9e4a2f7b39432f2622ecedf172cb1765e96b9e4384a5dd6fe7243fed0570b96d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4fde583c5b0d4bf354bf278c6b86457_JaffaCakes118.html
Size

133KB
MD5

d4fde583c5b0d4bf354bf278c6b86457
SHA1

cafe0eb491ca5a753d145c347af2577fd0f116ab
SHA256

9e4a2f7b39432f2622ecedf172cb1765e96b9e4384a5dd6fe7243fed0570b96d
SHA512

195a44f45b250eb8b923ac29c3b6a70c808d5b39ce9c5739963d0f93a710c06c8449b9c4692a2c4df42396a1e36e93e76fb01cd7fbe0f241b088f06cf7bbf0ac
SSDEEP

1536:zPZydlEbbA99YZHqRHHEExx66++IIddtt77bbSSSSccllbbFFDD998811qquuHH8:z4dlEbbA99YhV

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3060	msedge.exe
3060	msedge.exe
4508	msedge.exe
4508	msedge.exe
1944	identity_helper.exe
1944	identity_helper.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 2336	4508	msedge.exe	83
PID 4508 wrote to memory of 2336	4508	msedge.exe	83
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 1520	4508	msedge.exe	84
PID 4508 wrote to memory of 3060	4508	msedge.exe	85
PID 4508 wrote to memory of 3060	4508	msedge.exe	85
PID 4508 wrote to memory of 2540	4508	msedge.exe	86
PID 4508 wrote to memory of 2540	4508	msedge.exe	86
PID 4508 wrote to memory of 2540	4508	msedge.exe	86
PID 4508 wrote to memory of 2540	4508	msedge.exe	86
PID 4508 wrote to memory of 2540	4508	msedge.exe	86
PID 4508 wrote to memory of 2540	4508	msedge.exe	86
PID 4508 wrote to memory of 2540	4508	msedge.exe	86
PID 4508 wrote to memory of 2540	4508	msedge.exe	86
PID 4508 wrote to memory of 2540	4508	msedge.exe	86
PID 4508 wrote to memory of 2540	4508	msedge.exe	86
PID 4508 wrote to memory of 2540	4508	msedge.exe	86
PID 4508 wrote to memory of 2540	4508	msedge.exe	86
PID 4508 wrote to memory of 2540	4508	msedge.exe	86
PID 4508 wrote to memory of 2540	4508	msedge.exe	86
PID 4508 wrote to memory of 2540	4508	msedge.exe	86
PID 4508 wrote to memory of 2540	4508	msedge.exe	86
PID 4508 wrote to memory of 2540	4508	msedge.exe	86
PID 4508 wrote to memory of 2540	4508	msedge.exe	86
PID 4508 wrote to memory of 2540	4508	msedge.exe	86
PID 4508 wrote to memory of 2540	4508	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d4fde583c5b0d4bf354bf278c6b86457_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbd21b46f8,0x7ffbd21b4708,0x7ffbd21b4718
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,17406971413829214704,768775933854785886,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2240,17406971413829214704,768775933854785886,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2240,17406971413829214704,768775933854785886,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,17406971413829214704,768775933854785886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,17406971413829214704,768775933854785886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,17406971413829214704,768775933854785886,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,17406971413829214704,768775933854785886,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,17406971413829214704,768775933854785886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,17406971413829214704,768775933854785886,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,17406971413829214704,768775933854785886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,17406971413829214704,768775933854785886,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,17406971413829214704,768775933854785886,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4824 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2aaef131-07c3-445b-a210-24e72e7f1b71.tmp

Filesize
10KB

MD5
5f03669075aed37e29cc4024ba6346a6

SHA1
e9fce52e9f17b06348078650836ed71c618f2fe5

SHA256
de50e8e4ec44561e2d7d284d542650fb9ef4930370e41909c8bb3a3a68c64519

SHA512
eedd59fabda7bb3db96a10c108887fc64ccfa1e482762fbc0609454e50e7127b561697c45e280e24797302d3064b130e230586b0581dde1b650ccc37ad436e28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ac1bf7ad253ae2542d4c656199b13fe1

SHA1
b53ff9a520436f4273b500a1984d6e3f935dce78

SHA256
024d6c2c1bfe193b94dbb2bb2915fd7b2831260d04d6308cf14ff6abc7c55673

SHA512
39a310be208c74878158af2230879edd4553e806163d461aafe670c9bee2ffda9e66f1970ed07fe79ad170739153d58e1873b146462b2e8806b4eee63642a2f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
890ae924d80da3b176ad43239f2af175

SHA1
ce11085a684203669d8e5650e68db0d11870c8cc

SHA256
078caf3c042704fcde9b811c46c8469f93246761992bd81a841518bebb910c2a

SHA512
02587ae311dabd49b77e5f8d953ec036dd885914e59707d0ec291e14d67c4bb54f2984973552dea3c7c30be819a46e10fc6b30b749661d0ecf13279d427761a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
055ccfda43a52698226f16226f386f10

SHA1
be1e87e8d8f8a878fa015252a2d113840af8c880

SHA256
8fd4e7ce379bc6215fe98af8fdbf272f194f15747b5f8ceae8a23a1fcf101252

SHA512
44c1e942ebbd12f3c9b4804338baf01fa82a032627621bfb76492fd0ed5dc53116624c39d88e856b30bddcf5a8698b15618e166bb7d08148e9d68120ac303469

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit