCC+yfE+KfqzNsjzJuAIPHFASxfJ7dmgKXzHEgKdahTdXcfk3iW3mRubRCtASH/P:OqRsyVWGud12Vt

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1904	msedge.exe
1904	msedge.exe
1332	msedge.exe
1332	msedge.exe
3188	identity_helper.exe
3188	identity_helper.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 1176	1332	msedge.exe	83
PID 1332 wrote to memory of 1176	1332	msedge.exe	83
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 4804	1332	msedge.exe	84
PID 1332 wrote to memory of 1904	1332	msedge.exe	85
PID 1332 wrote to memory of 1904	1332	msedge.exe	85
PID 1332 wrote to memory of 2392	1332	msedge.exe	86
PID 1332 wrote to memory of 2392	1332	msedge.exe	86
PID 1332 wrote to memory of 2392	1332	msedge.exe	86
PID 1332 wrote to memory of 2392	1332	msedge.exe	86
PID 1332 wrote to memory of 2392	1332	msedge.exe	86
PID 1332 wrote to memory of 2392	1332	msedge.exe	86
PID 1332 wrote to memory of 2392	1332	msedge.exe	86
PID 1332 wrote to memory of 2392	1332	msedge.exe	86
PID 1332 wrote to memory of 2392	1332	msedge.exe	86
PID 1332 wrote to memory of 2392	1332	msedge.exe	86
PID 1332 wrote to memory of 2392	1332	msedge.exe	86
PID 1332 wrote to memory of 2392	1332	msedge.exe	86
PID 1332 wrote to memory of 2392	1332	msedge.exe	86
PID 1332 wrote to memory of 2392	1332	msedge.exe	86
PID 1332 wrote to memory of 2392	1332	msedge.exe	86
PID 1332 wrote to memory of 2392	1332	msedge.exe	86
PID 1332 wrote to memory of 2392	1332	msedge.exe	86
PID 1332 wrote to memory of 2392	1332	msedge.exe	86
PID 1332 wrote to memory of 2392	1332	msedge.exe	86
PID 1332 wrote to memory of 2392	1332	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\cff1087894b42ce1ffcbc6c39e953bf5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde23f46f8,0x7ffde23f4708,0x7ffde23f4718
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,17207983784883880222,6739961609131311388,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,17207983784883880222,6739961609131311388,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,17207983784883880222,6739961609131311388,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17207983784883880222,6739961609131311388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17207983784883880222,6739961609131311388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17207983784883880222,6739961609131311388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,17207983784883880222,6739961609131311388,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,17207983784883880222,6739961609131311388,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17207983784883880222,6739961609131311388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17207983784883880222,6739961609131311388,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17207983784883880222,6739961609131311388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17207983784883880222,6739961609131311388,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,17207983784883880222,6739961609131311388,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4740 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
721B

MD5
3619532a4886020f6ff0a24a2c8dfc9a

SHA1
03c27e64402fe82ef3189e4f10e6e6fec3d85262

SHA256
e52632f1f562b888aa2ad1878e83332557c2dd669e873a587b45308b16faa607

SHA512
43553a10f340602b42443bf19bf04180f0d0050601e99674efbef1ab52aa78e90d6e3860a7ad5d0063003f87c02b452c58c6bfbd04c4af431fee9b5478ef0977

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3f809eae77aea22c2b7a6e2017d8bdca

SHA1
17599966a5d40101e82b6adb70a73935d757ea8e

SHA256
6f7b2909feb50e3afa89365ed0bc5442a8f2e6c4c7c731d3d1e3b36b768193f9

SHA512
077ac1766e7552d821beacaf001b6b39c13196c59ddaddbe7015f3be2fd5934f1b1f3f4cc6a85750f2585fff88a9e1a72f9b8a1be96df878ec86f5f80c21b734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e281a6dff9c3623957f05575749db769

SHA1
a9f13bea87cc2d3484d5c2c24537d02ad55eaa49

SHA256
a5167a63fdd158ad413355fb808a4fd436138d92511a920a61685e3de649211f

SHA512
8d79a027fafdd76ef79788211e940759bf6f2936b7c64f781e6d95e56833725f2dcf30de333d03840e2cb9423e55f1f97fa0d228012b3cd5a102a1419628e4de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9af8cc811d8e8958559287202d138d4e

SHA1
f5b63da7ed79fbe4c7a9e60d0df31ef0893440ba

SHA256
3c40a5868168b36ae4a2b7c3edec7fc26b5f893bbf94cfdf4c89ad07733690ac

SHA512
87c5629139a14c1f8251944d513cab416acdead87a35b9819ac085a59d307548607537711c2b8b073b35da448725a63295d23a464720babab0e3f9b91cd9be9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a0392ab470a8ae5997f51fcae8b41834

SHA1
116946de0c54ec1b2c1367b8c05dc9b3e89041ef

SHA256
4c3d9af5dc245ce6778d3929d1794c2db5771e9b733ef83179c6a919e6bd3a5c

SHA512
4ae25558901da8fa2403365a5854c89d21f6d9e897e78460b7a762ed152b70522e2ed7fd83f284da04e1032e6ec30e3cec97fe8ed7a32a384765030bd61ba157

Download Submit