16bbd9a684683ecd6dff4c05a4af0d6930a5affe39448741ddc4a9d7da8db7b3

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d6a48725ed648d2dab90a74e88c29c35_JaffaCakes118.html
Size

62KB
MD5

d6a48725ed648d2dab90a74e88c29c35
SHA1

013e86bb9fcf9a56b3893f1fb7a55d33678d4876
SHA256

16bbd9a684683ecd6dff4c05a4af0d6930a5affe39448741ddc4a9d7da8db7b3
SHA512

c04ec04e2913b122d38b21908f15ef5c474092ed7c3561d2ab16170adea1657a7d6c0fc8da80f94d475400a4e3d5a9666f33b4a0915e544ab20e378b7b98d285
SSDEEP

1536:XLBmpBHgA2i08ZebrAl4NCjJaaujh8N6/Xs4:bBrAV08Ib0lsCjJaaOB

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
644	msedge.exe
644	msedge.exe
3124	msedge.exe
3124	msedge.exe
4940	identity_helper.exe
4940	identity_helper.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 1432	3124	msedge.exe	83
PID 3124 wrote to memory of 1432	3124	msedge.exe	83
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 5088	3124	msedge.exe	84
PID 3124 wrote to memory of 644	3124	msedge.exe	85
PID 3124 wrote to memory of 644	3124	msedge.exe	85
PID 3124 wrote to memory of 5080	3124	msedge.exe	86
PID 3124 wrote to memory of 5080	3124	msedge.exe	86
PID 3124 wrote to memory of 5080	3124	msedge.exe	86
PID 3124 wrote to memory of 5080	3124	msedge.exe	86
PID 3124 wrote to memory of 5080	3124	msedge.exe	86
PID 3124 wrote to memory of 5080	3124	msedge.exe	86
PID 3124 wrote to memory of 5080	3124	msedge.exe	86
PID 3124 wrote to memory of 5080	3124	msedge.exe	86
PID 3124 wrote to memory of 5080	3124	msedge.exe	86
PID 3124 wrote to memory of 5080	3124	msedge.exe	86
PID 3124 wrote to memory of 5080	3124	msedge.exe	86
PID 3124 wrote to memory of 5080	3124	msedge.exe	86
PID 3124 wrote to memory of 5080	3124	msedge.exe	86
PID 3124 wrote to memory of 5080	3124	msedge.exe	86
PID 3124 wrote to memory of 5080	3124	msedge.exe	86
PID 3124 wrote to memory of 5080	3124	msedge.exe	86
PID 3124 wrote to memory of 5080	3124	msedge.exe	86
PID 3124 wrote to memory of 5080	3124	msedge.exe	86
PID 3124 wrote to memory of 5080	3124	msedge.exe	86
PID 3124 wrote to memory of 5080	3124	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d6a48725ed648d2dab90a74e88c29c35_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb057346f8,0x7ffb05734708,0x7ffb05734718
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,10354215487195243775,12083671769025775840,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,10354215487195243775,12083671769025775840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,10354215487195243775,12083671769025775840,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10354215487195243775,12083671769025775840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10354215487195243775,12083671769025775840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,10354215487195243775,12083671769025775840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,10354215487195243775,12083671769025775840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10354215487195243775,12083671769025775840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10354215487195243775,12083671769025775840,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10354215487195243775,12083671769025775840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10354215487195243775,12083671769025775840,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,10354215487195243775,12083671769025775840,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
567B

MD5
2f63f252ca6a7db761984e15e8b32d40

SHA1
3e9a38634bc22c4345d55f29e03625833625fd3c

SHA256
1f20efe7668306baa054fba2c84625ed93cd2ca1c05ba04015ac054d707d0880

SHA512
81241cf1f239f88fd2116b1a00d36bed8bfa7ce430f5e1a37389c647509a5f98aa6fdcc6c69a989bba2eccea28b9f021d5b8b0927c509f5501ae4cc473a825de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e712d188f7a096d2888fabf257d1f357

SHA1
54d22fef760e1fcb46659387d67f27bbb16fd00b

SHA256
2323935e2373bf75dbe351a4ba10fc6742dd092b0b68fadaecd467b18133fe70

SHA512
1ee285ddc15c3117dfa19ddc37a8d3e77b1182b04b052a3b6fe6996725a2b794d5a2cb6cc13aa2f11d184b8d9a1fd86d2f1c5f9bb5125ef63ef59f4bd017eb23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b3a13b57d005ad3364747d64ddfbae11

SHA1
8e05b9b091ff6f97ee9845179bd6a98a0fbabef5

SHA256
aaf70699d0ae38d94796afb3258378a789d964e06d0b42c8aec8758c76bd60f5

SHA512
6352b6f4af6e386757bc85d66677dc10e3aea7b77b78641c49159e87fec66e5e15b728afefe7af89a3ed78f6ba95973feb68b511635f103a80c228aad6d77384

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ac2c5f694e1b512e66117e2dac01b468

SHA1
b20e95b1d71e024146e7306fd64d3351e90454f1

SHA256
8c05eddde9bb184ee6c3d2263a4090f192cc721977a3c1f4cef8e009e23db575

SHA512
e4dc947d73e93ca48307aed3809c388966c5e410caaf2c1fefe17956c831fec80fc65bc2f0558108f876a790fafa8e741eb928b36fc8f490fc1ede59bece6c2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
978a8a5b7f0e09ae6b81987d4abac11b

SHA1
ccfc257c75c4bffd6222c725f9e3d8629a423828

SHA256
8d508aadc5f499fa072b85d1d0de2e170b665d72fada452241b70c92870f0e57

SHA512
b83ef8a6330c3847d2e5605ac77d21dd08c9c4cc197749b3b8e4cf35e3e1d5692dd26c261da0ba6d5bb776aced8515724edebd0414f67ca2fc96062dbdad4ab6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe644f98.TMP

Filesize
372B

MD5
32773ef8651d60e2edba6579bdf76c10

SHA1
b31b0e10cf391fb279386bdd92ec015e44154ea3

SHA256
76f2ec2a92d819a7b455602f9fa3257112bc5960185a0655196fdbe378a4655b

SHA512
e1edf4e4e1c68e018790750f4050e186988fae71eddab6490d28ee44af221a73a86433ef52a737a1b861da917f498bd6ec2e260ae6ebc9cdbd66d8c0f8e5a1d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
56e7fc3e827487088c4d9a2402dd475b

SHA1
487e10cde72fa9f41e9a26ec0e6b223cc4b938c9

SHA256
589269059449ad74ef565100a3069fe417aa6e9a4844c7a20c0dba349f543848

SHA512
cdfe09b12a5077425ac4f19dbfd358b49046fac872197912a6da1a408382db1178e4d3636c3947778d66d183823f7a94a600ff2d5ac33ef025696133aa134cf8

Download Submit