5e8e850dbf2e6ee11e08d386510e2ca2af0793ef7fbb67f5a01ee9d24b552bb2

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 15:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d241cd56d92b148a05df27ca791ab031_JaffaCakes118.html
Size

151KB
MD5

d241cd56d92b148a05df27ca791ab031
SHA1

94a95bdd4906789b33d8309550f08ec5ff3669cf
SHA256

5e8e850dbf2e6ee11e08d386510e2ca2af0793ef7fbb67f5a01ee9d24b552bb2
SHA512

1977b8f04cd4f4d1683af64fb6a7813f0283bdf2d3547c6c0b9a3f92b8c4323614be04600b29ad7d3e7de627f1c5fafa4ef07e14544559d31653806f5ed85fe4
SSDEEP

1536:pqDohUooppWWBBkkaazzKKII66MMKKlljjFFNNllQQHHQQjjEECChh66xxxx++Bs:ADoA1YmST+U1CuxdtAW

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4216	msedge.exe
4216	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
1952	identity_helper.exe
1952	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 2408	4216	msedge.exe	84
PID 4216 wrote to memory of 2408	4216	msedge.exe	84
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 2596	4216	msedge.exe	85
PID 4216 wrote to memory of 4984	4216	msedge.exe	86
PID 4216 wrote to memory of 4984	4216	msedge.exe	86
PID 4216 wrote to memory of 4688	4216	msedge.exe	87
PID 4216 wrote to memory of 4688	4216	msedge.exe	87
PID 4216 wrote to memory of 4688	4216	msedge.exe	87
PID 4216 wrote to memory of 4688	4216	msedge.exe	87
PID 4216 wrote to memory of 4688	4216	msedge.exe	87
PID 4216 wrote to memory of 4688	4216	msedge.exe	87
PID 4216 wrote to memory of 4688	4216	msedge.exe	87
PID 4216 wrote to memory of 4688	4216	msedge.exe	87
PID 4216 wrote to memory of 4688	4216	msedge.exe	87
PID 4216 wrote to memory of 4688	4216	msedge.exe	87
PID 4216 wrote to memory of 4688	4216	msedge.exe	87
PID 4216 wrote to memory of 4688	4216	msedge.exe	87
PID 4216 wrote to memory of 4688	4216	msedge.exe	87
PID 4216 wrote to memory of 4688	4216	msedge.exe	87
PID 4216 wrote to memory of 4688	4216	msedge.exe	87
PID 4216 wrote to memory of 4688	4216	msedge.exe	87
PID 4216 wrote to memory of 4688	4216	msedge.exe	87
PID 4216 wrote to memory of 4688	4216	msedge.exe	87
PID 4216 wrote to memory of 4688	4216	msedge.exe	87
PID 4216 wrote to memory of 4688	4216	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d241cd56d92b148a05df27ca791ab031_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff99b1146f8,0x7ff99b114708,0x7ff99b114718
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,2095083735722447142,6485210815671080678,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,2095083735722447142,6485210815671080678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,2095083735722447142,6485210815671080678,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2095083735722447142,6485210815671080678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2095083735722447142,6485210815671080678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,2095083735722447142,6485210815671080678,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,2095083735722447142,6485210815671080678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4584 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,2095083735722447142,6485210815671080678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4584 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2095083735722447142,6485210815671080678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2095083735722447142,6485210815671080678,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2095083735722447142,6485210815671080678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2095083735722447142,6485210815671080678,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2140 /prefetch:1
  2⤵
  PID:216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
271B

MD5
d210be6d1eaa3c04315de1249c78e400

SHA1
95379f43dbffa4e57b924e3392d7caea0a463c1f

SHA256
a669f3ebaa2808158481a62cb3469fcf5183abd88eb08b29ca834faf30a69e92

SHA512
065c145367880c428011d91ab33561b7b24e9da9baa5c1c77b8d5301e4b978d7d487f17cfb3cae68f86bdfebf6ff47fb1a61cf8ed3eaeff34fee7b73c0e198d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6d14f9e8ba9d9d7fc23fb637dfdfcbb2

SHA1
7b57842cd9c28b9823ecb606c1cff9e2570c40b0

SHA256
4e8ff17a8575c95ace5d064eaf55a932003e1a2ec341a4012c3645c4fc570ac3

SHA512
5d5f33da7803878e55bdc6a2d5d154f5bf33d4496445a3fe1012087980bc37610d171992a17ca66ad04ffdd8809daf465e586d9e881f2c059aaa859c03368f22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
06ee76e476391ac5a1d8a20ffc9aeb1c

SHA1
8c7f42015597bbfadf542aa4b4bc8028d0f7269b

SHA256
21e37b0684c1a76c75d76ef3838d4e412fbe05de31a96c50aea93a120ef58c24

SHA512
cc1393068e030f28acaaf7cd5793de9f79f0a3e608792891c36bed194fea20303e3e689a0549cff2b6fd5a16423ec23a703f2f6ed7ff77de99541c1d2a3d0000

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
68caebf2784800a470b9ad4290f0695b

SHA1
f40d1caa72a406cddd80623d8589dbf2b1dd8cc1

SHA256
4fa30052f1c83e774f42d37aab0f078fa0000e86e763177c08af9753b5b1ccd2

SHA512
0b9b43418424a2c1dd2c925b35c79453b3f7b2357c6a3023f95b8a7f3cb5a9b2304aa976c73ccb53c210d99fab80b9f38b073907ab199502e275400503698948

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
8cf235101a546398e540cc415542f200

SHA1
f1c187c680058ec1123cb8e28e3b691ccff72295

SHA256
63359c0e5fb6267bb47a6e11fc2b44d43daf03864db8b117ca8423eb763d6467

SHA512
04677c6ea1076af5c692b61850374b9256fadc44c65b199511e78432800d0669784ed3cd360137ce210cd0d30a67bf951dbc91bebfa1bbe6c40d51def2b3c199

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59115b.TMP

Filesize
203B

MD5
d255a34d33e152b4911d7746bdc1984a

SHA1
c5be2c0526a390c66148d71872bd692f27455e19

SHA256
5981e526c32fb962e682f1af10e0ba707458c43640c5f22dba904c6257e37f14

SHA512
7f58eac845221d4d71b2834b47ac1354395c2ddc0eaa3d73421610b435d1d45c584d1362e65414793f1d7846a68f1da6cf3e2c5ffdd927fd316ee9780628ebed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0f129368f6118f20b73b284644669b0e

SHA1
6761e6e5e35833763d5d560cf1010fe578a0e6b3

SHA256
8da7c3ec610b58ba4516afe52e33e9f852ac70ae9e12ececf5bcc6f49ae925d3

SHA512
5b6d286943e1f0502fee64d274e21a6d0d661bf99d50f1c32cf8d1d285c89e2ea1aabab1fb4bf6759dbaedc63290786825f0900459d5727d5e9db3fc3932bd3a

Download Submit